Windows Analysis Report
03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe

Overview

General Information

Sample name: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe
renamed because original name is a hash value
Original sample name: 03.07.2024-sipari UG01072410 -onka ve Tic a.s.exe
Analysis ID: 1467080
MD5: 22f3e4a1d074aec6cbc7314efd0f53e0
SHA1: 169c6970364d5f8b75efe451a38d7a91b1b47f6b
SHA256: 2d6eb4f35570a71972008b6f1e3572aaab6d0ef97e19c42dbc68aeb57b670964
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Deletes itself after installation
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses shutdown.exe to shutdown or reboot the system
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe ReversingLabs: Detection: 28%
Yara detected FormBook
Source: Yara match File source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.2563757906.0000000003700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2561298319.0000000003230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2563222127.0000000000FA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2213669414.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2214051577.0000000001250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2563650828.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2215409822.0000000001AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2563123525.0000000002F70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: fTTh.pdb source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000000.2140611303.0000000000EAE000.00000002.00000001.01000000.0000000C.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000E.00000002.2563006189.0000000000EAE000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: wntdll.pdbUGP source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000005.00000002.2214355002.0000000001700000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000003.2215943559.0000000003797000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000002.2564318778.0000000003ADE000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000003.2213972420.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000002.2564318778.0000000003940000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: shutdown.pdbGCTL source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000005.00000002.2214174481.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000002.2562237583.0000000001458000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000005.00000002.2214355002.0000000001700000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, shutdown.exe, 0000000D.00000003.2215943559.0000000003797000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000002.2564318778.0000000003ADE000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000003.2213972420.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000002.2564318778.0000000003940000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: shutdown.pdb source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000005.00000002.2214174481.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000002.2562237583.0000000001458000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: fTTh.pdbSHA256x source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0324C240 FindFirstFileW,FindNextFileW,FindClose, 13_2_0324C240
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 4x nop then jmp 02CD4B0Ch 0_2_02CD46DE
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 4x nop then xor eax, eax 13_2_03239780
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 4x nop then mov ebx, 00000004h 13_2_03C9053E

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.9:49715 -> 91.195.240.19:80
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 91.195.240.19 91.195.240.19
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SEDO-ASDE SEDO-ASDE
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /ucdm/?j2=EKdombQUikql/e8x5w/b0WRCZZ7GjewvGt5yqJ62oMuwgaHfKWbffkwAJSwjzlHKlyNbdgTciiNebF1Tnxx1ssE7dAszzRsyY0LYOFUjrmAhIYA2gw==&NbL=5XSdkb2PqtnPh8PP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Host: www.fungusbus.comConnection: closeUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2483.0 Safari/537.36
Source: global traffic DNS traffic detected: DNS query: www.betful.site
Source: global traffic DNS traffic detected: DNS query: www.deviexp.com
Source: global traffic DNS traffic detected: DNS query: www.fungusbus.com
Source: global traffic HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000000.00000002.1329890365.0000000002F50000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: shutdown.exe, 0000000D.00000003.2493335987.0000000008318000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: shutdown.exe, 0000000D.00000003.2493335987.0000000008318000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: shutdown.exe, 0000000D.00000003.2493335987.0000000008318000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: shutdown.exe, 0000000D.00000003.2493335987.0000000008318000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: shutdown.exe, 0000000D.00000003.2493335987.0000000008318000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: shutdown.exe, 0000000D.00000003.2493335987.0000000008318000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: shutdown.exe, 0000000D.00000003.2493335987.0000000008318000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: shutdown.exe, 0000000D.00000002.2561874080.000000000344B000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000002.2561874080.000000000341E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: shutdown.exe, 0000000D.00000002.2561874080.000000000344B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: shutdown.exe, 0000000D.00000003.2489693718.000000000824A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: shutdown.exe, 0000000D.00000002.2561874080.000000000341E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: shutdown.exe, 0000000D.00000002.2561874080.000000000341E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=10333NB
Source: shutdown.exe, 0000000D.00000002.2561874080.000000000341E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: shutdown.exe, 0000000D.00000002.2561874080.000000000344B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: shutdown.exe, 0000000D.00000003.2493335987.0000000008318000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: shutdown.exe, 0000000D.00000003.2493335987.0000000008318000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.2563757906.0000000003700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2561298319.0000000003230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2563222127.0000000000FA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2213669414.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2214051577.0000000001250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2563650828.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2215409822.0000000001AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2563123525.0000000002F70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.2563757906.0000000003700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.2561298319.0000000003230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.2563222127.0000000000FA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2213669414.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2214051577.0000000001250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.2563650828.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2215409822.0000000001AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000C.00000002.2563123525.0000000002F70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
.NET source code contains very large array initializations
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.2dbc398.1.raw.unpack, -Module-.cs Large array initialization: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E: array initializer size 3088
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.7540000.3.raw.unpack, -Module-.cs Large array initialization: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E: array initializer size 3088
Uses shutdown.exe to shutdown or reboot the system
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe"
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process Stats: CPU usage > 49%
Contains functionality to call native functions
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0042B863 NtClose, 5_2_0042B863
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772B60 NtClose,LdrInitializeThunk, 5_2_01772B60
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772DF0 NtQuerySystemInformation,LdrInitializeThunk, 5_2_01772DF0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772C70 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_01772C70
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017735C0 NtCreateMutant,LdrInitializeThunk, 5_2_017735C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01774340 NtSetContextThread, 5_2_01774340
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01774650 NtSuspendThread, 5_2_01774650
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772BF0 NtAllocateVirtualMemory, 5_2_01772BF0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772BE0 NtQueryValueKey, 5_2_01772BE0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772BA0 NtEnumerateValueKey, 5_2_01772BA0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772B80 NtQueryInformationFile, 5_2_01772B80
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772AF0 NtWriteFile, 5_2_01772AF0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772AD0 NtReadFile, 5_2_01772AD0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772AB0 NtWaitForSingleObject, 5_2_01772AB0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772D30 NtUnmapViewOfSection, 5_2_01772D30
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772D10 NtMapViewOfSection, 5_2_01772D10
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772D00 NtSetInformationFile, 5_2_01772D00
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772DD0 NtDelayExecution, 5_2_01772DD0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772DB0 NtEnumerateKey, 5_2_01772DB0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772C60 NtCreateKey, 5_2_01772C60
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772C00 NtQueryInformationProcess, 5_2_01772C00
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772CF0 NtOpenProcess, 5_2_01772CF0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772CC0 NtQueryVirtualMemory, 5_2_01772CC0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772CA0 NtQueryInformationToken, 5_2_01772CA0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772F60 NtCreateProcessEx, 5_2_01772F60
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772F30 NtCreateSection, 5_2_01772F30
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772FE0 NtCreateFile, 5_2_01772FE0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772FB0 NtResumeThread, 5_2_01772FB0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772FA0 NtQuerySection, 5_2_01772FA0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772F90 NtProtectVirtualMemory, 5_2_01772F90
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772E30 NtWriteVirtualMemory, 5_2_01772E30
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772EE0 NtQueueApcThread, 5_2_01772EE0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772EA0 NtAdjustPrivilegesToken, 5_2_01772EA0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772E80 NtReadVirtualMemory, 5_2_01772E80
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01773010 NtOpenDirectoryObject, 5_2_01773010
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01773090 NtSetValueKey, 5_2_01773090
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017739B0 NtGetContextThread, 5_2_017739B0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01773D70 NtOpenThread, 5_2_01773D70
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01773D10 NtOpenProcessToken, 5_2_01773D10
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B4340 NtSetContextThread,LdrInitializeThunk, 13_2_039B4340
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B4650 NtSuspendThread,LdrInitializeThunk, 13_2_039B4650
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2BA0 NtEnumerateValueKey,LdrInitializeThunk, 13_2_039B2BA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 13_2_039B2BF0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2BE0 NtQueryValueKey,LdrInitializeThunk, 13_2_039B2BE0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2B60 NtClose,LdrInitializeThunk, 13_2_039B2B60
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2AD0 NtReadFile,LdrInitializeThunk, 13_2_039B2AD0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2AF0 NtWriteFile,LdrInitializeThunk, 13_2_039B2AF0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2FB0 NtResumeThread,LdrInitializeThunk, 13_2_039B2FB0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2FE0 NtCreateFile,LdrInitializeThunk, 13_2_039B2FE0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2F30 NtCreateSection,LdrInitializeThunk, 13_2_039B2F30
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2E80 NtReadVirtualMemory,LdrInitializeThunk, 13_2_039B2E80
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2EE0 NtQueueApcThread,LdrInitializeThunk, 13_2_039B2EE0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2DD0 NtDelayExecution,LdrInitializeThunk, 13_2_039B2DD0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2DF0 NtQuerySystemInformation,LdrInitializeThunk, 13_2_039B2DF0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2D10 NtMapViewOfSection,LdrInitializeThunk, 13_2_039B2D10
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2D30 NtUnmapViewOfSection,LdrInitializeThunk, 13_2_039B2D30
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2CA0 NtQueryInformationToken,LdrInitializeThunk, 13_2_039B2CA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2C70 NtFreeVirtualMemory,LdrInitializeThunk, 13_2_039B2C70
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2C60 NtCreateKey,LdrInitializeThunk, 13_2_039B2C60
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B35C0 NtCreateMutant,LdrInitializeThunk, 13_2_039B35C0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B39B0 NtGetContextThread,LdrInitializeThunk, 13_2_039B39B0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2B80 NtQueryInformationFile, 13_2_039B2B80
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2AB0 NtWaitForSingleObject, 13_2_039B2AB0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2F90 NtProtectVirtualMemory, 13_2_039B2F90
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2FA0 NtQuerySection, 13_2_039B2FA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2F60 NtCreateProcessEx, 13_2_039B2F60
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2EA0 NtAdjustPrivilegesToken, 13_2_039B2EA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2E30 NtWriteVirtualMemory, 13_2_039B2E30
