Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Ticari Siparis Belgesi 26 07 2024 17545000600.exe

Overview

General Information

Sample name:Ticari Siparis Belgesi 26 07 2024 17545000600.exe
Analysis ID:1485412
MD5:4a699c45efa52f13210361413ebd9358
SHA1:4243cc3717a371b2fdf4a7eb0387ea3b19a62764
SHA256:078b3704bde85e8ad84e4c21ca910f5d5367843bbecc2a384acc3fd89cd3553c
Tags:exeformbook
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to launch a process as a different user
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Ticari Siparis Belgesi 26 07 2024 17545000600.exe (PID: 6520 cmdline: "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe" MD5: 4A699C45EFA52F13210361413EBD9358)
    • powershell.exe (PID: 6444 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • Ticari Siparis Belgesi 26 07 2024 17545000600.exe (PID: 3116 cmdline: "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe" MD5: 4A699C45EFA52F13210361413EBD9358)
      • explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
        • cmd.exe (PID: 7364 cmdline: "C:\Windows\SysWOW64\cmd.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • cmd.exe (PID: 7420 cmdline: /c del "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 7428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.jnhdh8827.com/pz12/"], "decoy": ["paucanyes.com", "autonwheels.com", "cowboysandcaviarbar.com", "fitnessengineeredworkouts.com", "nuevobajonfavorito.com", "dflx8.com", "rothability.com", "sxybet88.com", "onesource.live", "brenjitu1904.com", "airdrop-zero1labs.com", "guangdongqiangzhetc.com", "apartments-for-rent-72254.bond", "ombak99.lol", "qqfoodsolutions.com", "kyyzz.com", "thepicklematch.com", "ainth.com", "missorris.com", "gabbygomez.com", "aromacuppa.com", "kaskusbagus.com", "zoox1.asia", "hemophilia-treatment-41433.bond", "meidupro.com", "shrisona.com", "sekanse.com", "marcocostasax.com", "loyalbahis356.com", "mzmz97.com", "ma-google.com", "xiangadvanced.site", "tuotalogis.com", "xcxocef.shop", "fidgetbottles.com", "shuaninvolved.site", "ambientelatino.com", "98980901.com", "singhbrothersframes.com", "pureamyl.com", "hgs0713.net", "surejobzapp.com", "slotgame99.bet", "datalakeflow.com", "ebehemin.com", "vanessasmobilespa.com", "317wb.com", "motchillssss.top", "huesch.net", "salesgymshark.shop", "mejorcompra99.com", "tacubashop.com", "jessicaxsimmons.com", "roar-stores.com", "chalkandthimble.com", "84556.vip", "luyutuwen.com", "siliconcollege.icu", "marvowhite.com", "gjxuh82y0u3h6.top", "e2taop5.top", "businessbroadway.com", "cripmz.xyz", "4hu259.com"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x6251:$a1: 3C 30 50 4F 53 54 74 09 40
      • 0x1cbc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0xa9cf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      • 0x158b7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
      00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
      • 0x18849:$sqlite3step: 68 34 1C 7B E1
      • 0x1895c:$sqlite3step: 68 34 1C 7B E1
      • 0x18878:$sqlite3text: 68 38 2A 90 C5
      • 0x1899d:$sqlite3text: 68 38 2A 90 C5
      • 0x1888b:$sqlite3blob: 68 53 D8 7F 8C
      • 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
      Click to see the 25 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x5451:$a1: 3C 30 50 4F 53 54 74 09 40
          • 0x1bdc0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x9bcf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          • 0x14ab7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
          6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
          • 0x17a49:$sqlite3step: 68 34 1C 7B E1
          • 0x17b5c:$sqlite3step: 68 34 1C 7B E1
          • 0x17a78:$sqlite3text: 68 38 2A 90 C5
          • 0x17b9d:$sqlite3text: 68 38 2A 90 C5
          • 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C
          • 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
          Click to see the 5 entries

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", ParentImage: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe, ParentProcessId: 6520, ParentProcessName: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", ProcessId: 6444, ProcessName: powershell.exe
          Sigma detected: Powershell Defender Exclusion
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", ParentImage: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe, ParentProcessId: 6520, ParentProcessName: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", ProcessId: 6444, ProcessName: powershell.exe
          Sigma detected: Non Interactive PowerShell Process Spawned
          Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", ParentImage: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe, ParentProcessId: 6520, ParentProcessName: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe", ProcessId: 6444, ProcessName: powershell.exe

          Snort Signatures

          ⊘No Snort rule has matched

          Suricata Signatures

          Timestamp:2024-07-31T16:01:32.709233+0200
          SID:2031453
          Source Port:52194
          Destination Port:80
          Protocol:TCP
          Classtype:Malware Command and Control Activity Detected
          Timestamp:2024-07-31T16:02:34.625397+0200
          SID:2031453
          Source Port:52197
          Destination Port:80
          Protocol:TCP
          Classtype:Malware Command and Control Activity Detected
          Timestamp:2024-07-31T16:02:15.959407+0200
          SID:2031453
          Source Port:52196
          Destination Port:80
          Protocol:TCP
          Classtype:Malware Command and Control Activity Detected
          Timestamp:2024-07-31T15:59:29.688565+0200
          SID:2031453
          Source Port:52191
          Destination Port:80
          Protocol:TCP
          Classtype:Malware Command and Control Activity Detected
          Timestamp:2024-07-31T16:01:53.574872+0200
          SID:2031453
          Source Port:52195
          Destination Port:80
          Protocol:TCP
          Classtype:Malware Command and Control Activity Detected
          Timestamp:2024-07-31T16:01:12.188977+0200
          SID:2031453
          Source Port:52193
          Destination Port:80
          Protocol:TCP
          Classtype:Malware Command and Control Activity Detected
          Timestamp:2024-07-31T16:00:51.151727+0200
          SID:2031453
          Source Port:52192
          Destination Port:80
          Protocol:TCP
          Classtype:Malware Command and Control Activity Detected
          Timestamp:2024-07-31T15:58:50.266265+0200
          SID:2031453
          Source Port:52188
          Destination Port:80
          Protocol:TCP
          Classtype:Malware Command and Control Activity Detected

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeAvira: detected
          Antivirus detection for URL or domain
          Source: http://www.autonwheels.com/pz12/www.vanessasmobilespa.comAvira URL Cloud: Label: malware
          Source: http://www.chalkandthimble.comAvira URL Cloud: Label: malware
          Source: http://www.autonwheels.comAvira URL Cloud: Label: malware
          Source: https://loyalbahis356.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=mhHbh1AUgvkDqhcxvrHPgmJxw//lx/Avira URL Cloud: Label: malware
          Source: http://www.xcxocef.shop/pz12/www.chalkandthimble.comAvira URL Cloud: Label: phishing
          Source: http://www.autonwheels.com/pz12/Avira URL Cloud: Label: malware
          Source: http://www.chalkandthimble.com/pz12/Avira URL Cloud: Label: malware
          Source: http://www.loyalbahis356.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=mhHbh1AUgvkDqhcxvrHPgmJxw//lx/+38lrQrf/b9xTaJsLm+Z3/RBaY9L1MEhp7dpaAAvira URL Cloud: Label: malware
          Source: http://www.chalkandthimble.com/pz12/www.xiangadvanced.siteAvira URL Cloud: Label: malware
          Source: http://www.chalkandthimble.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=9hrk18skSQhCCsrWhUPNj3yaKA8UlZiY5Un3cfGqWer7qRPGp2VeMQg9udTNeDooaK7+Avira URL Cloud: Label: malware
          Source: http://www.loyalbahis356.comAvira URL Cloud: Label: malware
          Source: http://www.xcxocef.shop/pz12/Avira URL Cloud: Label: malware
          Source: http://www.xcxocef.shopAvira URL Cloud: Label: phishing
          Source: http://www.loyalbahis356.com/pz12/www.aromacuppa.comAvira URL Cloud: Label: malware
          Source: http://www.loyalbahis356.com/pz12/Avira URL Cloud: Label: malware
          Found malware configuration
          Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.jnhdh8827.com/pz12/"], "decoy": ["paucanyes.com", "autonwheels.com", "cowboysandcaviarbar.com", "fitnessengineeredworkouts.com", "nuevobajonfavorito.com", "dflx8.com", "rothability.com", "sxybet88.com", "onesource.live", "brenjitu1904.com", "airdrop-zero1labs.com", "guangdongqiangzhetc.com", "apartments-for-rent-72254.bond", "ombak99.lol", "qqfoodsolutions.com", "kyyzz.com", "thepicklematch.com", "ainth.com", "missorris.com", "gabbygomez.com", "aromacuppa.com", "kaskusbagus.com", "zoox1.asia", "hemophilia-treatment-41433.bond", "meidupro.com", "shrisona.com", "sekanse.com", "marcocostasax.com", "loyalbahis356.com", "mzmz97.com", "ma-google.com", "xiangadvanced.site", "tuotalogis.com", "xcxocef.shop", "fidgetbottles.com", "shuaninvolved.site", "ambientelatino.com", "98980901.com", "singhbrothersframes.com", "pureamyl.com", "hgs0713.net", "surejobzapp.com", "slotgame99.bet", "datalakeflow.com", "ebehemin.com", "vanessasmobilespa.com", "317wb.com", "motchillssss.top", "huesch.net", "salesgymshark.shop", "mejorcompra99.com", "tacubashop.com", "jessicaxsimmons.com", "roar-stores.com", "chalkandthimble.com", "84556.vip", "luyutuwen.com", "siliconcollege.icu", "marvowhite.com", "gjxuh82y0u3h6.top", "e2taop5.top", "businessbroadway.com", "cripmz.xyz", "4hu259.com"]}