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2DB0 NtEnumerateKey, 13_2_039B2DB0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2D00 NtSetInformationFile, 13_2_039B2D00
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2CC0 NtQueryVirtualMemory, 13_2_039B2CC0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2CF0 NtOpenProcess, 13_2_039B2CF0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B2C00 NtQueryInformationProcess, 13_2_039B2C00
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B3090 NtSetValueKey, 13_2_039B3090
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B3010 NtOpenDirectoryObject, 13_2_039B3010
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B3D10 NtOpenProcessToken, 13_2_039B3D10
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B3D70 NtOpenThread, 13_2_039B3D70
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03258240 NtDeleteFile, 13_2_03258240
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_032582D0 NtClose, 13_2_032582D0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03258160 NtReadFile, 13_2_03258160
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03258000 NtCreateFile, 13_2_03258000
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03258420 NtAllocateVirtualMemory, 13_2_03258420
Detected potential crypto function
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_0105D364 0_2_0105D364
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_02CD6250 0_2_02CD6250
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_02CD1BA0 0_2_02CD1BA0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_02CD1198 0_2_02CD1198
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_02CD1197 0_2_02CD1197
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_02CD7178 0_2_02CD7178
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_05367D58 0_2_05367D58
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_05360006 0_2_05360006
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_05360040 0_2_05360040
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_0536AEB0 0_2_0536AEB0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F8788 0_2_072F8788
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F1060 0_2_072F1060
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F7F28 0_2_072F7F28
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F3D50 0_2_072F3D50
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F877B 0_2_072F877B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072FF6B8 0_2_072FF6B8
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F2460 0_2_072F2460
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F2450 0_2_072F2450
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F7F18 0_2_072F7F18
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F0F89 0_2_072F0F89
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F3EE3 0_2_072F3EE3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F3D42 0_2_072F3D42
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F3CC8 0_2_072F3CC8
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F1918 0_2_072F1918
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F1912 0_2_072F1912
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F7967 0_2_072F7967
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F7978 0_2_072F7978
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0040E823 5_2_0040E823
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00403320 5_2_00403320
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0042DC93 5_2_0042DC93
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0041057A 5_2_0041057A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0040257E 5_2_0040257E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00402500 5_2_00402500
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00410583 5_2_00410583
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00416EB3 5_2_00416EB3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_004027EB 5_2_004027EB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_004027F0 5_2_004027F0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00402F98 5_2_00402F98
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00402FA0 5_2_00402FA0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_004107A3 5_2_004107A3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C8158 5_2_017C8158
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_018001AA 5_2_018001AA
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DA118 5_2_017DA118
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01730100 5_2_01730100
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F81CC 5_2_017F81CC
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F41A2 5_2_017F41A2
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D2000 5_2_017D2000
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FA352 5_2_017FA352
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_018003E6 5_2_018003E6
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174E3F0 5_2_0174E3F0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C02C0 5_2_017C02C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01800591 5_2_01800591
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740535 5_2_01740535
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F2446 5_2_017F2446
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E4420 5_2_017E4420
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017EE4F6 5_2_017EE4F6
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01764750 5_2_01764750
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173C7C0 5_2_0173C7C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175C6E0 5_2_0175C6E0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01756962 5_2_01756962
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0180A9A6 5_2_0180A9A6
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174A840 5_2_0174A840
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01742840 5_2_01742840
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E8F0 5_2_0176E8F0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017268B8 5_2_017268B8
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FAB40 5_2_017FAB40
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F6BD7 5_2_017F6BD7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173EA80 5_2_0173EA80
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DCD1F 5_2_017DCD1F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174AD00 5_2_0174AD00
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173ADE0 5_2_0173ADE0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01758DBF 5_2_01758DBF
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740C00 5_2_01740C00
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01730CF2 5_2_01730CF2
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0CB5 5_2_017E0CB5
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B4F40 5_2_017B4F40
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01760F30 5_2_01760F30
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E2F30 5_2_017E2F30
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01782F28 5_2_01782F28
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174CFE0 5_2_0174CFE0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01732FC8 5_2_01732FC8
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BEFA0 5_2_017BEFA0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740E59 5_2_01740E59
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FEE26 5_2_017FEE26
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FEEDB 5_2_017FEEDB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01752E90 5_2_01752E90
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FCE93 5_2_017FCE93
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172F172 5_2_0172F172
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0177516C 5_2_0177516C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174B1B0 5_2_0174B1B0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0180B16B 5_2_0180B16B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F70E9 5_2_017F70E9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FF0E0 5_2_017FF0E0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017EF0CC 5_2_017EF0CC
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017470C0 5_2_017470C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172D34C 5_2_0172D34C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F132D 5_2_017F132D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0178739A 5_2_0178739A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E12ED 5_2_017E12ED
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175B2C0 5_2_0175B2C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017452A0 5_2_017452A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F7571 5_2_017F7571
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_018095C3 5_2_018095C3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DD5B0 5_2_017DD5B0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01731460 5_2_01731460
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FF43F 5_2_017FF43F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FF7B0 5_2_017FF7B0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01785630 5_2_01785630
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F16CC 5_2_017F16CC
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01749950 5_2_01749950
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175B950 5_2_0175B950
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D5910 5_2_017D5910
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AD800 5_2_017AD800
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017438E0 5_2_017438E0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FFB76 5_2_017FFB76
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B5BF0 5_2_017B5BF0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0177DBF9 5_2_0177DBF9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175FB80 5_2_0175FB80
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B3A6C 5_2_017B3A6C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FFA49 5_2_017FFA49
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F7A46 5_2_017F7A46
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017EDAC6 5_2_017EDAC6
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DDAAC 5_2_017DDAAC
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01785AA0 5_2_01785AA0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E1AA3 5_2_017E1AA3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F7D73 5_2_017F7D73
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F1D5A 5_2_017F1D5A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01743D40 5_2_01743D40
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175FDC0 5_2_0175FDC0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B9C32 5_2_017B9C32
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FFCF2 5_2_017FFCF2
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FFF09 5_2_017FFF09
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01703FD2 5_2_01703FD2
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01703FD5 5_2_01703FD5
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FFFB1 5_2_017FFFB1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01741F92 5_2_01741F92
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01749EB0 5_2_01749EB0
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Code function: 12_2_03198B1D 12_2_03198B1D
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Code function: 12_2_0317B62D 12_2_0317B62D
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Code function: 12_2_031796AD 12_2_031796AD
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Code function: 12_2_03181D3D 12_2_03181D3D
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Code function: 12_2_0317B404 12_2_0317B404
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Code function: 12_2_0317B40D 12_2_0317B40D
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A403E6 13_2_03A403E6
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0398E3F0 13_2_0398E3F0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3A352 13_2_03A3A352
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A002C0 13_2_03A002C0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A20274 13_2_03A20274
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A341A2 13_2_03A341A2
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A401AA 13_2_03A401AA
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A381CC 13_2_03A381CC
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03970100 13_2_03970100
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A1A118 13_2_03A1A118
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A08158 13_2_03A08158
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A12000 13_2_03A12000
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0397C7C0 13_2_0397C7C0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039A4750 13_2_039A4750
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03980770 13_2_03980770
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0399C6E0 13_2_0399C6E0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A40591 13_2_03A40591
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03980535 13_2_03980535
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A2E4F6 13_2_03A2E4F6
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A24420 13_2_03A24420
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A32446 13_2_03A32446
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A36BD7 13_2_03A36BD7
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3AB40 13_2_03A3AB40
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0397EA80 13_2_0397EA80
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A4A9A6 13_2_03A4A9A6
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039829A0 13_2_039829A0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03996962 13_2_03996962
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039668B8 13_2_039668B8
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039AE8F0 13_2_039AE8F0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0398A840 13_2_0398A840
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03982840 13_2_03982840
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039FEFA0 13_2_039FEFA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03972FC8 13_2_03972FC8
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0398CFE0 13_2_0398CFE0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A22F30 13_2_03A22F30
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039A0F30 13_2_039A0F30
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039C2F28 13_2_039C2F28
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039F4F40 13_2_039F4F40
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03992E90 13_2_03992E90
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3CE93 13_2_03A3CE93
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3EEDB 13_2_03A3EEDB
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3EE26 13_2_03A3EE26
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03980E59 13_2_03980E59
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03998DBF 13_2_03998DBF
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0397ADE0 13_2_0397ADE0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0398AD00 13_2_0398AD00
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A1CD1F 13_2_03A1CD1F
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A20CB5 13_2_03A20CB5
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03970CF2 13_2_03970CF2
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03980C00 13_2_03980C00
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039C739A 13_2_039C739A
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3132D 13_2_03A3132D
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0396D34C 13_2_0396D34C
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039852A0 13_2_039852A0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A212ED 13_2_03A212ED
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0399B2C0 13_2_0399B2C0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0398B1B0 13_2_0398B1B0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A4B16B 13_2_03A4B16B
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0396F172 13_2_0396F172
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039B516C 13_2_039B516C
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3F0E0 13_2_03A3F0E0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A370E9 13_2_03A370E9
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039870C0 13_2_039870C0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A2F0CC 13_2_03A2F0CC
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3F7B0 13_2_03A3F7B0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A316CC 13_2_03A316CC
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039C5630 13_2_039C5630
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A1D5B0 13_2_03A1D5B0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A495C3 13_2_03A495C3
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A37571 13_2_03A37571
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3F43F 13_2_03A3F43F
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03971460 13_2_03971460
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0399FB80 13_2_0399FB80
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039BDBF9 13_2_039BDBF9
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039F5BF0 13_2_039F5BF0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3FB76 13_2_03A3FB76
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A21AA3 13_2_03A21AA3
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A1DAAC 13_2_03A1DAAC
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039C5AA0 13_2_039C5AA0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A2DAC6 13_2_03A2DAC6
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A37A46 13_2_03A37A46
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3FA49 13_2_03A3FA49
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039F3A6C 13_2_039F3A6C
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A15910 13_2_03A15910
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03989950 13_2_03989950
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0399B950 13_2_0399B950
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039838E0 13_2_039838E0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039ED800 13_2_039ED800
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03981F92 13_2_03981F92
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3FFB1 13_2_03A3FFB1
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03943FD5 13_2_03943FD5
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03943FD2 13_2_03943FD2
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3FF09 13_2_03A3FF09
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03989EB0 13_2_03989EB0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0399FDC0 13_2_0399FDC0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A37D73 13_2_03A37D73
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03983D40 13_2_03983D40
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A31D5A 13_2_03A31D5A
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03A3FCF2 13_2_03A3FCF2
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_039F9C32 13_2_039F9C32
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03241DE0 13_2_03241DE0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0325A700 13_2_0325A700
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0323CFE7 13_2_0323CFE7
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0323CFF0 13_2_0323CFF0
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0323D210 13_2_0323D210
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0323B290 13_2_0323B290
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03243920 13_2_03243920
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03C9B088 13_2_03C9B088
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03C9C01C 13_2_03C9C01C
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03C9BB68 13_2_03C9BB68
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_03C9BC83 13_2_03C9BC83
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\shutdown.exe Code function: String function: 039FF290 appears 105 times
Source: C:\Windows\SysWOW64\shutdown.exe Code function: String function: 039B5130 appears 58 times
Source: C:\Windows\SysWOW64\shutdown.exe Code function: String function: 0396B970 appears 280 times
Source: C:\Windows\SysWOW64\shutdown.exe Code function: String function: 039C7E54 appears 110 times
Source: C:\Windows\SysWOW64\shutdown.exe Code function: String function: 039EEA12 appears 86 times
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: String function: 017AEA12 appears 86 times
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: String function: 01775130 appears 58 times
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: String function: 017BF290 appears 105 times
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: String function: 0172B970 appears 280 times
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: String function: 01787E54 appears 110 times
Sample file is different than original file name gathered from version info
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000000.00000002.1354636489.0000000007540000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameRT.dll. vs 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000000.00000002.1358819440.000000000D530000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000000.00000002.1329890365.0000000002D91000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRT.dll. vs 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000000.00000002.1328688417.000000000106E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000005.00000002.2214174481.00000000012AC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSHUTDOWN.EXEj% vs 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000005.00000002.2214355002.000000000182D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Binary or memory string: OriginalFilenamefTTh.exe> vs 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe
Uses 32bit PE files
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.2563757906.0000000003700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.2561298319.0000000003230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.2563222127.0000000000FA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2213669414.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2214051577.0000000001250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.2563650828.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2215409822.0000000001AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000C.00000002.2563123525.0000000002F70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, P5EYD3VTbd1RAsAUnc.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, BDhqcm3UeZWT7A9K30.cs Security API names: _0020.SetAccessControl
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, BDhqcm3UeZWT7A9K30.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, BDhqcm3UeZWT7A9K30.cs Security API names: _0020.AddAccessRule
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, BDhqcm3UeZWT7A9K30.cs Security API names: _0020.SetAccessControl
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, BDhqcm3UeZWT7A9K30.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, BDhqcm3UeZWT7A9K30.cs Security API names: _0020.AddAccessRule
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, P5EYD3VTbd1RAsAUnc.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.rans.troj.spyw.evad.winEXE@10/7@3/1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7712:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_plapwhs1.hgt.ps1 Jump to behavior
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: shutdown.exe, 0000000D.00000003.2490318394.0000000003485000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000003.2490205187.0000000003464000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000003.2492288234.000000000348F000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000002.2561874080.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000002.2561874080.0000000003485000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe ReversingLabs: Detection: 28%
Source: unknown Process created: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe "C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe"
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process created: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe "C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe"
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe"
Source: C:\Windows\SysWOW64\shutdown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe" Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process created: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe "C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe" Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe" Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: fTTh.pdb source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000000.2140611303.0000000000EAE000.00000002.00000001.01000000.0000000C.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000E.00000002.2563006189.0000000000EAE000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: wntdll.pdbUGP source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000005.00000002.2214355002.0000000001700000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000003.2215943559.0000000003797000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000002.2564318778.0000000003ADE000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000003.2213972420.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000002.2564318778.0000000003940000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: shutdown.pdbGCTL source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000005.00000002.2214174481.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000002.2562237583.0000000001458000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000005.00000002.2214355002.0000000001700000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, shutdown.exe, 0000000D.00000003.2215943559.0000000003797000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000002.2564318778.0000000003ADE000.00000040.00001000.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000003.2213972420.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, shutdown.exe, 0000000D.00000002.2564318778.0000000003940000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: shutdown.pdb source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000005.00000002.2214174481.00000000012A6000.00000004.00000020.00020000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000002.2562237583.0000000001458000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: fTTh.pdbSHA256x source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, mainscreen.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, BDhqcm3UeZWT7A9K30.cs .Net Code: yqN2SwCrWk System.Reflection.Assembly.Load(byte[])
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, BDhqcm3UeZWT7A9K30.cs .Net Code: yqN2SwCrWk System.Reflection.Assembly.Load(byte[])
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.2dbc398.1.raw.unpack, -Module-.cs .Net Code: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.2dbc398.1.raw.unpack, PingPong.cs .Net Code: _206E_206D_206E_206E_202E_202E_200C_206A_202D_206E_200C_202B_200F_206E_200B_202E_200E_202A_202D_200E_200E_200E_200E_202B_200E_202C_200C_200B_202C_202D_200C_202A_200B_200C_206D_206B_202B_202A_202E_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.7540000.3.raw.unpack, -Module-.cs .Net Code: _200D_200D_202B_206F_206A_206B_202B_200B_200D_206D_200C_206B_206A_200B_202E_200C_200E_202A_200E_206D_206F_202D_206F_206D_206C_200F_206A_202D_206C_202B_206A_206F_202A_206A_200E_200F_200B_200F_202E_202D_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.7540000.3.raw.unpack, PingPong.cs .Net Code: _206E_206D_206E_206E_202E_202E_200C_206A_202D_206E_200C_202B_200F_206E_200B_202E_200E_202A_202D_200E_200E_200E_200E_202B_200E_202C_200C_200B_202C_202D_200C_202A_200B_200C_206D_206B_202B_202A_202E_200C_202E System.Reflection.Assembly.Load(byte[])
Source: 13.2.shutdown.exe.400cd08.2.raw.unpack, mainscreen.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 14.2.zkhJmzWnNnFLoIoaAsyqpwQZ.exe.2d8cd08.1.raw.unpack, mainscreen.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 14.0.zkhJmzWnNnFLoIoaAsyqpwQZ.exe.2d8cd08.1.raw.unpack, mainscreen.cs .Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Static PE information: 0xB95FCE0F [Sat Jul 21 02:33:51 2068 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_02CD2794 push ds; iretd 0_2_02CD2797
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_02CD0448 pushad ; retf 0_2_02CD06F6
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_05361CD4 push ds; retf 0_2_05361CE2
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 0_2_072F98D8 push cs; retf 0_2_072F98E2
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00418884 push eax; ret 5_2_0041888B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0040D888 push ecx; ret 5_2_0040D889
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00407894 push eax; iretd 5_2_00407898
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0040D202 pushad ; ret 5_2_0040D205
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00401A31 push es; retf 5_2_00401A37
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0041435D push CF08DBE8h; retf 5_2_00414385
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_004233D3 push edi; iretd 5_2_004233DE
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0040D462 push ebx; iretd 5_2_0040D45A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00408465 pushfd ; iretd 5_2_00408472
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00414C7A push edx; iretd 5_2_00414C91
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0040D407 push ebx; iretd 5_2_0040D45A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00414C83 push edx; iretd 5_2_00414C91