          Multi AV Scanner detection for submitted file
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeReversingLabs: Detection: 76%
          Yara detected FormBook
          Source: Yara matchFile source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
          Machine Learning detection for sample
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeJoe Sandbox ML: detected
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: bBvN.pdbSHA256 source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Binary string: cmd.pdbUGP source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000006.00000002.2192065955.0000000002EE0000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000008.00000003.2192228602.000000000359D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000003.2190559274.00000000033E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, cmd.exe, 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000008.00000003.2192228602.000000000359D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000003.2190559274.00000000033E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: bBvN.pdb source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Binary string: cmd.pdb source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000006.00000002.2192065955.0000000002EE0000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, cmd.exe, 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,8_2_007A589A
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007B3E66 FindFirstFileW,FindNextFileW,FindClose,8_2_007B3E66
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,8_2_007A0207
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,8_2_007A4EC1
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0079532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,8_2_0079532E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 4x nop then pop ebx6_2_00407B1B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 4x nop then pop edi6_2_00416CEB
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 4x nop then pop ebx8_2_02E37B1B
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 4x nop then pop edi8_2_02E46CEB

          Networking

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 207.241.198.3 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 108.157.194.11 80Jump to behavior
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.jnhdh8827.com/pz12/
          Source: global trafficHTTP traffic detected: GET /pz12/?XvRxR=rTfdhh5hH2&NBtT=XLxih9erqU5OQ/zVa2U9uayzQwvQYqwD+iUwcFTJkQJbXUUHI+Ws7VPKfbblI2vONd0o HTTP/1.1Host: www.datalakeflow.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /pz12/?XvRxR=rTfdhh5hH2&NBtT=9hrk18skSQhCCsrWhUPNj3yaKA8UlZiY5Un3cfGqWer7qRPGp2VeMQg9udTNeDooaK7+ HTTP/1.1Host: www.chalkandthimble.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /pz12/?XvRxR=rTfdhh5hH2&NBtT=mhHbh1AUgvkDqhcxvrHPgmJxw//lx/+38lrQrf/b9xTaJsLm+Z3/RBaY9L1MEhp7dpaA HTTP/1.1Host: www.loyalbahis356.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 108.157.194.11 108.157.194.11
          Source: Joe Sandbox ViewASN Name: LIGHTSOURCE-US LIGHTSOURCE-US
          Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: C:\Windows\explorer.exeCode function: 7_2_10464F82 getaddrinfo,setsockopt,recv,7_2_10464F82
          Source: global trafficHTTP traffic detected: GET /pz12/?XvRxR=rTfdhh5hH2&NBtT=XLxih9erqU5OQ/zVa2U9uayzQwvQYqwD+iUwcFTJkQJbXUUHI+Ws7VPKfbblI2vONd0o HTTP/1.1Host: www.datalakeflow.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /pz12/?XvRxR=rTfdhh5hH2&NBtT=9hrk18skSQhCCsrWhUPNj3yaKA8UlZiY5Un3cfGqWer7qRPGp2VeMQg9udTNeDooaK7+ HTTP/1.1Host: www.chalkandthimble.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /pz12/?XvRxR=rTfdhh5hH2&NBtT=mhHbh1AUgvkDqhcxvrHPgmJxw//lx/+38lrQrf/b9xTaJsLm+Z3/RBaY9L1MEhp7dpaA HTTP/1.1Host: www.loyalbahis356.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficDNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
          Source: global trafficDNS traffic detected: DNS query: www.datalakeflow.com
          Source: global trafficDNS traffic detected: DNS query: www.xcxocef.shop
          Source: global trafficDNS traffic detected: DNS query: www.chalkandthimble.com
          Source: global trafficDNS traffic detected: DNS query: www.xiangadvanced.site
          Source: global trafficDNS traffic detected: DNS query: www.317wb.com
          Source: global trafficDNS traffic detected: DNS query: www.loyalbahis356.com
          Source: global trafficDNS traffic detected: DNS query: www.aromacuppa.com
          Source: global trafficDNS traffic detected: DNS query: www.autonwheels.com
          Source: global trafficDNS traffic detected: DNS query: www.vanessasmobilespa.com
          Source: global trafficDNS traffic detected: DNS query: www.98980901.com
          Source: global trafficDNS traffic detected: DNS query: www.jnhdh8827.com
          Source: explorer.exe, 00000007.00000002.4545593539.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4545593539.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: explorer.exe, 00000007.00000002.4538762767.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2131821278.0000000000F13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.v
          Source: explorer.exe, 00000007.00000002.4545593539.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4545593539.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: explorer.exe, 00000007.00000002.4545593539.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4545593539.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: explorer.exe, 00000007.00000002.4545593539.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4545593539.0000000009B0B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: explorer.exe, 00000007.00000003.3094747325.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4545593539.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
          Source: explorer.exe, 00000007.00000000.2137907662.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.2142461714.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000002.4544751645.0000000008870000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000000.00000002.2128019151.0000000002A21000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.317wb.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.317wb.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.317wb.com/pz12/www.loyalbahis356.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.317wb.comReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.98980901.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.98980901.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.98980901.com/pz12/www.jnhdh8827.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.98980901.comReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aromacuppa.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aromacuppa.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aromacuppa.com/pz12/www.autonwheels.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.aromacuppa.comReferer:
          Source: explorer.exe, 00000007.00000000.2149075288.000000000C860000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3103961985.000000000C860000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autonwheels.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autonwheels.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autonwheels.com/pz12/www.vanessasmobilespa.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autonwheels.comReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.brenjitu1904.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.brenjitu1904.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.brenjitu1904.com/pz12/www.salesgymshark.shop
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.brenjitu1904.comReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.businessbroadway.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.businessbroadway.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.businessbroadway.com/pz12/www.qqfoodsolutions.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.businessbroadway.comReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.chalkandthimble.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.chalkandthimble.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.chalkandthimble.com/pz12/www.xiangadvanced.site
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.chalkandthimble.comReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cripmz.xyz
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cripmz.xyz/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cripmz.xyz/pz12/www.317wb.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.cripmz.xyzReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.datalakeflow.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.datalakeflow.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.datalakeflow.com/pz12/www.xcxocef.shop
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.datalakeflow.comReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jnhdh8827.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jnhdh8827.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jnhdh8827.com/pz12/www.brenjitu1904.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.jnhdh8827.comReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.loyalbahis356.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.loyalbahis356.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.loyalbahis356.com/pz12/www.aromacuppa.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.loyalbahis356.comReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.qqfoodsolutions.com
          Source: explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.qqfoodsolutions.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.qqfoodsolutions.comReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.salesgymshark.shop
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.salesgymshark.shop/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.salesgymshark.shop/pz12/www.businessbroadway.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.salesgymshark.shopReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vanessasmobilespa.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vanessasmobilespa.com/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vanessasmobilespa.com/pz12/www.98980901.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.vanessasmobilespa.comReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xcxocef.shop
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xcxocef.shop/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xcxocef.shop/pz12/www.chalkandthimble.com
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xcxocef.shopReferer:
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xiangadvanced.site
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xiangadvanced.site/pz12/
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xiangadvanced.site/pz12/www.cripmz.xyz
          Source: explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.xiangadvanced.siteReferer:
          Source: explorer.exe, 00000007.00000000.2148003902.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4552727694.000000000C54A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3100767881.000000000C547000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
          Source: explorer.exe, 00000007.00000000.2135493161.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3102199089.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3566241603.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4542934252.00000000076F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
          Source: explorer.exe, 00000007.00000003.3094747325.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4545593539.0000000009ADB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
          Source: explorer.exe, 00000007.00000000.2135493161.0000000007637000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4542501941.0000000007637000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
          Source: explorer.exe, 00000007.00000002.4540828283.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096357225.00000000035FA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2133108106.00000000035FA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.coml
          Source: explorer.exe, 00000007.00000003.3105365605.0000000009C21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4546550713.0000000009C22000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
          Source: explorer.exe, 00000007.00000002.4556895478.0000000010FBF000.00000004.80000000.00040000.00000000.sdmp, cmd.exe, 00000008.00000002.4540713209.000000000418F000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://loyalbahis356.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=mhHbh1AUgvkDqhcxvrHPgmJxw//lx/
          Source: explorer.exe, 00000007.00000003.3100077346.0000000009C92000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4546607897.0000000009C96000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
          Source: explorer.exe, 00000007.00000002.4551366329.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2148003902.000000000C460000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comcember
          Source: explorer.exe, 00000007.00000003.3094747325.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4545593539.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/)s
          Source: explorer.exe, 00000007.00000003.3094747325.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4545593539.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comon

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000002.4556728675.000000001047C000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
          Source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID: 6520, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID: 3116, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: cmd.exe PID: 7364, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041A360 NtCreateFile,6_2_0041A360
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041A410 NtReadFile,6_2_0041A410
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041A490 NtClose,6_2_0041A490
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041A540 NtAllocateVirtualMemory,6_2_0041A540
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041A35A NtCreateFile,6_2_0041A35A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041A40A NtReadFile,6_2_0041A40A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242B60 NtClose,LdrInitializeThunk,6_2_01242B60
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242BF0 NtAllocateVirtualMemory,LdrInitializeThunk,6_2_01242BF0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242AD0 NtReadFile,LdrInitializeThunk,6_2_01242AD0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242D30 NtUnmapViewOfSection,LdrInitializeThunk,6_2_01242D30
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242D10 NtMapViewOfSection,LdrInitializeThunk,6_2_01242D10
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242DF0 NtQuerySystemInformation,LdrInitializeThunk,6_2_01242DF0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242DD0 NtDelayExecution,LdrInitializeThunk,6_2_01242DD0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242C70 NtFreeVirtualMemory,LdrInitializeThunk,6_2_01242C70
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242CA0 NtQueryInformationToken,LdrInitializeThunk,6_2_01242CA0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242F30 NtCreateSection,LdrInitializeThunk,6_2_01242F30
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242FB0 NtResumeThread,LdrInitializeThunk,6_2_01242FB0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242F90 NtProtectVirtualMemory,LdrInitializeThunk,6_2_01242F90
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242FE0 NtCreateFile,LdrInitializeThunk,6_2_01242FE0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,6_2_01242EA0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242E80 NtReadVirtualMemory,LdrInitializeThunk,6_2_01242E80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01244340 NtSetContextThread,6_2_01244340
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01244650 NtSuspendThread,6_2_01244650
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242BA0 NtEnumerateValueKey,6_2_01242BA0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242B80 NtQueryInformationFile,6_2_01242B80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242BE0 NtQueryValueKey,6_2_01242BE0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242AB0 NtWaitForSingleObject,6_2_01242AB0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242AF0 NtWriteFile,6_2_01242AF0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242D00 NtSetInformationFile,6_2_01242D00
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242DB0 NtEnumerateKey,6_2_01242DB0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242C00 NtQueryInformationProcess,6_2_01242C00
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242C60 NtCreateKey,6_2_01242C60
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242CF0 NtOpenProcess,6_2_01242CF0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242CC0 NtQueryVirtualMemory,6_2_01242CC0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242F60 NtCreateProcessEx,6_2_01242F60
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242FA0 NtQuerySection,6_2_01242FA0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242E30 NtWriteVirtualMemory,6_2_01242E30
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242EE0 NtQueueApcThread,6_2_01242EE0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01243010 NtOpenDirectoryObject,6_2_01243010
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01243090 NtSetValueKey,6_2_01243090
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012435C0 NtCreateMutant,6_2_012435C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012439B0 NtGetContextThread,6_2_012439B0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01243D10 NtOpenProcessToken,6_2_01243D10
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01243D70 NtOpenThread,6_2_01243D70
          Source: C:\Windows\explorer.exeCode function: 7_2_10465E12 NtProtectVirtualMemory,7_2_10465E12
          Source: C:\Windows\explorer.exeCode function: 7_2_10464232 NtCreateFile,7_2_10464232
          Source: C:\Windows\explorer.exeCode function: 7_2_10465E0A NtProtectVirtualMemory,7_2_10465E0A
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007B7460 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,8_2_007B7460
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A643A NtOpenThreadToken,NtOpenProcessToken,NtClose,8_2_007A643A
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A4823 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,8_2_007A4823
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A64CA NtQueryInformationToken,8_2_007A64CA
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007BA135 NtSetInformationFile,8_2_007BA135
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A6500 NtQueryInformationToken,NtQueryInformationToken,8_2_007A6500
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007BC1FA SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,8_2_007BC1FA