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00414DD6 push ebx; iretd 5_2_00414DD7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_004185F8 push ebp; ret 5_2_004185F9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00403590 push eax; ret 5_2_00403592
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00416653 push edx; retf 5_2_004167A1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0040D686 push ebp; retf 5_2_0040D688
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0040174F push ds; iretd 5_2_00401765
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0170225F pushad ; ret 5_2_017027F9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017027FA pushad ; ret 5_2_017027F9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017309AD push ecx; mov dword ptr [esp], ecx 5_2_017309B6
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0170283D push eax; iretd 5_2_01702858
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Code function: 12_2_0318E25D push edi; iretd 12_2_0318E268
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Code function: 12_2_03178291 push ebx; iretd 12_2_031782E4
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Code function: 12_2_031732EF pushfd ; iretd 12_2_031732FC
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Code function: 12_2_031782EC push ebx; iretd 12_2_031782E4
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Code function: 12_2_0318A184 push ds; iretd 12_2_0318A194
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Static PE information: section name: .text entropy: 7.978509985045748
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, wNIeg05p2J7LI0sxAR.cs High entropy of concatenated method names: 'NImRDM0cjf', 'TpyRXtcAxC', 'U9UCyfsU2Y', 'cFsCrg05Ja', 'WkYRHdyqxA', 'VK1R7oyHoy', 'TnsRiBCRj8', 'MprRunGlCo', 'vABRGG4Awa', 'gteRf7AQBg'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, hlp3NEjD1wHnN17DLi.cs High entropy of concatenated method names: 'wIfCBKOMC0', 'DbOCT3JGFl', 'M1ACYxOm3s', 'iEVCmZ3mDg', 'OjTCuoyvxr', 'wjRC9C74ho', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, Avoj1xuZSJJPO5cL1n.cs High entropy of concatenated method names: 'mSgaJCtutB', 'E1ma7q9C06', 'tGDaubWDjp', 'mBmaG79fZ5', 'Cd7aTQkUjY', 'bCLaY33FCU', 'THkamxRFp0', 'hP0a9vnUAQ', 'gg9aweanRF', 'bjNatNwR5B'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, CrKSSdWwC4ohnA1aue.cs High entropy of concatenated method names: 'FbcRLh9JgW', 'jAcRhTGmdL', 'ToString', 'NgLRv9Nkw7', 'lO9RxlUuY0', 'GBMRFs2DJG', 'KE6RoDYiNq', 'EWVRpU1TA9', 'q9NRAXobQ3', 'rCYR3ItP2u'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, P5EYD3VTbd1RAsAUnc.cs High entropy of concatenated method names: 'lIQxuGqBEd', 'lNDxG4akiX', 'xn5xfXSDWn', 'mTDxW1A7F3', 'i0MxOJ0R0H', 'Ehvx5QMOxZ', 'zgWxMVXbHG', 'M5axDxXSAO', 'Pt2xjtUxmm', 'R6exXPw9uo'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, qHo7EMPthDctL8gHN0.cs High entropy of concatenated method names: 'EajAcq0svO', 'bM9AKy4rSt', 'tAvASO0B7o', 'QsKA0dtng0', 'DfMAkRxMDn', 'jDgA17kEOA', 'xg9An6Eecn', 'hkvAVKo0ix', 'NbcAQ1kv6D', 'MIGAsXO45h'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, C4bZLLrNrbZofIeJmqZ.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'M4mluCB7tx', 'pmClGW8veQ', 'JRFlfUXl8p', 'vgnlWvLPBr', 'Q9glO2DBFn', 'de5l55Dt4Y', 'eT8lM47SDF'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, hKuFhjryaSVDxkDxM28.cs High entropy of concatenated method names: 'LBfEcUNRag', 'jMiEKlDBRT', 'swcES0hw9u', 'wysE0uIYat', 'vCQEk7rGdX', 'rBeE1LsXM1', 'osTEn4GX1U', 'IyxEVHWqBo', 'WehEQn8egO', 'LnBEsHihx6'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, oDcZLoiMDjhxP6TWfD.cs High entropy of concatenated method names: 'yVw4Vna94c', 'PVF4QoR7Tu', 'hWn4BgyStB', 'oZX4TnfV5q', 'whp4mFUbNK', 'lR249NSKy6', 'ITs4teOODJ', 'VMg46r7Skx', 'dHW4JBj2m2', 'umb4Hao2Ha'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, SPjLDHDQd8ndbtcfNw.cs High entropy of concatenated method names: 'NYOCvhndW7', 'hpBCxC4spn', 'XgICFHUOhg', 'z8LCoOkimi', 'rmZCprJP8U', 'MKECAwMWul', 'e3uC3xtEUn', 'ceyCgeqwR8', 'cvOCLKn0mF', 'h2KChdl6ZO'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, FxTBy2f31BZEcJBBZx.cs High entropy of concatenated method names: 'ToString', 'aJdbH1vyeo', 't4gbTmS45i', 'mELbYoVfjs', 'fJkbmjXknP', 'FcBb9XxU9w', 'wK3bw5CDbI', 'DSKbt6qKVw', 'O9Hb6WAoEg', 'fwFbPODYZe'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, Cv8vxsTJ4YVbIBS0cF.cs High entropy of concatenated method names: 'G3kF0E303P3ObbByeTh', 'V2mI0K3VGSFTA5wFxkA', 'bd8Uor3FAOSvJmju4Ym', 'HrFpCtyo6e', 'e5BpEoJdR5', 'XEKplVYVQJ', 'b22NTc3TDBM9ao9Zv6a', 'bp9DpI3sfSQ1HZJbi68', 'KUANZk3EpWQm3p8UuQA'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, QLUuWKz8Wdj3Ib1tdJ.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LPYE4aX3fJ', 'fv2EaxPxpW', 'WYfEbaQsqS', 'DExERX2WPl', 'FMHECfGgGa', 'hq4EEWjRnq', 'O1cEl0qjc9'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, lHBIC5x361wOap6SkM.cs High entropy of concatenated method names: 'Dispose', 'X0arjahDUi', 'MAaeTds3j2', 'NlHqqhjSKI', 'OfPrXjLDHQ', 'v8nrzdbtcf', 'ProcessDialogKey', 'cwFeylp3NE', 'W1werHnN17', 'XLieeSVmAt'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, BDhqcm3UeZWT7A9K30.cs High entropy of concatenated method names: 'E2cNUt9JZX', 'sAfNvMqBZt', 'nx3NxNDweS', 'zCjNF4lqqe', 'USaNoRW76C', 'kQGNpUV1MU', 'cxkNASXVHt', 'B77N3bxyMO', 'ocSNglJF1y', 'FtpNLFXHQy'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, URwXUFBkg0MlltB7UT.cs High entropy of concatenated method names: 'm7MpUrwGO0', 'Am5pxgR61u', 'XSspogGfgO', 'mC3pAttV5y', 'YLJp3b1uJv', 'U7SoOhubaU', 'qeXo5xKrch', 'iP4oMlj2Id', 'WN9oDig9qa', 'GeGojVpHtC'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, o43hex2TD0vtHdwI8s.cs High entropy of concatenated method names: 'iQirA5EYD3', 'Hbdr31RAsA', 'PbcrL8dpDU', 'VxwrhHfiFK', 'S89raFRORw', 'YUFrbkg0Ml', 'oeInT3XV12k7ZZaxmT', 'LkUtVogbuMdFmFJVme', 'xIpmPnatLyJ2YJD9tN', 'j2Trr4f4f3'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, g5Gsf8thO2d1YMtUaY.cs High entropy of concatenated method names: 'Pq3AvKDdHd', 'XeSAFyjKIK', 'kt4ApI8rQv', 'AaqpXEhRyS', 'Wf9pz5YUlU', 'Kk3AyLqRg7', 'nkBArTcXuP', 'AyrAeXeZWP', 'JWCANNXhUe', 'y9NA2yQoKT'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, jGA7F3es1uwcXBQf56.cs High entropy of concatenated method names: 'kWaSJK1Xa', 'hQD0E3sWm', 'Qsu1e49La', 'jvvnac0en', 'aAJQoTDn1', 'D0ispGaF7', 'Ge6JxjBPkjPXdQbLQ5', 'Qm3dK0AC6KLxR81K78', 'yMLCZrvMN', 'Seqll5rYe'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, yTB8liQbc8dpDUMxwH.cs High entropy of concatenated method names: 'DhfF0JCW7Q', 'lxYF1T13Fb', 'tyBFVmSKUp', 'alnFQ5J0Q6', 'SDWFadhLKx', 'rDVFbbTZ6V', 'V8PFRLiamB', 'g5nFCclAi7', 'HY1FE2i56F', 'G24FlsXFtS'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.4a8b310.2.raw.unpack, zVmAtVXaZ7bPSxv3Fo.cs High entropy of concatenated method names: 'R8kErHthN4', 'qqjENLInr4', 'xiIE2FQfW4', 'dd2Ev3rErQ', 'BifExlAUQX', 'z1OEofaDJj', 'oqoEpROpYx', 'wjdCMHEw67', 'I2ACDyERfu', 'K32Cj38ZmS'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, wNIeg05p2J7LI0sxAR.cs High entropy of concatenated method names: 'NImRDM0cjf', 'TpyRXtcAxC', 'U9UCyfsU2Y', 'cFsCrg05Ja', 'WkYRHdyqxA', 'VK1R7oyHoy', 'TnsRiBCRj8', 'MprRunGlCo', 'vABRGG4Awa', 'gteRf7AQBg'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, hlp3NEjD1wHnN17DLi.cs High entropy of concatenated method names: 'wIfCBKOMC0', 'DbOCT3JGFl', 'M1ACYxOm3s', 'iEVCmZ3mDg', 'OjTCuoyvxr', 'wjRC9C74ho', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, Avoj1xuZSJJPO5cL1n.cs High entropy of concatenated method names: 'mSgaJCtutB', 'E1ma7q9C06', 'tGDaubWDjp', 'mBmaG79fZ5', 'Cd7aTQkUjY', 'bCLaY33FCU', 'THkamxRFp0', 'hP0a9vnUAQ', 'gg9aweanRF', 'bjNatNwR5B'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, CrKSSdWwC4ohnA1aue.cs High entropy of concatenated method names: 'FbcRLh9JgW', 'jAcRhTGmdL', 'ToString', 'NgLRv9Nkw7', 'lO9RxlUuY0', 'GBMRFs2DJG', 'KE6RoDYiNq', 'EWVRpU1TA9', 'q9NRAXobQ3', 'rCYR3ItP2u'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, P5EYD3VTbd1RAsAUnc.cs High entropy of concatenated method names: 'lIQxuGqBEd', 'lNDxG4akiX', 'xn5xfXSDWn', 'mTDxW1A7F3', 'i0MxOJ0R0H', 'Ehvx5QMOxZ', 'zgWxMVXbHG', 'M5axDxXSAO', 'Pt2xjtUxmm', 'R6exXPw9uo'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, qHo7EMPthDctL8gHN0.cs High entropy of concatenated method names: 'EajAcq0svO', 'bM9AKy4rSt', 'tAvASO0B7o', 'QsKA0dtng0', 'DfMAkRxMDn', 'jDgA17kEOA', 'xg9An6Eecn', 'hkvAVKo0ix', 'NbcAQ1kv6D', 'MIGAsXO45h'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, C4bZLLrNrbZofIeJmqZ.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'M4mluCB7tx', 'pmClGW8veQ', 'JRFlfUXl8p', 'vgnlWvLPBr', 'Q9glO2DBFn', 'de5l55Dt4Y', 'eT8lM47SDF'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, hKuFhjryaSVDxkDxM28.cs High entropy of concatenated method names: 'LBfEcUNRag', 'jMiEKlDBRT', 'swcES0hw9u', 'wysE0uIYat', 'vCQEk7rGdX', 'rBeE1LsXM1', 'osTEn4GX1U', 'IyxEVHWqBo', 'WehEQn8egO', 'LnBEsHihx6'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, oDcZLoiMDjhxP6TWfD.cs High entropy of concatenated method names: 'yVw4Vna94c', 'PVF4QoR7Tu', 'hWn4BgyStB', 'oZX4TnfV5q', 'whp4mFUbNK', 'lR249NSKy6', 'ITs4teOODJ', 'VMg46r7Skx', 'dHW4JBj2m2', 'umb4Hao2Ha'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, SPjLDHDQd8ndbtcfNw.cs High entropy of concatenated method names: 'NYOCvhndW7', 'hpBCxC4spn', 'XgICFHUOhg', 'z8LCoOkimi', 'rmZCprJP8U', 'MKECAwMWul', 'e3uC3xtEUn', 'ceyCgeqwR8', 'cvOCLKn0mF', 'h2KChdl6ZO'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, FxTBy2f31BZEcJBBZx.cs High entropy of concatenated method names: 'ToString', 'aJdbH1vyeo', 't4gbTmS45i', 'mELbYoVfjs', 'fJkbmjXknP', 'FcBb9XxU9w', 'wK3bw5CDbI', 'DSKbt6qKVw', 'O9Hb6WAoEg', 'fwFbPODYZe'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, Cv8vxsTJ4YVbIBS0cF.cs High entropy of concatenated method names: 'G3kF0E303P3ObbByeTh', 'V2mI0K3VGSFTA5wFxkA', 'bd8Uor3FAOSvJmju4Ym', 'HrFpCtyo6e', 'e5BpEoJdR5', 'XEKplVYVQJ', 'b22NTc3TDBM9ao9Zv6a', 'bp9DpI3sfSQ1HZJbi68', 'KUANZk3EpWQm3p8UuQA'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, QLUuWKz8Wdj3Ib1tdJ.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LPYE4aX3fJ', 'fv2EaxPxpW', 'WYfEbaQsqS', 'DExERX2WPl', 'FMHECfGgGa', 'hq4EEWjRnq', 'O1cEl0qjc9'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, lHBIC5x361wOap6SkM.cs High entropy of concatenated method names: 'Dispose', 'X0arjahDUi', 'MAaeTds3j2', 'NlHqqhjSKI', 'OfPrXjLDHQ', 'v8nrzdbtcf', 'ProcessDialogKey', 'cwFeylp3NE', 'W1werHnN17', 'XLieeSVmAt'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, BDhqcm3UeZWT7A9K30.cs High entropy of concatenated method names: 'E2cNUt9JZX', 'sAfNvMqBZt', 'nx3NxNDweS', 'zCjNF4lqqe', 'USaNoRW76C', 'kQGNpUV1MU', 'cxkNASXVHt', 'B77N3bxyMO', 'ocSNglJF1y', 'FtpNLFXHQy'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, URwXUFBkg0MlltB7UT.cs High entropy of concatenated method names: 'm7MpUrwGO0', 'Am5pxgR61u', 'XSspogGfgO', 'mC3pAttV5y', 'YLJp3b1uJv', 'U7SoOhubaU', 'qeXo5xKrch', 'iP4oMlj2Id', 'WN9oDig9qa', 'GeGojVpHtC'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, o43hex2TD0vtHdwI8s.cs High entropy of concatenated method names: 'iQirA5EYD3', 'Hbdr31RAsA', 'PbcrL8dpDU', 'VxwrhHfiFK', 'S89raFRORw', 'YUFrbkg0Ml', 'oeInT3XV12k7ZZaxmT', 'LkUtVogbuMdFmFJVme', 'xIpmPnatLyJ2YJD9tN', 'j2Trr4f4f3'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, g5Gsf8thO2d1YMtUaY.cs High entropy of concatenated method names: 'Pq3AvKDdHd', 'XeSAFyjKIK', 'kt4ApI8rQv', 'AaqpXEhRyS', 'Wf9pz5YUlU', 'Kk3AyLqRg7', 'nkBArTcXuP', 'AyrAeXeZWP', 'JWCANNXhUe', 'y9NA2yQoKT'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, jGA7F3es1uwcXBQf56.cs High entropy of concatenated method names: 'kWaSJK1Xa', 'hQD0E3sWm', 'Qsu1e49La', 'jvvnac0en', 'aAJQoTDn1', 'D0ispGaF7', 'Ge6JxjBPkjPXdQbLQ5', 'Qm3dK0AC6KLxR81K78', 'yMLCZrvMN', 'Seqll5rYe'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, yTB8liQbc8dpDUMxwH.cs High entropy of concatenated method names: 'DhfF0JCW7Q', 'lxYF1T13Fb', 'tyBFVmSKUp', 'alnFQ5J0Q6', 'SDWFadhLKx', 'rDVFbbTZ6V', 'V8PFRLiamB', 'g5nFCclAi7', 'HY1FE2i56F', 'G24FlsXFtS'
Source: 0.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.d530000.6.raw.unpack, zVmAtVXaZ7bPSxv3Fo.cs High entropy of concatenated method names: 'R8kErHthN4', 'qqjENLInr4', 'xiIE2FQfW4', 'dd2Ev3rErQ', 'BifExlAUQX', 'z1OEofaDJj', 'oqoEpROpYx', 'wjdCMHEw67', 'I2ACDyERfu', 'K32Cj38ZmS'
Creates processes with suspicious names
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe File created: \03.07.2024-sipari#u015f ug01072410 -onka ve tic a.s.exe
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe File created: \03.07.2024-sipari#u015f ug01072410 -onka ve tic a.s.exe
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe File created: \03.07.2024-sipari#u015f ug01072410 -onka ve tic a.s.exe Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe File created: \03.07.2024-sipari#u015f ug01072410 -onka ve tic a.s.exe Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes itself after installation
Source: C:\Windows\SysWOW64\shutdown.exe File deleted: c:\users\user\desktop\03.07.2024-sipari#u015f ug01072410 -onka ve tic a.s.exe Jump to behavior
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe PID: 7524, type: MEMORYSTR
Switches to a custom stack to bypass stack traces
Source: C:\Windows\SysWOW64\shutdown.exe API/Special instruction interceptor: Address: 7FF90818D324
Source: C:\Windows\SysWOW64\shutdown.exe API/Special instruction interceptor: Address: 7FF90818D7E4
Source: C:\Windows\SysWOW64\shutdown.exe API/Special instruction interceptor: Address: 7FF90818D944
Source: C:\Windows\SysWOW64\shutdown.exe API/Special instruction interceptor: Address: 7FF90818D504
Source: C:\Windows\SysWOW64\shutdown.exe API/Special instruction interceptor: Address: 7FF90818D544
Source: C:\Windows\SysWOW64\shutdown.exe API/Special instruction interceptor: Address: 7FF90818D1E4
Source: C:\Windows\SysWOW64\shutdown.exe API/Special instruction interceptor: Address: 7FF908190154
Source: C:\Windows\SysWOW64\shutdown.exe API/Special instruction interceptor: Address: 7FF90818DA44
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: 1050000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: 2D90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: 2CA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: 7C40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: 8C40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: 8DF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: 9DF0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: A150000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: B150000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: C150000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: D600000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: E600000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: F600000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: FCB0000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0177096E rdtsc 5_2_0177096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3778 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 856 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe API coverage: 0.7 %