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_00794E3B _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp,8_2_00794E3B
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A4759 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError,8_2_007A4759
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2B60 NtClose,LdrInitializeThunk,8_2_037C2B60
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2AD0 NtReadFile,LdrInitializeThunk,8_2_037C2AD0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2F30 NtCreateSection,LdrInitializeThunk,8_2_037C2F30
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2FE0 NtCreateFile,LdrInitializeThunk,8_2_037C2FE0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk,8_2_037C2EA0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2D10 NtMapViewOfSection,LdrInitializeThunk,8_2_037C2D10
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2DF0 NtQuerySystemInformation,LdrInitializeThunk,8_2_037C2DF0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2DD0 NtDelayExecution,LdrInitializeThunk,8_2_037C2DD0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2C70 NtFreeVirtualMemory,LdrInitializeThunk,8_2_037C2C70
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2C60 NtCreateKey,LdrInitializeThunk,8_2_037C2C60
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2CA0 NtQueryInformationToken,LdrInitializeThunk,8_2_037C2CA0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C35C0 NtCreateMutant,LdrInitializeThunk,8_2_037C35C0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C4340 NtSetContextThread,8_2_037C4340
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C4650 NtSuspendThread,8_2_037C4650
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2BF0 NtAllocateVirtualMemory,8_2_037C2BF0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2BE0 NtQueryValueKey,8_2_037C2BE0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2BA0 NtEnumerateValueKey,8_2_037C2BA0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2B80 NtQueryInformationFile,8_2_037C2B80
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2AF0 NtWriteFile,8_2_037C2AF0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2AB0 NtWaitForSingleObject,8_2_037C2AB0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2F60 NtCreateProcessEx,8_2_037C2F60
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2FB0 NtResumeThread,8_2_037C2FB0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2FA0 NtQuerySection,8_2_037C2FA0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2F90 NtProtectVirtualMemory,8_2_037C2F90
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2E30 NtWriteVirtualMemory,8_2_037C2E30
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2EE0 NtQueueApcThread,8_2_037C2EE0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2E80 NtReadVirtualMemory,8_2_037C2E80
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2D30 NtUnmapViewOfSection,8_2_037C2D30
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2D00 NtSetInformationFile,8_2_037C2D00
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2DB0 NtEnumerateKey,8_2_037C2DB0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2C00 NtQueryInformationProcess,8_2_037C2C00
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2CF0 NtOpenProcess,8_2_037C2CF0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C2CC0 NtQueryVirtualMemory,8_2_037C2CC0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C3010 NtOpenDirectoryObject,8_2_037C3010
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C3090 NtSetValueKey,8_2_037C3090
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C39B0 NtGetContextThread,8_2_037C39B0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C3D70 NtOpenThread,8_2_037C3D70
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C3D10 NtOpenProcessToken,8_2_037C3D10
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E4A360 NtCreateFile,8_2_02E4A360
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E4A490 NtClose,8_2_02E4A490
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E4A410 NtReadFile,8_2_02E4A410
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E4A35A NtCreateFile,8_2_02E4A35A
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E4A40A NtReadFile,8_2_02E4A40A
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03629BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose,8_2_03629BAF
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0362A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,RtlQueueApcWow64Thread,NtResumeThread,8_2_0362A036
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03629BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,8_2_03629BB2
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0362A042 NtQueryInformationProcess,8_2_0362A042
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_00794C10: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPAX@Z,memset,CreateFileW,DeviceIoControl,memcpy,CloseHandle,??_V@YAXPAX@Z,memset,??_V@YAXPAX@Z,FindClose,??_V@YAXPAX@Z,8_2_00794C10
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_00799458 InitializeProcThreadAttributeList,UpdateProcThreadAttribute,memset,memset,GetStartupInfoW,lstrcmpW,CreateProcessW,CloseHandle,GetLastError,GetLastError,DeleteProcThreadAttributeList,_local_unwind4,CreateProcessAsUserW,GetLastError,CloseHandle,8_2_00799458
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_010AD5DC0_2_010AD5DC
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_04FD7BB80_2_04FD7BB8
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_04FD00400_2_04FD0040
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_04FD001E0_2_04FD001E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_04FD7BA80_2_04FD7BA8
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F9377C0_2_06F9377C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F941280_2_06F94128
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F94F800_2_06F94F80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F996C00_2_06F996C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F9A4A80_2_06F9A4A8
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F904000_2_06F90400
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F903F00_2_06F903F0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F9F0500_2_06F9F050
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F97EC00_2_06F97EC0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F94F730_2_06F94F73
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F99AF80_2_06F99AF8
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_06F97A800_2_06F97A80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_004010306_2_00401030
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_00402D876_2_00402D87
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_00402D906_2_00402D90
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041EDAD6_2_0041EDAD
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_00409E606_2_00409E60
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041D7A06_2_0041D7A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_00402FB06_2_00402FB0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012001006_2_01200100
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AA1186_2_012AA118
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012981586_2_01298158
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D01AA6_2_012D01AA
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C41A26_2_012C41A2
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C81CC6_2_012C81CC
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A20006_2_012A2000
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CA3526_2_012CA352
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D03E66_2_012D03E6
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121E3F06_2_0121E3F0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B02746_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012902C06_2_012902C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012105356_2_01210535
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D05916_2_012D0591
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B44206_2_012B4420
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C24466_2_012C2446
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012BE4F66_2_012BE4F6
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012107706_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012347506_2_01234750
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120C7C06_2_0120C7C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122C6E06_2_0122C6E0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012269626_2_01226962
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A06_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012DA9A66_2_012DA9A6
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121A8406_2_0121A840
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012128406_2_01212840
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011F68B86_2_011F68B8
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E8F06_2_0123E8F0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CAB406_2_012CAB40
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C6BD76_2_012C6BD7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120EA806_2_0120EA80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121AD006_2_0121AD00
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012ACD1F6_2_012ACD1F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01228DBF6_2_01228DBF
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120ADE06_2_0120ADE0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210C006_2_01210C00
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0CB56_2_012B0CB5
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01200CF26_2_01200CF2
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01252F286_2_01252F28
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01230F306_2_01230F30
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B2F306_2_012B2F30
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01284F406_2_01284F40
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128EFA06_2_0128EFA0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121CFE06_2_0121CFE0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01202FC86_2_01202FC8
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CEE266_2_012CEE26
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210E596_2_01210E59
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01222E906_2_01222E90
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CCE936_2_012CCE93
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CEEDB6_2_012CEEDB
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012DB16B6_2_012DB16B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0124516C6_2_0124516C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FF1726_2_011FF172
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121B1B06_2_0121B1B0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C70E96_2_012C70E9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CF0E06_2_012CF0E0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012170C06_2_012170C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012BF0CC6_2_012BF0CC
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C132D6_2_012C132D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FD34C6_2_011FD34C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0125739A6_2_0125739A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012152A06_2_012152A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B12ED6_2_012B12ED
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122B2C06_2_0122B2C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C75716_2_012C7571
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AD5B06_2_012AD5B0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D95C36_2_012D95C3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CF43F6_2_012CF43F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012014606_2_01201460
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CF7B06_2_012CF7B0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012556306_2_01255630
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C16CC6_2_012C16CC
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A59106_2_012A5910
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012199506_2_01219950
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122B9506_2_0122B950
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127D8006_2_0127D800
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012138E06_2_012138E0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CFB766_2_012CFB76
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122FB806_2_0122FB80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01285BF06_2_01285BF0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0124DBF96_2_0124DBF9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01283A6C6_2_01283A6C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CFA496_2_012CFA49
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C7A466_2_012C7A46
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01255AA06_2_01255AA0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012ADAAC6_2_012ADAAC
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B1AA36_2_012B1AA3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012BDAC66_2_012BDAC6
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C7D736_2_012C7D73
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01213D406_2_01213D40
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C1D5A6_2_012C1D5A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122FDC06_2_0122FDC0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01289C326_2_01289C32
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CFCF26_2_012CFCF2
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CFF096_2_012CFF09
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CFFB16_2_012CFFB1
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01211F926_2_01211F92
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011D3FD56_2_011D3FD5
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011D3FD26_2_011D3FD2
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01219EB06_2_01219EB0
          Source: C:\Windows\explorer.exeCode function: 7_2_097249127_2_09724912
          Source: C:\Windows\explorer.exeCode function: 7_2_0971ED027_2_0971ED02
          Source: C:\Windows\explorer.exeCode function: 7_2_0972A5CD7_2_0972A5CD
          Source: C:\Windows\explorer.exeCode function: 7_2_097260367_2_09726036
          Source: C:\Windows\explorer.exeCode function: 7_2_0971D0827_2_0971D082
          Source: C:\Windows\explorer.exeCode function: 7_2_09721B327_2_09721B32
          Source: C:\Windows\explorer.exeCode function: 7_2_09721B307_2_09721B30
          Source: C:\Windows\explorer.exeCode function: 7_2_097272327_2_09727232
          Source: C:\Windows\explorer.exeCode function: 7_2_104642327_2_10464232
          Source: C:\Windows\explorer.exeCode function: 7_2_104630367_2_10463036
          Source: C:\Windows\explorer.exeCode function: 7_2_1045A0827_2_1045A082
          Source: C:\Windows\explorer.exeCode function: 7_2_1045BD027_2_1045BD02
          Source: C:\Windows\explorer.exeCode function: 7_2_104619127_2_10461912
          Source: C:\Windows\explorer.exeCode function: 7_2_1045EB307_2_1045EB30
          Source: C:\Windows\explorer.exeCode function: 7_2_1045EB327_2_1045EB32
          Source: C:\Windows\explorer.exeCode function: 7_2_104675CD7_2_104675CD
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A48758_2_007A4875
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_00794C108_2_00794C10
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0079540A8_2_0079540A
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007974B18_2_007974B1
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007B695A8_2_007B695A
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007991448_2_00799144
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007B41918_2_007B4191
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0079D6608_2_0079D660
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007B3E668_2_007B3E66
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_00796E578_2_00796E57
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_00797A348_2_00797A34
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0079EE038_2_0079EE03
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A4EC18_2_007A4EC1
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A3EB38_2_007A3EB3
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007B769E8_2_007B769E
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A5A868_2_007A5A86
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A07408_2_007A0740
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_00796B208_2_00796B20
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A0BF08_2_007A0BF0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038503E68_2_038503E6
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0379E3F08_2_0379E3F0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384A3528_2_0384A352
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038102C08_2_038102C0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038302748_2_03830274
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038441A28_2_038441A2
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038501AA8_2_038501AA
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038481CC8_2_038481CC
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037801008_2_03780100
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0382A1188_2_0382A118
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038181588_2_03818158
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038220008_2_03822000
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037907708_2_03790770
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037B47508_2_037B4750
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0378C7C08_2_0378C7C0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037AC6E08_2_037AC6E0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038505918_2_03850591
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037905358_2_03790535
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0383E4F68_2_0383E4F6
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038344208_2_03834420
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038424468_2_03842446
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03846BD78_2_03846BD7
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384AB408_2_0384AB40
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0378EA808_2_0378EA80
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037A69628_2_037A6962
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0385A9A68_2_0385A9A6
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037929A08_2_037929A0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0379A8408_2_0379A840
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037928408_2_03792840
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037BE8F08_2_037BE8F0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037768B88_2_037768B8
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0380EFA08_2_0380EFA0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037B0F308_2_037B0F30
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037D2F288_2_037D2F28
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0379CFE08_2_0379CFE0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03782FC88_2_03782FC8