Source: C:\Windows\SysWOW64\shutdown.exe API coverage: 2.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe TID: 7584 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7848 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7836 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\shutdown.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\shutdown.exe Code function: 13_2_0324C240 FindFirstFileW,FindNextFileW,FindClose, 13_2_0324C240
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: 3y36225.13.dr Binary or memory string: dev.azure.comVMware20,11696497155j
Source: 3y36225.13.dr Binary or memory string: global block list test formVMware20,11696497155
Source: 3y36225.13.dr Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: 3y36225.13.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: 3y36225.13.dr Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: shutdown.exe, 0000000D.00000002.2561874080.000000000340D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln'Id
Source: 3y36225.13.dr Binary or memory string: secure.bankofamerica.comVMware20,11696497155|UE
Source: 3y36225.13.dr Binary or memory string: tasks.office.comVMware20,11696497155o
Source: 3y36225.13.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: 3y36225.13.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000E.00000002.2562812206.0000000000D4F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 3y36225.13.dr Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: 3y36225.13.dr Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: 3y36225.13.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: 3y36225.13.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: 3y36225.13.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: 3y36225.13.dr Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: 3y36225.13.dr Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: 3y36225.13.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: 3y36225.13.dr Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: 3y36225.13.dr Binary or memory string: AMC password management pageVMware20,11696497155
Source: 3y36225.13.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: 3y36225.13.dr Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: 3y36225.13.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: 3y36225.13.dr Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: 3y36225.13.dr Binary or memory string: discord.comVMware20,11696497155f
Source: 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe, 00000000.00000002.1358819440.000000000D530000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: BTQemuFc9M
Source: 3y36225.13.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: 3y36225.13.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: 3y36225.13.dr Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: 3y36225.13.dr Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 3y36225.13.dr Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: 3y36225.13.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: 3y36225.13.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0177096E rdtsc 5_2_0177096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_00417E63 LdrLoadDll, 5_2_00417E63
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172C156 mov eax, dword ptr fs:[00000030h] 5_2_0172C156
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C8158 mov eax, dword ptr fs:[00000030h] 5_2_017C8158
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01736154 mov eax, dword ptr fs:[00000030h] 5_2_01736154
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01736154 mov eax, dword ptr fs:[00000030h] 5_2_01736154
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C4144 mov eax, dword ptr fs:[00000030h] 5_2_017C4144
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C4144 mov eax, dword ptr fs:[00000030h] 5_2_017C4144
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C4144 mov ecx, dword ptr fs:[00000030h] 5_2_017C4144
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C4144 mov eax, dword ptr fs:[00000030h] 5_2_017C4144
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C4144 mov eax, dword ptr fs:[00000030h] 5_2_017C4144
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01760124 mov eax, dword ptr fs:[00000030h] 5_2_01760124
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DA118 mov ecx, dword ptr fs:[00000030h] 5_2_017DA118
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DA118 mov eax, dword ptr fs:[00000030h] 5_2_017DA118
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DA118 mov eax, dword ptr fs:[00000030h] 5_2_017DA118
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DA118 mov eax, dword ptr fs:[00000030h] 5_2_017DA118
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_018061E5 mov eax, dword ptr fs:[00000030h] 5_2_018061E5
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F0115 mov eax, dword ptr fs:[00000030h] 5_2_017F0115
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE10E mov eax, dword ptr fs:[00000030h] 5_2_017DE10E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE10E mov ecx, dword ptr fs:[00000030h] 5_2_017DE10E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE10E mov eax, dword ptr fs:[00000030h] 5_2_017DE10E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE10E mov eax, dword ptr fs:[00000030h] 5_2_017DE10E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE10E mov ecx, dword ptr fs:[00000030h] 5_2_017DE10E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE10E mov eax, dword ptr fs:[00000030h] 5_2_017DE10E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE10E mov eax, dword ptr fs:[00000030h] 5_2_017DE10E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE10E mov ecx, dword ptr fs:[00000030h] 5_2_017DE10E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE10E mov eax, dword ptr fs:[00000030h] 5_2_017DE10E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE10E mov ecx, dword ptr fs:[00000030h] 5_2_017DE10E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017601F8 mov eax, dword ptr fs:[00000030h] 5_2_017601F8
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE1D0 mov eax, dword ptr fs:[00000030h] 5_2_017AE1D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE1D0 mov eax, dword ptr fs:[00000030h] 5_2_017AE1D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE1D0 mov ecx, dword ptr fs:[00000030h] 5_2_017AE1D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE1D0 mov eax, dword ptr fs:[00000030h] 5_2_017AE1D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE1D0 mov eax, dword ptr fs:[00000030h] 5_2_017AE1D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F61C3 mov eax, dword ptr fs:[00000030h] 5_2_017F61C3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F61C3 mov eax, dword ptr fs:[00000030h] 5_2_017F61C3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B019F mov eax, dword ptr fs:[00000030h] 5_2_017B019F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B019F mov eax, dword ptr fs:[00000030h] 5_2_017B019F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B019F mov eax, dword ptr fs:[00000030h] 5_2_017B019F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B019F mov eax, dword ptr fs:[00000030h] 5_2_017B019F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804164 mov eax, dword ptr fs:[00000030h] 5_2_01804164
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804164 mov eax, dword ptr fs:[00000030h] 5_2_01804164
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172A197 mov eax, dword ptr fs:[00000030h] 5_2_0172A197
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172A197 mov eax, dword ptr fs:[00000030h] 5_2_0172A197
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172A197 mov eax, dword ptr fs:[00000030h] 5_2_0172A197
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01770185 mov eax, dword ptr fs:[00000030h] 5_2_01770185
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017EC188 mov eax, dword ptr fs:[00000030h] 5_2_017EC188
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017EC188 mov eax, dword ptr fs:[00000030h] 5_2_017EC188
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D4180 mov eax, dword ptr fs:[00000030h] 5_2_017D4180
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D4180 mov eax, dword ptr fs:[00000030h] 5_2_017D4180
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175C073 mov eax, dword ptr fs:[00000030h] 5_2_0175C073
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01732050 mov eax, dword ptr fs:[00000030h] 5_2_01732050
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B6050 mov eax, dword ptr fs:[00000030h] 5_2_017B6050
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C6030 mov eax, dword ptr fs:[00000030h] 5_2_017C6030
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172A020 mov eax, dword ptr fs:[00000030h] 5_2_0172A020
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172C020 mov eax, dword ptr fs:[00000030h] 5_2_0172C020
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174E016 mov eax, dword ptr fs:[00000030h] 5_2_0174E016
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174E016 mov eax, dword ptr fs:[00000030h] 5_2_0174E016
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174E016 mov eax, dword ptr fs:[00000030h] 5_2_0174E016
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174E016 mov eax, dword ptr fs:[00000030h] 5_2_0174E016
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B4000 mov ecx, dword ptr fs:[00000030h] 5_2_017B4000
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D2000 mov eax, dword ptr fs:[00000030h] 5_2_017D2000
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D2000 mov eax, dword ptr fs:[00000030h] 5_2_017D2000
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D2000 mov eax, dword ptr fs:[00000030h] 5_2_017D2000
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D2000 mov eax, dword ptr fs:[00000030h] 5_2_017D2000
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D2000 mov eax, dword ptr fs:[00000030h] 5_2_017D2000
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D2000 mov eax, dword ptr fs:[00000030h] 5_2_017D2000
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D2000 mov eax, dword ptr fs:[00000030h] 5_2_017D2000
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D2000 mov eax, dword ptr fs:[00000030h] 5_2_017D2000
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172C0F0 mov eax, dword ptr fs:[00000030h] 5_2_0172C0F0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017720F0 mov ecx, dword ptr fs:[00000030h] 5_2_017720F0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172A0E3 mov ecx, dword ptr fs:[00000030h] 5_2_0172A0E3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017380E9 mov eax, dword ptr fs:[00000030h] 5_2_017380E9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B60E0 mov eax, dword ptr fs:[00000030h] 5_2_017B60E0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B20DE mov eax, dword ptr fs:[00000030h] 5_2_017B20DE
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F60B8 mov eax, dword ptr fs:[00000030h] 5_2_017F60B8
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F60B8 mov ecx, dword ptr fs:[00000030h] 5_2_017F60B8
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017280A0 mov eax, dword ptr fs:[00000030h] 5_2_017280A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C80A8 mov eax, dword ptr fs:[00000030h] 5_2_017C80A8
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173208A mov eax, dword ptr fs:[00000030h] 5_2_0173208A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D437C mov eax, dword ptr fs:[00000030h] 5_2_017D437C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B035C mov eax, dword ptr fs:[00000030h] 5_2_017B035C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B035C mov eax, dword ptr fs:[00000030h] 5_2_017B035C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B035C mov eax, dword ptr fs:[00000030h] 5_2_017B035C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B035C mov ecx, dword ptr fs:[00000030h] 5_2_017B035C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B035C mov eax, dword ptr fs:[00000030h] 5_2_017B035C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B035C mov eax, dword ptr fs:[00000030h] 5_2_017B035C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FA352 mov eax, dword ptr fs:[00000030h] 5_2_017FA352
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D8350 mov ecx, dword ptr fs:[00000030h] 5_2_017D8350
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B2349 mov eax, dword ptr fs:[00000030h] 5_2_017B2349
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172C310 mov ecx, dword ptr fs:[00000030h] 5_2_0172C310
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01750310 mov ecx, dword ptr fs:[00000030h] 5_2_01750310
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176A30B mov eax, dword ptr fs:[00000030h] 5_2_0176A30B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176A30B mov eax, dword ptr fs:[00000030h] 5_2_0176A30B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176A30B mov eax, dword ptr fs:[00000030h] 5_2_0176A30B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174E3F0 mov eax, dword ptr fs:[00000030h] 5_2_0174E3F0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174E3F0 mov eax, dword ptr fs:[00000030h] 5_2_0174E3F0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174E3F0 mov eax, dword ptr fs:[00000030h] 5_2_0174E3F0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017663FF mov eax, dword ptr fs:[00000030h] 5_2_017663FF
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017403E9 mov eax, dword ptr fs:[00000030h] 5_2_017403E9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017403E9 mov eax, dword ptr fs:[00000030h] 5_2_017403E9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017403E9 mov eax, dword ptr fs:[00000030h] 5_2_017403E9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017403E9 mov eax, dword ptr fs:[00000030h] 5_2_017403E9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017403E9 mov eax, dword ptr fs:[00000030h] 5_2_017403E9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017403E9 mov eax, dword ptr fs:[00000030h] 5_2_017403E9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017403E9 mov eax, dword ptr fs:[00000030h] 5_2_017403E9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017403E9 mov eax, dword ptr fs:[00000030h] 5_2_017403E9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01808324 mov eax, dword ptr fs:[00000030h] 5_2_01808324
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01808324 mov ecx, dword ptr fs:[00000030h] 5_2_01808324
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01808324 mov eax, dword ptr fs:[00000030h] 5_2_01808324
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01808324 mov eax, dword ptr fs:[00000030h] 5_2_01808324