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03832F308_2_03832F30
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03804F408_2_03804F40
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384CE938_2_0384CE93
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03790E598_2_03790E59
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384EEDB8_2_0384EEDB
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384EE268_2_0384EE26
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037A2E908_2_037A2E90
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0379AD008_2_0379AD00
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0378ADE08_2_0378ADE0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0382CD1F8_2_0382CD1F
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037A8DBF8_2_037A8DBF
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03830CB58_2_03830CB5
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03790C008_2_03790C00
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03780CF28_2_03780CF2
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0377D34C8_2_0377D34C
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384132D8_2_0384132D
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037D739A8_2_037D739A
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038312ED8_2_038312ED
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037AB2C08_2_037AB2C0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037952A08_2_037952A0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0377F1728_2_0377F172
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037C516C8_2_037C516C
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0379B1B08_2_0379B1B0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0385B16B8_2_0385B16B
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0383F0CC8_2_0383F0CC
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384F0E08_2_0384F0E0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038470E98_2_038470E9
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037970C08_2_037970C0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384F7B08_2_0384F7B0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038416CC8_2_038416CC
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037D56308_2_037D5630
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0382D5B08_2_0382D5B0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038595C38_2_038595C3
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038475718_2_03847571
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037814608_2_03781460
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384F43F8_2_0384F43F
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03805BF08_2_03805BF0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037CDBF98_2_037CDBF9
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384FB768_2_0384FB76
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037AFB808_2_037AFB80
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03831AA38_2_03831AA3
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0382DAAC8_2_0382DAAC
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0383DAC68_2_0383DAC6
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03847A468_2_03847A46
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384FA498_2_0384FA49
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037D5AA08_2_037D5AA0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03803A6C8_2_03803A6C
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037999508_2_03799950
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037AB9508_2_037AB950
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_038259108_2_03825910
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037FD8008_2_037FD800
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037938E08_2_037938E0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384FFB18_2_0384FFB1
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384FF098_2_0384FF09
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03791F928_2_03791F92
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03799EB08_2_03799EB0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03793D408_2_03793D40
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037AFDC08_2_037AFDC0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03841D5A8_2_03841D5A
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03847D738_2_03847D73
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0384FCF28_2_0384FCF2
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03809C328_2_03809C32
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E39E608_2_02E39E60
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E32FB08_2_02E32FB0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E4EDAD8_2_02E4EDAD
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E32D878_2_02E32D87
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E32D908_2_02E32D90
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0362A0368_2_0362A036
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03625B328_2_03625B32
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03625B308_2_03625B30
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0362B2328_2_0362B232
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_036289128_2_03628912
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_036210828_2_03621082
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03622D028_2_03622D02
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0362E5CD8_2_0362E5CD
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: String function: 0127EA12 appears 86 times
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: String function: 0128F290 appears 105 times
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: String function: 011FB970 appears 280 times
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: String function: 01257E54 appears 111 times
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: String function: 01245130 appears 58 times
          Source: C:\Windows\SysWOW64\cmd.exeCode function: String function: 0377B970 appears 280 times
          Source: C:\Windows\SysWOW64\cmd.exeCode function: String function: 037FEA12 appears 86 times
          Source: C:\Windows\SysWOW64\cmd.exeCode function: String function: 037C5130 appears 58 times
          Source: C:\Windows\SysWOW64\cmd.exeCode function: String function: 0380F290 appears 105 times
          Source: C:\Windows\SysWOW64\cmd.exeCode function: String function: 037D7E54 appears 111 times
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000000.00000002.2128443100.0000000003BFE000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000000.00000002.2128019151.0000000002A21000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMML.dll2 vs Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000000.00000002.2132665542.0000000005620000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMML.dll2 vs Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000000.00000002.2132961552.0000000006D60000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTyrone.dll8 vs Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000000.00000002.2128019151.0000000002A6D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMML.dll2 vs Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000006.00000002.2191061034.00000000012FD000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000006.00000002.2192065955.0000000002F2E000.00000040.10000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCmd.Exej% vs Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeBinary or memory string: OriginalFilenamebBvN.exe: vs Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000002.4556728675.000000001047C000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
          Source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID: 6520, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID: 3116, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: cmd.exe PID: 7364, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, oOSLaJiXYcsR9gu6Ws.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, BZGao2DXdnGg50S4nE.csSecurity API names: _0020.SetAccessControl
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, BZGao2DXdnGg50S4nE.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, BZGao2DXdnGg50S4nE.csSecurity API names: _0020.AddAccessRule
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, BZGao2DXdnGg50S4nE.csSecurity API names: _0020.SetAccessControl
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, BZGao2DXdnGg50S4nE.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, BZGao2DXdnGg50S4nE.csSecurity API names: _0020.AddAccessRule
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, oOSLaJiXYcsR9gu6Ws.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, oOSLaJiXYcsR9gu6Ws.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, BZGao2DXdnGg50S4nE.csSecurity API names: _0020.SetAccessControl
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, BZGao2DXdnGg50S4nE.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, BZGao2DXdnGg50S4nE.csSecurity API names: _0020.AddAccessRule
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d40000.10.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.2a8a338.6.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.2aa9504.2.raw.unpack, ReactionVessel.csSuspicious method names: .ReactionVessel.Inject
          Source: classification engineClassification label: mal100.troj.evad.winEXE@13/6@12/3
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007BA759 memset,GetDiskFreeSpaceExW,??_V@YAXPAX@Z,8_2_007BA759
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ticari Siparis Belgesi 26 07 2024 17545000600.exe.logJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7428:120:WilError_03
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2q4x0gu.y4z.ps1Jump to behavior
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeReversingLabs: Detection: 76%
          Source: unknownProcess created: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess created: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess created: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess created: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess created: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"Jump to behavior
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: dwrite.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: textshaping.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: windowscodecs.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: edputil.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: windows.staterepositoryps.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: wintypes.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: appresolver.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: bcp47langs.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: slc.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: sppc.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: onecorecommonproxystub.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: mfsrcsnk.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: windows.internal.shell.broker.dllJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: bBvN.pdbSHA256 source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Binary string: cmd.pdbUGP source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000006.00000002.2192065955.0000000002EE0000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp
          Source: Binary string: wntdll.pdbUGP source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000008.00000003.2192228602.000000000359D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000003.2190559274.00000000033E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, cmd.exe, 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, cmd.exe, 00000008.00000003.2192228602.000000000359D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000003.2190559274.00000000033E4000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmp
          Source: Binary string: bBvN.pdb source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe
          Source: Binary string: cmd.pdb source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, 00000006.00000002.2192065955.0000000002EE0000.00000040.10000000.00040000.00000000.sdmp, cmd.exe, cmd.exe, 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp

          Data Obfuscation

          barindex
          .NET source code contains potential unpacker
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exe, frmMain.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.2a47c60.5.raw.unpack, -.cs.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.2a47c60.5.raw.unpack, PingPong.cs.Net Code: Justy
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.2a76748.4.raw.unpack, -.cs.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.2a76748.4.raw.unpack, PingPong.cs.Net Code: Justy
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, BZGao2DXdnGg50S4nE.cs.Net Code: oYhA4NPrMT System.Reflection.Assembly.Load(byte[])
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.5620000.9.raw.unpack, -.cs.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.5620000.9.raw.unpack, PingPong.cs.Net Code: Justy
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, BZGao2DXdnGg50S4nE.cs.Net Code: oYhA4NPrMT System.Reflection.Assembly.Load(byte[])
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, BZGao2DXdnGg50S4nE.cs.Net Code: oYhA4NPrMT System.Reflection.Assembly.Load(byte[])
          Source: 7.2.explorer.exe.10acf840.0.raw.unpack, frmMain.cs.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 0_2_04FDD238 push eax; iretd 0_2_04FDD241
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0040E33E pushfd ; retf 6_2_0040E3A2
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0040E39D pushfd ; retf 6_2_0040E3A2
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0040E440 push FFFFFF8Bh; ret 6_2_0040E45E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041D4B5 push eax; ret 6_2_0041D508
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041D56C push eax; ret 6_2_0041D572
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041D502 push eax; ret 6_2_0041D508
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0041D50B push eax; ret 6_2_0041D572
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011D225F pushad ; ret 6_2_011D27F9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011D27FA pushad ; ret 6_2_011D27F9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012009AD push ecx; mov dword ptr [esp], ecx6_2_012009B6
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011D283D push eax; iretd 6_2_011D2858
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011D1368 push eax; iretd 6_2_011D1369
          Source: C:\Windows\explorer.exeCode function: 7_2_0972A9B5 push esp; retn 0000h7_2_0972AAE7
          Source: C:\Windows\explorer.exeCode function: 7_2_0972AB1E push esp; retn 0000h7_2_0972AB1F
          Source: C:\Windows\explorer.exeCode function: 7_2_0972AB02 push esp; retn 0000h7_2_0972AB03
          Source: C:\Windows\explorer.exeCode function: 7_2_10467B02 push esp; retn 0000h7_2_10467B03
          Source: C:\Windows\explorer.exeCode function: 7_2_10467B1E push esp; retn 0000h7_2_10467B1F
          Source: C:\Windows\explorer.exeCode function: 7_2_104679B5 push esp; retn 0000h7_2_10467AE7
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A71ED push ecx; ret 8_2_007A7200
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A722B push ecx; ret 8_2_007A723E
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0375225F pushad ; ret 8_2_037527F9
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037527FA pushad ; ret 8_2_037527F9
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_037809AD push ecx; mov dword ptr [esp], ecx8_2_037809B6
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0375283D push eax; iretd 8_2_03752858
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_03751350 push eax; iretd 8_2_03751369
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E3E39D pushfd ; retf 8_2_02E3E3A2
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E3E33E pushfd ; retf 8_2_02E3E3A2
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E4D4B5 push eax; ret 8_2_02E4D508
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E3E440 push FFFFFF8Bh; ret 8_2_02E3E45E
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_02E4D56C push eax; ret 8_2_02E4D572
          Source: Ticari Siparis Belgesi 26 07 2024 17545000600.exeStatic PE information: section name: .text entropy: 7.978982023106639
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, gOiaWKgfVnkFQdi03Z.csHigh entropy of concatenated method names: 'LLI17NsGrJ', 'EOx1QRVbtS', 'oRf1eNX48e', 'mqMevKrg0f', 'CYQezqlUB8', 'Vi216vtUwK', 'aZo1a92sH9', 'IV01lKCpra', 'AUX1Rxlm3C', 'Fad1A9RTMG'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, U2KqfffNymPq7qjA8I.csHigh entropy of concatenated method names: 'OMdiopsHbe', 'mf4iI7j8nE', 'wKTiS2cGSA', 'sAiigF2h8O', 'N0yiF316ci', 'mHbibi8EYt', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, ah0kbSHK40J96Vo2hb.csHigh entropy of concatenated method names: 'Ay4NE3ZGwk', 'n6WNvJoorJ', 'eMAi6I0fo2', 'bchiacAcFk', 'xRENBUgTDG', 'gQaNxPfn0J', 'OYhNy5hqV4', 'zL1NFhyNcv', 'akBNOKgmsr', 'fWaNktn9Xy'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, oOSLaJiXYcsR9gu6Ws.csHigh entropy of concatenated method names: 'OtD9FeDAnQ', 'NBu9OGVfEv', 'KMX9kiyjyq', 'qjU9H28NDL', 'w509tpQnfV', 'uMK9mPQm2K', 'J1I95ulZug', 'LRI9Ee6efP', 'Tx99UGpwtC', 'aVV9vZ5tpK'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, tSvgqiL3ya0FMASywp.csHigh entropy of concatenated method names: 'rjHi7lxJy2', 'b44i9WBBPX', 'pmRiQsP3aq', 'GCriK8uOx5', 'ENAieQWit3', 'EcKi1lkMJX', 'LIbiJm5SXJ', 'nPkidSkefY', 'eHdiftSvuv', 'JREiYXJiKR'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, tFmfrmcTFeFYBPVGf8.csHigh entropy of concatenated method names: 'Hek1CWLAjI', 'K6s1sijkvN', 'FQ514IBnWV', 'gL612LLi83', 'tFP1nS8vul', 'rlY1WEcejE', 'dHR1TAuftf', 'br71cL1uMQ', 'JZn1pqp6af', 'r8K1GmJJIc'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, o8ZEMM6Y3kX8Ei4xMt.csHigh entropy of concatenated method names: 'ogQQ2X7iRo', 'HpiQWrWyIs', 'i3YQcwRamu', 'tFgQprlOqD', 'pxgQ0XSBtQ', 'yQOQrJgoSp', 'DQ1QNvs5xJ', 'sGmQiOvgZe', 'fDfQqF7DiW', 'FH1QV8GB2H'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, YWPamvUhpR0aeKMiX8.csHigh entropy of concatenated method names: 'Dispose', 'lD1aUgyaAN', 'xhDlIEkUMZ', 'SMPZZ8FNiw', 'kwGavxGUsa', 'dHvaz8jDPv', 'ProcessDialogKey', 'tJKl6SILh7', 'ab7laYPqBH', 'CavllUELSm'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, fwLolazv9fyHtQ4vva.