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE3DB mov eax, dword ptr fs:[00000030h] 5_2_017DE3DB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE3DB mov eax, dword ptr fs:[00000030h] 5_2_017DE3DB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE3DB mov ecx, dword ptr fs:[00000030h] 5_2_017DE3DB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DE3DB mov eax, dword ptr fs:[00000030h] 5_2_017DE3DB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D43D4 mov eax, dword ptr fs:[00000030h] 5_2_017D43D4
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D43D4 mov eax, dword ptr fs:[00000030h] 5_2_017D43D4
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017EC3CD mov eax, dword ptr fs:[00000030h] 5_2_017EC3CD
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A3C0 mov eax, dword ptr fs:[00000030h] 5_2_0173A3C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A3C0 mov eax, dword ptr fs:[00000030h] 5_2_0173A3C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A3C0 mov eax, dword ptr fs:[00000030h] 5_2_0173A3C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A3C0 mov eax, dword ptr fs:[00000030h] 5_2_0173A3C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A3C0 mov eax, dword ptr fs:[00000030h] 5_2_0173A3C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A3C0 mov eax, dword ptr fs:[00000030h] 5_2_0173A3C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017383C0 mov eax, dword ptr fs:[00000030h] 5_2_017383C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017383C0 mov eax, dword ptr fs:[00000030h] 5_2_017383C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017383C0 mov eax, dword ptr fs:[00000030h] 5_2_017383C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017383C0 mov eax, dword ptr fs:[00000030h] 5_2_017383C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B63C0 mov eax, dword ptr fs:[00000030h] 5_2_017B63C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0180634F mov eax, dword ptr fs:[00000030h] 5_2_0180634F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01728397 mov eax, dword ptr fs:[00000030h] 5_2_01728397
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01728397 mov eax, dword ptr fs:[00000030h] 5_2_01728397
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01728397 mov eax, dword ptr fs:[00000030h] 5_2_01728397
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172E388 mov eax, dword ptr fs:[00000030h] 5_2_0172E388
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172E388 mov eax, dword ptr fs:[00000030h] 5_2_0172E388
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172E388 mov eax, dword ptr fs:[00000030h] 5_2_0172E388
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175438F mov eax, dword ptr fs:[00000030h] 5_2_0175438F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175438F mov eax, dword ptr fs:[00000030h] 5_2_0175438F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E0274 mov eax, dword ptr fs:[00000030h] 5_2_017E0274
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01734260 mov eax, dword ptr fs:[00000030h] 5_2_01734260
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01734260 mov eax, dword ptr fs:[00000030h] 5_2_01734260
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01734260 mov eax, dword ptr fs:[00000030h] 5_2_01734260
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172826B mov eax, dword ptr fs:[00000030h] 5_2_0172826B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172A250 mov eax, dword ptr fs:[00000030h] 5_2_0172A250
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01736259 mov eax, dword ptr fs:[00000030h] 5_2_01736259
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017EA250 mov eax, dword ptr fs:[00000030h] 5_2_017EA250
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017EA250 mov eax, dword ptr fs:[00000030h] 5_2_017EA250
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B8243 mov eax, dword ptr fs:[00000030h] 5_2_017B8243
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B8243 mov ecx, dword ptr fs:[00000030h] 5_2_017B8243
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172823B mov eax, dword ptr fs:[00000030h] 5_2_0172823B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_018062D6 mov eax, dword ptr fs:[00000030h] 5_2_018062D6
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017402E1 mov eax, dword ptr fs:[00000030h] 5_2_017402E1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017402E1 mov eax, dword ptr fs:[00000030h] 5_2_017402E1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017402E1 mov eax, dword ptr fs:[00000030h] 5_2_017402E1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A2C3 mov eax, dword ptr fs:[00000030h] 5_2_0173A2C3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A2C3 mov eax, dword ptr fs:[00000030h] 5_2_0173A2C3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A2C3 mov eax, dword ptr fs:[00000030h] 5_2_0173A2C3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A2C3 mov eax, dword ptr fs:[00000030h] 5_2_0173A2C3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A2C3 mov eax, dword ptr fs:[00000030h] 5_2_0173A2C3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017402A0 mov eax, dword ptr fs:[00000030h] 5_2_017402A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017402A0 mov eax, dword ptr fs:[00000030h] 5_2_017402A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C62A0 mov eax, dword ptr fs:[00000030h] 5_2_017C62A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C62A0 mov ecx, dword ptr fs:[00000030h] 5_2_017C62A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C62A0 mov eax, dword ptr fs:[00000030h] 5_2_017C62A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C62A0 mov eax, dword ptr fs:[00000030h] 5_2_017C62A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C62A0 mov eax, dword ptr fs:[00000030h] 5_2_017C62A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C62A0 mov eax, dword ptr fs:[00000030h] 5_2_017C62A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0180625D mov eax, dword ptr fs:[00000030h] 5_2_0180625D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E284 mov eax, dword ptr fs:[00000030h] 5_2_0176E284
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E284 mov eax, dword ptr fs:[00000030h] 5_2_0176E284
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B0283 mov eax, dword ptr fs:[00000030h] 5_2_017B0283
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B0283 mov eax, dword ptr fs:[00000030h] 5_2_017B0283
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B0283 mov eax, dword ptr fs:[00000030h] 5_2_017B0283
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176656A mov eax, dword ptr fs:[00000030h] 5_2_0176656A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176656A mov eax, dword ptr fs:[00000030h] 5_2_0176656A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176656A mov eax, dword ptr fs:[00000030h] 5_2_0176656A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01738550 mov eax, dword ptr fs:[00000030h] 5_2_01738550
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01738550 mov eax, dword ptr fs:[00000030h] 5_2_01738550
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740535 mov eax, dword ptr fs:[00000030h] 5_2_01740535
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740535 mov eax, dword ptr fs:[00000030h] 5_2_01740535
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740535 mov eax, dword ptr fs:[00000030h] 5_2_01740535
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740535 mov eax, dword ptr fs:[00000030h] 5_2_01740535
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740535 mov eax, dword ptr fs:[00000030h] 5_2_01740535
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740535 mov eax, dword ptr fs:[00000030h] 5_2_01740535
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E53E mov eax, dword ptr fs:[00000030h] 5_2_0175E53E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E53E mov eax, dword ptr fs:[00000030h] 5_2_0175E53E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E53E mov eax, dword ptr fs:[00000030h] 5_2_0175E53E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E53E mov eax, dword ptr fs:[00000030h] 5_2_0175E53E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E53E mov eax, dword ptr fs:[00000030h] 5_2_0175E53E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C6500 mov eax, dword ptr fs:[00000030h] 5_2_017C6500
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804500 mov eax, dword ptr fs:[00000030h] 5_2_01804500
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804500 mov eax, dword ptr fs:[00000030h] 5_2_01804500
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804500 mov eax, dword ptr fs:[00000030h] 5_2_01804500
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804500 mov eax, dword ptr fs:[00000030h] 5_2_01804500
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804500 mov eax, dword ptr fs:[00000030h] 5_2_01804500
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804500 mov eax, dword ptr fs:[00000030h] 5_2_01804500
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804500 mov eax, dword ptr fs:[00000030h] 5_2_01804500
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0175E5E7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0175E5E7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0175E5E7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0175E5E7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0175E5E7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0175E5E7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0175E5E7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E5E7 mov eax, dword ptr fs:[00000030h] 5_2_0175E5E7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017325E0 mov eax, dword ptr fs:[00000030h] 5_2_017325E0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176C5ED mov eax, dword ptr fs:[00000030h] 5_2_0176C5ED
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176C5ED mov eax, dword ptr fs:[00000030h] 5_2_0176C5ED
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017365D0 mov eax, dword ptr fs:[00000030h] 5_2_017365D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176A5D0 mov eax, dword ptr fs:[00000030h] 5_2_0176A5D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176A5D0 mov eax, dword ptr fs:[00000030h] 5_2_0176A5D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E5CF mov eax, dword ptr fs:[00000030h] 5_2_0176E5CF
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E5CF mov eax, dword ptr fs:[00000030h] 5_2_0176E5CF
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017545B1 mov eax, dword ptr fs:[00000030h] 5_2_017545B1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017545B1 mov eax, dword ptr fs:[00000030h] 5_2_017545B1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B05A7 mov eax, dword ptr fs:[00000030h] 5_2_017B05A7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B05A7 mov eax, dword ptr fs:[00000030h] 5_2_017B05A7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B05A7 mov eax, dword ptr fs:[00000030h] 5_2_017B05A7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E59C mov eax, dword ptr fs:[00000030h] 5_2_0176E59C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01732582 mov eax, dword ptr fs:[00000030h] 5_2_01732582
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01732582 mov ecx, dword ptr fs:[00000030h] 5_2_01732582
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01764588 mov eax, dword ptr fs:[00000030h] 5_2_01764588
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175A470 mov eax, dword ptr fs:[00000030h] 5_2_0175A470
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175A470 mov eax, dword ptr fs:[00000030h] 5_2_0175A470
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175A470 mov eax, dword ptr fs:[00000030h] 5_2_0175A470
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BC460 mov ecx, dword ptr fs:[00000030h] 5_2_017BC460
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017EA456 mov eax, dword ptr fs:[00000030h] 5_2_017EA456
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172645D mov eax, dword ptr fs:[00000030h] 5_2_0172645D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175245A mov eax, dword ptr fs:[00000030h] 5_2_0175245A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E443 mov eax, dword ptr fs:[00000030h] 5_2_0176E443
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E443 mov eax, dword ptr fs:[00000030h] 5_2_0176E443
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E443 mov eax, dword ptr fs:[00000030h] 5_2_0176E443
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E443 mov eax, dword ptr fs:[00000030h] 5_2_0176E443
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E443 mov eax, dword ptr fs:[00000030h] 5_2_0176E443
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E443 mov eax, dword ptr fs:[00000030h] 5_2_0176E443
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E443 mov eax, dword ptr fs:[00000030h] 5_2_0176E443
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176E443 mov eax, dword ptr fs:[00000030h] 5_2_0176E443
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176A430 mov eax, dword ptr fs:[00000030h] 5_2_0176A430
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172E420 mov eax, dword ptr fs:[00000030h] 5_2_0172E420
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172E420 mov eax, dword ptr fs:[00000030h] 5_2_0172E420
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172E420 mov eax, dword ptr fs:[00000030h] 5_2_0172E420
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172C427 mov eax, dword ptr fs:[00000030h] 5_2_0172C427
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B6420 mov eax, dword ptr fs:[00000030h] 5_2_017B6420
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B6420 mov eax, dword ptr fs:[00000030h] 5_2_017B6420
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B6420 mov eax, dword ptr fs:[00000030h] 5_2_017B6420
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B6420 mov eax, dword ptr fs:[00000030h] 5_2_017B6420
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B6420 mov eax, dword ptr fs:[00000030h] 5_2_017B6420
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B6420 mov eax, dword ptr fs:[00000030h] 5_2_017B6420
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B6420 mov eax, dword ptr fs:[00000030h] 5_2_017B6420
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01768402 mov eax, dword ptr fs:[00000030h] 5_2_01768402
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01768402 mov eax, dword ptr fs:[00000030h] 5_2_01768402
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01768402 mov eax, dword ptr fs:[00000030h] 5_2_01768402
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017304E5 mov ecx, dword ptr fs:[00000030h] 5_2_017304E5
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017644B0 mov ecx, dword ptr fs:[00000030h] 5_2_017644B0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BA4B0 mov eax, dword ptr fs:[00000030h] 5_2_017BA4B0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017364AB mov eax, dword ptr fs:[00000030h] 5_2_017364AB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017EA49A mov eax, dword ptr fs:[00000030h] 5_2_017EA49A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01738770 mov eax, dword ptr fs:[00000030h] 5_2_01738770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740770 mov eax, dword ptr fs:[00000030h] 5_2_01740770
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01730750 mov eax, dword ptr fs:[00000030h] 5_2_01730750
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BE75D mov eax, dword ptr fs:[00000030h] 5_2_017BE75D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772750 mov eax, dword ptr fs:[00000030h] 5_2_01772750
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772750 mov eax, dword ptr fs:[00000030h] 5_2_01772750
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B4755 mov eax, dword ptr fs:[00000030h] 5_2_017B4755
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176674D mov esi, dword ptr fs:[00000030h] 5_2_0176674D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176674D mov eax, dword ptr fs:[00000030h] 5_2_0176674D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176674D mov eax, dword ptr fs:[00000030h] 5_2_0176674D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176273C mov eax, dword ptr fs:[00000030h] 5_2_0176273C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176273C mov ecx, dword ptr fs:[00000030h] 5_2_0176273C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176273C mov eax, dword ptr fs:[00000030h] 5_2_0176273C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AC730 mov eax, dword ptr fs:[00000030h] 5_2_017AC730
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176C720 mov eax, dword ptr fs:[00000030h] 5_2_0176C720
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176C720 mov eax, dword ptr fs:[00000030h] 5_2_0176C720
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01730710 mov eax, dword ptr fs:[00000030h] 5_2_01730710
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01760710 mov eax, dword ptr fs:[00000030h] 5_2_01760710
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176C700 mov eax, dword ptr fs:[00000030h] 5_2_0176C700
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017347FB mov eax, dword ptr fs:[00000030h] 5_2_017347FB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017347FB mov eax, dword ptr fs:[00000030h] 5_2_017347FB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017527ED mov eax, dword ptr fs:[00000030h] 5_2_017527ED
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017527ED mov eax, dword ptr fs:[00000030h] 5_2_017527ED
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017527ED mov eax, dword ptr fs:[00000030h] 5_2_017527ED
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BE7E1 mov eax, dword ptr fs:[00000030h] 5_2_017BE7E1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173C7C0 mov eax, dword ptr fs:[00000030h] 5_2_0173C7C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B07C3 mov eax, dword ptr fs:[00000030h] 5_2_017B07C3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017307AF mov eax, dword ptr fs:[00000030h] 5_2_017307AF
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E47A0 mov eax, dword ptr fs:[00000030h] 5_2_017E47A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D678E mov eax, dword ptr fs:[00000030h] 5_2_017D678E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01762674 mov eax, dword ptr fs:[00000030h] 5_2_01762674
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F866E mov eax, dword ptr fs:[00000030h] 5_2_017F866E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F866E mov eax, dword ptr fs:[00000030h] 5_2_017F866E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176A660 mov eax, dword ptr fs:[00000030h] 5_2_0176A660
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176A660 mov eax, dword ptr fs:[00000030h] 5_2_0176A660
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174C640 mov eax, dword ptr fs:[00000030h] 5_2_0174C640
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174E627 mov eax, dword ptr fs:[00000030h] 5_2_0174E627
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01766620 mov eax, dword ptr fs:[00000030h] 5_2_01766620
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01768620 mov eax, dword ptr fs:[00000030h] 5_2_01768620
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173262C mov eax, dword ptr fs:[00000030h] 5_2_0173262C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01772619 mov eax, dword ptr fs:[00000030h] 5_2_01772619
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE609 mov eax, dword ptr fs:[00000030h] 5_2_017AE609
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174260B mov eax, dword ptr fs:[00000030h] 5_2_0174260B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174260B mov eax, dword ptr fs:[00000030h] 5_2_0174260B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174260B mov eax, dword ptr fs:[00000030h] 5_2_0174260B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174260B mov eax, dword ptr fs:[00000030h] 5_2_0174260B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174260B mov eax, dword ptr fs:[00000030h] 5_2_0174260B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174260B mov eax, dword ptr fs:[00000030h] 5_2_0174260B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0174260B mov eax, dword ptr fs:[00000030h] 5_2_0174260B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE6F2 mov eax, dword ptr fs:[00000030h] 5_2_017AE6F2
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE6F2 mov eax, dword ptr fs:[00000030h] 5_2_017AE6F2
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE6F2 mov eax, dword ptr fs:[00000030h] 5_2_017AE6F2
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE6F2 mov eax, dword ptr fs:[00000030h] 5_2_017AE6F2
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B06F1 mov eax, dword ptr fs:[00000030h] 5_2_017B06F1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B06F1 mov eax, dword ptr fs:[00000030h] 5_2_017B06F1
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176A6C7 mov ebx, dword ptr fs:[00000030h] 5_2_0176A6C7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176A6C7 mov eax, dword ptr fs:[00000030h] 5_2_0176A6C7
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017666B0 mov eax, dword ptr fs:[00000030h] 5_2_017666B0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176C6A6 mov eax, dword ptr fs:[00000030h] 5_2_0176C6A6
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01734690 mov eax, dword ptr fs:[00000030h] 5_2_01734690
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01734690 mov eax, dword ptr fs:[00000030h] 5_2_01734690
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D4978 mov eax, dword ptr fs:[00000030h] 5_2_017D4978
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D4978 mov eax, dword ptr fs:[00000030h] 5_2_017D4978
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BC97C mov eax, dword ptr fs:[00000030h] 5_2_017BC97C
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01756962 mov eax, dword ptr fs:[00000030h] 5_2_01756962
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01756962 mov eax, dword ptr fs:[00000030h] 5_2_01756962
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01756962 mov eax, dword ptr fs:[00000030h] 5_2_01756962
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0177096E mov eax, dword ptr fs:[00000030h] 5_2_0177096E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0177096E mov edx, dword ptr fs:[00000030h] 5_2_0177096E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0177096E mov eax, dword ptr fs:[00000030h] 5_2_0177096E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B0946 mov eax, dword ptr fs:[00000030h] 5_2_017B0946
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B892A mov eax, dword ptr fs:[00000030h] 5_2_017B892A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C892B mov eax, dword ptr fs:[00000030h] 5_2_017C892B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BC912 mov eax, dword ptr fs:[00000030h] 5_2_017BC912
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01728918 mov eax, dword ptr fs:[00000030h] 5_2_01728918
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01728918 mov eax, dword ptr fs:[00000030h] 5_2_01728918
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE908 mov eax, dword ptr fs:[00000030h] 5_2_017AE908
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AE908 mov eax, dword ptr fs:[00000030h] 5_2_017AE908
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017629F9 mov eax, dword ptr fs:[00000030h] 5_2_017629F9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017629F9 mov eax, dword ptr fs:[00000030h] 5_2_017629F9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BE9E0 mov eax, dword ptr fs:[00000030h] 5_2_017BE9E0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A9D0 mov eax, dword ptr fs:[00000030h] 5_2_0173A9D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A9D0 mov eax, dword ptr fs:[00000030h] 5_2_0173A9D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A9D0 mov eax, dword ptr fs:[00000030h] 5_2_0173A9D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A9D0 mov eax, dword ptr fs:[00000030h] 5_2_0173A9D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A9D0 mov eax, dword ptr fs:[00000030h] 5_2_0173A9D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0173A9D0 mov eax, dword ptr fs:[00000030h] 5_2_0173A9D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017649D0 mov eax, dword ptr fs:[00000030h] 5_2_017649D0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FA9D3 mov eax, dword ptr fs:[00000030h] 5_2_017FA9D3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C69C0 mov eax, dword ptr fs:[00000030h] 5_2_017C69C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804940 mov eax, dword ptr fs:[00000030h] 5_2_01804940
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B89B3 mov esi, dword ptr fs:[00000030h] 5_2_017B89B3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B89B3 mov eax, dword ptr fs:[00000030h] 5_2_017B89B3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017B89B3 mov eax, dword ptr fs:[00000030h] 5_2_017B89B3
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017429A0 mov eax, dword ptr fs:[00000030h] 5_2_017429A0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017309AD mov eax, dword ptr fs:[00000030h] 5_2_017309AD
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017309AD mov eax, dword ptr fs:[00000030h] 5_2_017309AD
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BE872 mov eax, dword ptr fs:[00000030h] 5_2_017BE872
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BE872 mov eax, dword ptr fs:[00000030h] 5_2_017BE872
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C6870 mov eax, dword ptr fs:[00000030h] 5_2_017C6870
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C6870 mov eax, dword ptr fs:[00000030h] 5_2_017C6870
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01760854 mov eax, dword ptr fs:[00000030h] 5_2_01760854
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01734859 mov eax, dword ptr fs:[00000030h] 5_2_01734859
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01734859 mov eax, dword ptr fs:[00000030h] 5_2_01734859
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01742840 mov ecx, dword ptr fs:[00000030h] 5_2_01742840
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01752835 mov eax, dword ptr fs:[00000030h] 5_2_01752835
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01752835 mov eax, dword ptr fs:[00000030h] 5_2_01752835
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01752835 mov eax, dword ptr fs:[00000030h] 5_2_01752835
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01752835 mov ecx, dword ptr fs:[00000030h] 5_2_01752835
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01752835 mov eax, dword ptr fs:[00000030h] 5_2_01752835
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01752835 mov eax, dword ptr fs:[00000030h] 5_2_01752835
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_018008C0 mov eax, dword ptr fs:[00000030h] 5_2_018008C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176A830 mov eax, dword ptr fs:[00000030h] 5_2_0176A830
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D483A mov eax, dword ptr fs:[00000030h] 5_2_017D483A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D483A mov eax, dword ptr fs:[00000030h] 5_2_017D483A
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BC810 mov eax, dword ptr fs:[00000030h] 5_2_017BC810
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176C8F9 mov eax, dword ptr fs:[00000030h] 5_2_0176C8F9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176C8F9 mov eax, dword ptr fs:[00000030h] 5_2_0176C8F9
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FA8E4 mov eax, dword ptr fs:[00000030h] 5_2_017FA8E4
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175E8C0 mov eax, dword ptr fs:[00000030h] 5_2_0175E8C0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BC89D mov eax, dword ptr fs:[00000030h] 5_2_017BC89D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01730887 mov eax, dword ptr fs:[00000030h] 5_2_01730887
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0172CB7E mov eax, dword ptr fs:[00000030h] 5_2_0172CB7E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01728B50 mov eax, dword ptr fs:[00000030h] 5_2_01728B50
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DEB50 mov eax, dword ptr fs:[00000030h] 5_2_017DEB50
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E4B4B mov eax, dword ptr fs:[00000030h] 5_2_017E4B4B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E4B4B mov eax, dword ptr fs:[00000030h] 5_2_017E4B4B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C6B40 mov eax, dword ptr fs:[00000030h] 5_2_017C6B40
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017C6B40 mov eax, dword ptr fs:[00000030h] 5_2_017C6B40
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017FAB40 mov eax, dword ptr fs:[00000030h] 5_2_017FAB40
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017D8B42 mov eax, dword ptr fs:[00000030h] 5_2_017D8B42
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175EB20 mov eax, dword ptr fs:[00000030h] 5_2_0175EB20
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175EB20 mov eax, dword ptr fs:[00000030h] 5_2_0175EB20
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F8B28 mov eax, dword ptr fs:[00000030h] 5_2_017F8B28
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017F8B28 mov eax, dword ptr fs:[00000030h] 5_2_017F8B28
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AEB1D mov eax, dword ptr fs:[00000030h] 5_2_017AEB1D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AEB1D mov eax, dword ptr fs:[00000030h] 5_2_017AEB1D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AEB1D mov eax, dword ptr fs:[00000030h] 5_2_017AEB1D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AEB1D mov eax, dword ptr fs:[00000030h] 5_2_017AEB1D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AEB1D mov eax, dword ptr fs:[00000030h] 5_2_017AEB1D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AEB1D mov eax, dword ptr fs:[00000030h] 5_2_017AEB1D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AEB1D mov eax, dword ptr fs:[00000030h] 5_2_017AEB1D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AEB1D mov eax, dword ptr fs:[00000030h] 5_2_017AEB1D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017AEB1D mov eax, dword ptr fs:[00000030h] 5_2_017AEB1D
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804B00 mov eax, dword ptr fs:[00000030h] 5_2_01804B00
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01738BF0 mov eax, dword ptr fs:[00000030h] 5_2_01738BF0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01738BF0 mov eax, dword ptr fs:[00000030h] 5_2_01738BF0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01738BF0 mov eax, dword ptr fs:[00000030h] 5_2_01738BF0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175EBFC mov eax, dword ptr fs:[00000030h] 5_2_0175EBFC
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BCBF0 mov eax, dword ptr fs:[00000030h] 5_2_017BCBF0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DEBD0 mov eax, dword ptr fs:[00000030h] 5_2_017DEBD0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01750BCB mov eax, dword ptr fs:[00000030h] 5_2_01750BCB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01750BCB mov eax, dword ptr fs:[00000030h] 5_2_01750BCB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01750BCB mov eax, dword ptr fs:[00000030h] 5_2_01750BCB
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01730BCD mov eax, dword ptr fs:[00000030h] 5_2_01730BCD
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01730BCD mov eax, dword ptr fs:[00000030h] 5_2_01730BCD
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01730BCD mov eax, dword ptr fs:[00000030h] 5_2_01730BCD
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740BBE mov eax, dword ptr fs:[00000030h] 5_2_01740BBE
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740BBE mov eax, dword ptr fs:[00000030h] 5_2_01740BBE
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E4BB0 mov eax, dword ptr fs:[00000030h] 5_2_017E4BB0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017E4BB0 mov eax, dword ptr fs:[00000030h] 5_2_017E4BB0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01802B57 mov eax, dword ptr fs:[00000030h] 5_2_01802B57
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01802B57 mov eax, dword ptr fs:[00000030h] 5_2_01802B57
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01802B57 mov eax, dword ptr fs:[00000030h] 5_2_01802B57
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01802B57 mov eax, dword ptr fs:[00000030h] 5_2_01802B57
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01804A80 mov eax, dword ptr fs:[00000030h] 5_2_01804A80
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017ACA72 mov eax, dword ptr fs:[00000030h] 5_2_017ACA72
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017ACA72 mov eax, dword ptr fs:[00000030h] 5_2_017ACA72
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176CA6F mov eax, dword ptr fs:[00000030h] 5_2_0176CA6F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176CA6F mov eax, dword ptr fs:[00000030h] 5_2_0176CA6F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176CA6F mov eax, dword ptr fs:[00000030h] 5_2_0176CA6F
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017DEA60 mov eax, dword ptr fs:[00000030h] 5_2_017DEA60
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01736A50 mov eax, dword ptr fs:[00000030h] 5_2_01736A50
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01736A50 mov eax, dword ptr fs:[00000030h] 5_2_01736A50
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01736A50 mov eax, dword ptr fs:[00000030h] 5_2_01736A50
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01736A50 mov eax, dword ptr fs:[00000030h] 5_2_01736A50
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01736A50 mov eax, dword ptr fs:[00000030h] 5_2_01736A50
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01736A50 mov eax, dword ptr fs:[00000030h] 5_2_01736A50
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01736A50 mov eax, dword ptr fs:[00000030h] 5_2_01736A50
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740A5B mov eax, dword ptr fs:[00000030h] 5_2_01740A5B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01740A5B mov eax, dword ptr fs:[00000030h] 5_2_01740A5B
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01754A35 mov eax, dword ptr fs:[00000030h] 5_2_01754A35
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01754A35 mov eax, dword ptr fs:[00000030h] 5_2_01754A35
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176CA38 mov eax, dword ptr fs:[00000030h] 5_2_0176CA38
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176CA24 mov eax, dword ptr fs:[00000030h] 5_2_0176CA24
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0175EA2E mov eax, dword ptr fs:[00000030h] 5_2_0175EA2E
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_017BCA11 mov eax, dword ptr fs:[00000030h] 5_2_017BCA11
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176AAEE mov eax, dword ptr fs:[00000030h] 5_2_0176AAEE
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_0176AAEE mov eax, dword ptr fs:[00000030h] 5_2_0176AAEE
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01730AD0 mov eax, dword ptr fs:[00000030h] 5_2_01730AD0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01764AD0 mov eax, dword ptr fs:[00000030h] 5_2_01764AD0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01764AD0 mov eax, dword ptr fs:[00000030h] 5_2_01764AD0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01786ACC mov eax, dword ptr fs:[00000030h] 5_2_01786ACC
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01786ACC mov eax, dword ptr fs:[00000030h] 5_2_01786ACC
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01786ACC mov eax, dword ptr fs:[00000030h] 5_2_01786ACC
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01738AA0 mov eax, dword ptr fs:[00000030h] 5_2_01738AA0
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Code function: 5_2_01738AA0 mov eax, dword ptr fs:[00000030h] 5_2_01738AA0
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe"
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe" Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtProtectVirtualMemory: Direct from: 0x77542F9C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtSetInformationProcess: Direct from: 0x77542C5C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtOpenKeyEx: Direct from: 0x77542B9C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtProtectVirtualMemory: Direct from: 0x77537B2E Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtCreateFile: Direct from: 0x77542FEC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtOpenFile: Direct from: 0x77542DCC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtQueryInformationToken: Direct from: 0x77542CAC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtDeviceIoControlFile: Direct from: 0x77542AEC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtAllocateVirtualMemory: Direct from: 0x77542BEC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtQueryVolumeInformationFile: Direct from: 0x77542F2C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtOpenSection: Direct from: 0x77542E0C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtAllocateVirtualMemory: Direct from: 0x775448EC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtSetInformationThread: Direct from: 0x775363F9 Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtQuerySystemInformation: Direct from: 0x775448CC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtClose: Direct from: 0x77542B6C
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtReadVirtualMemory: Direct from: 0x77542E8C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtCreateKey: Direct from: 0x77542C6C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtSetInformationThread: Direct from: 0x77542B4C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtQueryAttributesFile: Direct from: 0x77542E6C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtAllocateVirtualMemory: Direct from: 0x77543C9C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtCreateUserProcess: Direct from: 0x7754371C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtQueryInformationProcess: Direct from: 0x77542C26 Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtResumeThread: Direct from: 0x77542FBC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtWriteVirtualMemory: Direct from: 0x7754490C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtDelayExecution: Direct from: 0x77542DDC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtAllocateVirtualMemory: Direct from: 0x77542BFC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtReadFile: Direct from: 0x77542ADC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtQuerySystemInformation: Direct from: 0x77542DFC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtResumeThread: Direct from: 0x775436AC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtNotifyChangeKey: Direct from: 0x77543C2C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtCreateMutant: Direct from: 0x775435CC Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtWriteVirtualMemory: Direct from: 0x77542E3C Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe NtMapViewOfSection: Direct from: 0x77542D1C Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Memory written: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: NULL target: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Section loaded: NULL target: C:\Windows\SysWOW64\shutdown.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: NULL target: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: NULL target: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\shutdown.exe Thread register set: target process: 1544 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\shutdown.exe Thread APC queued: target process: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe" Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Process created: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe "C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe" Jump to behavior
Source: C:\Program Files (x86)\fCItteFJYCpGRjbbipFVZXppqDEMltRMTRZhTmAkhCdoSZgFZhPaeeYRYCCJYhiNGjPK\zkhJmzWnNnFLoIoaAsyqpwQZ.exe Process created: C:\Windows\SysWOW64\shutdown.exe "C:\Windows\SysWOW64\shutdown.exe" Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000002.2562495871.00000000018E1000.00000002.00000001.00040000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000000.2140831880.00000000018E1000.00000002.00000001.00040000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000E.00000000.2279922196.0000000001431000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000002.2562495871.00000000018E1000.00000002.00000001.00040000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000000.2140831880.00000000018E1000.00000002.00000001.00040000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000E.00000000.2279922196.0000000001431000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000002.2562495871.00000000018E1000.00000002.00000001.00040000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000000.2140831880.00000000018E1000.00000002.00000001.00040000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000E.00000000.2279922196.0000000001431000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000002.2562495871.00000000018E1000.00000002.00000001.00040000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000C.00000000.2140831880.00000000018E1000.00000002.00000001.00040000.00000000.sdmp, zkhJmzWnNnFLoIoaAsyqpwQZ.exe, 0000000E.00000000.2279922196.0000000001431000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Queries volume information: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.2563757906.0000000003700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2561298319.0000000003230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2563222127.0000000000FA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2213669414.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2214051577.0000000001250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2563650828.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2215409822.0000000001AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2563123525.0000000002F70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\shutdown.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\shutdown.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.2563757906.0000000003700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2561298319.0000000003230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2563222127.0000000000FA0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2213669414.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2214051577.0000000001250000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2563650828.00000000036C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2215409822.0000000001AF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2563123525.0000000002F70000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1467080 Sample: 03.07.2024-sipari#U015f UG0... Startdate: 03/07/2024 Architecture: WINDOWS Score: 100 35 www.fungusbus.com 2->35 37 www.deviexp.com 2->37 39 2 other IPs or domains 2->39 43 Snort IDS alert for network traffic 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 9 other signatures 2->49 10 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe 4 2->10         started        signatures3 process4 file5 33 03.07.2024-sipari#... ve Tic a.s.exe.log, ASCII 10->33 dropped 61 Adds a directory exclusion to Windows Defender 10->61 63 Injects a PE file into a foreign processes 10->63 14 03.07.2024-sipari#U015f UG01072410 -onka ve Tic a.s.exe 10->14         started        17 powershell.exe 23 10->17         started        signatures6 process7 signatures8 67 Maps a DLL or memory area into another process 14->67 19 zkhJmzWnNnFLoIoaAsyqpwQZ.exe 14->19 injected 69 Loading BitLocker PowerShell Module 17->69 22 conhost.exe 17->22         started        process9 signatures10 51 Found direct / indirect Syscall (likely to bypass EDR) 19->51 24 shutdown.exe 13 19->24         started        process11 signatures12 53 Tries to steal Mail credentials (via file / registry access) 24->53 55 Tries to harvest and steal browser information (history, passwords, etc) 24->55 57 Deletes itself after installation 24->57 59 4 other signatures 24->59 27 zkhJmzWnNnFLoIoaAsyqpwQZ.exe 24->27 injected 31 firefox.exe 24->31         started        process13 dnsIp14 41 parkingpage.namecheap.com 91.195.240.19, 49715, 80 SEDO-ASDE Germany 27->41 65 Found direct / indirect Syscall (likely to bypass EDR) 27->65 signatures15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.195.240.19
 parkingpage.namecheap.com Germany
47846 SEDO-ASDE true

Contacted Domains

Name IP Active
parkingpage.namecheap.com 91.195.240.19 true
www.fungusbus.com unknown unknown
www.deviexp.com unknown unknown
www.betful.site unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.fungusbus.com/ucdm/?j2=EKdombQUikql/e8x5w/b0WRCZZ7GjewvGt5yqJ62oMuwgaHfKWbffkwAJSwjzlHKlyNbdgTciiNebF1Tnxx1ssE7dAszzRsyY0LYOFUjrmAhIYA2gw==&NbL=5XSdkb2PqtnPh8PP true
  • Avira URL Cloud: safe
 unknown