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'A30qMSS7yU', 'gsFq0Sf3ll', 'lHiqrNxOZD', 'AR0qNd98OU', 'tJTqihAGhK', 'PT2qqXqjru', 'BaZqVDA40q'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, BZGao2DXdnGg50S4nE.csHigh entropy of concatenated method names: 'fBARLbGSwB', 'VwDR7dNNAx', 'h99R9CnQSj', 'mTARQFeeXT', 'ep6RKJXT5o', 'k8qRehSe0f', 'UFlR1rhjO3', 'h1xRJOUuJW', 'S29Rdcda1T', 'iKqRfuTYpb'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, t4vIAioxiY9L8sTcju.csHigh entropy of concatenated method names: 'B0nqacFiWa', 'mkkqRvjDMu', 'XkWqAM24Qm', 'sS7q7fSwaB', 'n51q9HZGMh', 'kubqKCxNUY', 'UPFqeEISsD', 'YdIi5xFSSw', 'rtviESMZvs', 'gjoiUbI4mn'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, NJgpEdEdtoODidsa3q.csHigh entropy of concatenated method names: 'ndB4tldmo', 'Ova2yhhTu', 'uspWuOPZj', 'ERtT0fBKt', 'sHTpH7sS2', 'Q8GG0RrBV', 'TsIZhT3kaXVTGpvFAk', 'vPngjr1ZnN77OvqJ5p', 'r4yiXQqGS', 'ibMV45qCw'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, QD8cW6QYGWAEa23pEf.csHigh entropy of concatenated method names: 'GjJeLmDFWJ', 'HCme95Mew2', 'FcTeKbWZ4o', 'Vyce1109Hn', 'NxMeJU9Bqn', 'zsEKtZeVKA', 'jMCKmmqSdK', 'p55K5yeiCD', 'AYQKEcavkn', 'SfWKUDUIWS'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, EVrMGL9wn5b3ZhtoWA.csHigh entropy of concatenated method names: 't6b0uDvSMK', 'faJ0xO1vWo', 'SaW0FM4xxn', 'LxA0OEmu8N', 'Sqg0IsSLD5', 'O290Se1Krr', 'jiw0gBeVbX', 'fUs0bRUdXm', 'yT40PkOrpq', 'FtR0hQ1l82'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, eSIbCv4g67m5RqgTQm.csHigh entropy of concatenated method names: 'B52a1dqsZs', 'UahaJBSbFv', 'qkGafoPrxc', 'mTLaYwH4vO', 'M9ta01vueb', 'Q4Yar64avu', 'sO1CSmv3jjqo3yAkrx', 'oiv177SQ2bJIGd5POj', 'yCTaa6XLCH', 'jvfaRMPHYx'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, DKlthmPWWLNRkw3Ofkh.csHigh entropy of concatenated method names: 'mvvqChYYy9', 'BDYqsBUTbU', 'vxmq4IXFKk', 'WvJq2oGHex', 'usTqn1jriY', 'sEpqWuceMp', 'BjIqTxW7Pp', 'xsvqcGjpLT', 'RkPqpJe5Q0', 'N47qGafu4o'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, C3IHPZhoafdfCmVdPx.csHigh entropy of concatenated method names: 'P9IKn1Gb4N', 'lq6KT07Ohe', 'nCkQSAHSds', 'J9KQgs5ijI', 'CTZQbj7jp7', 'CEZQPNlmIu', 'eDkQh6TlVT', 'T9xQjCc8kI', 'qtTQDWrKgA', 'HcgQu55M0K'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, MEggSNrSchJlDZ44U1.csHigh entropy of concatenated method names: 'kIjMcyx42Q', 'SCyMpZKpVf', 'rOUMoGT4QS', 'aD0MIyyX1u', 'k2CMghclIr', 'EZaMbGGsf7', 'O3GMhEGtVx', 'EUbMj299UV', 'GBlMuIQPfQ', 'JvmMBg0HCO'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3d5fed0.7.raw.unpack, U4gvU7PbL6NdfpqcPUs.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'COnVFHWEWW', 'ebMVOl6RIt', 'thuVkDow78', 'okYVHSxNdk', 'IFoVtxuvyo', 'GbyVmfLYC7', 'J9TV51wt19'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, gOiaWKgfVnkFQdi03Z.csHigh entropy of concatenated method names: 'LLI17NsGrJ', 'EOx1QRVbtS', 'oRf1eNX48e', 'mqMevKrg0f', 'CYQezqlUB8', 'Vi216vtUwK', 'aZo1a92sH9', 'IV01lKCpra', 'AUX1Rxlm3C', 'Fad1A9RTMG'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, U2KqfffNymPq7qjA8I.csHigh entropy of concatenated method names: 'OMdiopsHbe', 'mf4iI7j8nE', 'wKTiS2cGSA', 'sAiigF2h8O', 'N0yiF316ci', 'mHbibi8EYt', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, ah0kbSHK40J96Vo2hb.csHigh entropy of concatenated method names: 'Ay4NE3ZGwk', 'n6WNvJoorJ', 'eMAi6I0fo2', 'bchiacAcFk', 'xRENBUgTDG', 'gQaNxPfn0J', 'OYhNy5hqV4', 'zL1NFhyNcv', 'akBNOKgmsr', 'fWaNktn9Xy'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, oOSLaJiXYcsR9gu6Ws.csHigh entropy of concatenated method names: 'OtD9FeDAnQ', 'NBu9OGVfEv', 'KMX9kiyjyq', 'qjU9H28NDL', 'w509tpQnfV', 'uMK9mPQm2K', 'J1I95ulZug', 'LRI9Ee6efP', 'Tx99UGpwtC', 'aVV9vZ5tpK'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, tSvgqiL3ya0FMASywp.csHigh entropy of concatenated method names: 'rjHi7lxJy2', 'b44i9WBBPX', 'pmRiQsP3aq', 'GCriK8uOx5', 'ENAieQWit3', 'EcKi1lkMJX', 'LIbiJm5SXJ', 'nPkidSkefY', 'eHdiftSvuv', 'JREiYXJiKR'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, tFmfrmcTFeFYBPVGf8.csHigh entropy of concatenated method names: 'Hek1CWLAjI', 'K6s1sijkvN', 'FQ514IBnWV', 'gL612LLi83', 'tFP1nS8vul', 'rlY1WEcejE', 'dHR1TAuftf', 'br71cL1uMQ', 'JZn1pqp6af', 'r8K1GmJJIc'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, o8ZEMM6Y3kX8Ei4xMt.csHigh entropy of concatenated method names: 'ogQQ2X7iRo', 'HpiQWrWyIs', 'i3YQcwRamu', 'tFgQprlOqD', 'pxgQ0XSBtQ', 'yQOQrJgoSp', 'DQ1QNvs5xJ', 'sGmQiOvgZe', 'fDfQqF7DiW', 'FH1QV8GB2H'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, YWPamvUhpR0aeKMiX8.csHigh entropy of concatenated method names: 'Dispose', 'lD1aUgyaAN', 'xhDlIEkUMZ', 'SMPZZ8FNiw', 'kwGavxGUsa', 'dHvaz8jDPv', 'ProcessDialogKey', 'tJKl6SILh7', 'ab7laYPqBH', 'CavllUELSm'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, fwLolazv9fyHtQ4vva.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'A30qMSS7yU', 'gsFq0Sf3ll', 'lHiqrNxOZD', 'AR0qNd98OU', 'tJTqihAGhK', 'PT2qqXqjru', 'BaZqVDA40q'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, BZGao2DXdnGg50S4nE.csHigh entropy of concatenated method names: 'fBARLbGSwB', 'VwDR7dNNAx', 'h99R9CnQSj', 'mTARQFeeXT', 'ep6RKJXT5o', 'k8qRehSe0f', 'UFlR1rhjO3', 'h1xRJOUuJW', 'S29Rdcda1T', 'iKqRfuTYpb'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, t4vIAioxiY9L8sTcju.csHigh entropy of concatenated method names: 'B0nqacFiWa', 'mkkqRvjDMu', 'XkWqAM24Qm', 'sS7q7fSwaB', 'n51q9HZGMh', 'kubqKCxNUY', 'UPFqeEISsD', 'YdIi5xFSSw', 'rtviESMZvs', 'gjoiUbI4mn'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, NJgpEdEdtoODidsa3q.csHigh entropy of concatenated method names: 'ndB4tldmo', 'Ova2yhhTu', 'uspWuOPZj', 'ERtT0fBKt', 'sHTpH7sS2', 'Q8GG0RrBV', 'TsIZhT3kaXVTGpvFAk', 'vPngjr1ZnN77OvqJ5p', 'r4yiXQqGS', 'ibMV45qCw'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, QD8cW6QYGWAEa23pEf.csHigh entropy of concatenated method names: 'GjJeLmDFWJ', 'HCme95Mew2', 'FcTeKbWZ4o', 'Vyce1109Hn', 'NxMeJU9Bqn', 'zsEKtZeVKA', 'jMCKmmqSdK', 'p55K5yeiCD', 'AYQKEcavkn', 'SfWKUDUIWS'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, EVrMGL9wn5b3ZhtoWA.csHigh entropy of concatenated method names: 't6b0uDvSMK', 'faJ0xO1vWo', 'SaW0FM4xxn', 'LxA0OEmu8N', 'Sqg0IsSLD5', 'O290Se1Krr', 'jiw0gBeVbX', 'fUs0bRUdXm', 'yT40PkOrpq', 'FtR0hQ1l82'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, eSIbCv4g67m5RqgTQm.csHigh entropy of concatenated method names: 'B52a1dqsZs', 'UahaJBSbFv', 'qkGafoPrxc', 'mTLaYwH4vO', 'M9ta01vueb', 'Q4Yar64avu', 'sO1CSmv3jjqo3yAkrx', 'oiv177SQ2bJIGd5POj', 'yCTaa6XLCH', 'jvfaRMPHYx'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, DKlthmPWWLNRkw3Ofkh.csHigh entropy of concatenated method names: 'mvvqChYYy9', 'BDYqsBUTbU', 'vxmq4IXFKk', 'WvJq2oGHex', 'usTqn1jriY', 'sEpqWuceMp', 'BjIqTxW7Pp', 'xsvqcGjpLT', 'RkPqpJe5Q0', 'N47qGafu4o'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, C3IHPZhoafdfCmVdPx.csHigh entropy of concatenated method names: 'P9IKn1Gb4N', 'lq6KT07Ohe', 'nCkQSAHSds', 'J9KQgs5ijI', 'CTZQbj7jp7', 'CEZQPNlmIu', 'eDkQh6TlVT', 'T9xQjCc8kI', 'qtTQDWrKgA', 'HcgQu55M0K'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, MEggSNrSchJlDZ44U1.csHigh entropy of concatenated method names: 'kIjMcyx42Q', 'SCyMpZKpVf', 'rOUMoGT4QS', 'aD0MIyyX1u', 'k2CMghclIr', 'EZaMbGGsf7', 'O3GMhEGtVx', 'EUbMj299UV', 'GBlMuIQPfQ', 'JvmMBg0HCO'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.6d60000.11.raw.unpack, U4gvU7PbL6NdfpqcPUs.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'COnVFHWEWW', 'ebMVOl6RIt', 'thuVkDow78', 'okYVHSxNdk', 'IFoVtxuvyo', 'GbyVmfLYC7', 'J9TV51wt19'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, gOiaWKgfVnkFQdi03Z.csHigh entropy of concatenated method names: 'LLI17NsGrJ', 'EOx1QRVbtS', 'oRf1eNX48e', 'mqMevKrg0f', 'CYQezqlUB8', 'Vi216vtUwK', 'aZo1a92sH9', 'IV01lKCpra', 'AUX1Rxlm3C', 'Fad1A9RTMG'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, U2KqfffNymPq7qjA8I.csHigh entropy of concatenated method names: 'OMdiopsHbe', 'mf4iI7j8nE', 'wKTiS2cGSA', 'sAiigF2h8O', 'N0yiF316ci', 'mHbibi8EYt', 'Next', 'Next', 'Next', 'NextBytes'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, ah0kbSHK40J96Vo2hb.csHigh entropy of concatenated method names: 'Ay4NE3ZGwk', 'n6WNvJoorJ', 'eMAi6I0fo2', 'bchiacAcFk', 'xRENBUgTDG', 'gQaNxPfn0J', 'OYhNy5hqV4', 'zL1NFhyNcv', 'akBNOKgmsr', 'fWaNktn9Xy'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, oOSLaJiXYcsR9gu6Ws.csHigh entropy of concatenated method names: 'OtD9FeDAnQ', 'NBu9OGVfEv', 'KMX9kiyjyq', 'qjU9H28NDL', 'w509tpQnfV', 'uMK9mPQm2K', 'J1I95ulZug', 'LRI9Ee6efP', 'Tx99UGpwtC', 'aVV9vZ5tpK'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, tSvgqiL3ya0FMASywp.csHigh entropy of concatenated method names: 'rjHi7lxJy2', 'b44i9WBBPX', 'pmRiQsP3aq', 'GCriK8uOx5', 'ENAieQWit3', 'EcKi1lkMJX', 'LIbiJm5SXJ', 'nPkidSkefY', 'eHdiftSvuv', 'JREiYXJiKR'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, tFmfrmcTFeFYBPVGf8.csHigh entropy of concatenated method names: 'Hek1CWLAjI', 'K6s1sijkvN', 'FQ514IBnWV', 'gL612LLi83', 'tFP1nS8vul', 'rlY1WEcejE', 'dHR1TAuftf', 'br71cL1uMQ', 'JZn1pqp6af', 'r8K1GmJJIc'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, o8ZEMM6Y3kX8Ei4xMt.csHigh entropy of concatenated method names: 'ogQQ2X7iRo', 'HpiQWrWyIs', 'i3YQcwRamu', 'tFgQprlOqD', 'pxgQ0XSBtQ', 'yQOQrJgoSp', 'DQ1QNvs5xJ', 'sGmQiOvgZe', 'fDfQqF7DiW', 'FH1QV8GB2H'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, YWPamvUhpR0aeKMiX8.csHigh entropy of concatenated method names: 'Dispose', 'lD1aUgyaAN', 'xhDlIEkUMZ', 'SMPZZ8FNiw', 'kwGavxGUsa', 'dHvaz8jDPv', 'ProcessDialogKey', 'tJKl6SILh7', 'ab7laYPqBH', 'CavllUELSm'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, fwLolazv9fyHtQ4vva.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'A30qMSS7yU', 'gsFq0Sf3ll', 'lHiqrNxOZD', 'AR0qNd98OU', 'tJTqihAGhK', 'PT2qqXqjru', 'BaZqVDA40q'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, BZGao2DXdnGg50S4nE.csHigh entropy of concatenated method names: 'fBARLbGSwB', 'VwDR7dNNAx', 'h99R9CnQSj', 'mTARQFeeXT', 'ep6RKJXT5o', 'k8qRehSe0f', 'UFlR1rhjO3', 'h1xRJOUuJW', 'S29Rdcda1T', 'iKqRfuTYpb'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, t4vIAioxiY9L8sTcju.csHigh entropy of concatenated method names: 'B0nqacFiWa', 'mkkqRvjDMu', 'XkWqAM24Qm', 'sS7q7fSwaB', 'n51q9HZGMh', 'kubqKCxNUY', 'UPFqeEISsD', 'YdIi5xFSSw', 'rtviESMZvs', 'gjoiUbI4mn'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, NJgpEdEdtoODidsa3q.csHigh entropy of concatenated method names: 'ndB4tldmo', 'Ova2yhhTu', 'uspWuOPZj', 'ERtT0fBKt', 'sHTpH7sS2', 'Q8GG0RrBV', 'TsIZhT3kaXVTGpvFAk', 'vPngjr1ZnN77OvqJ5p', 'r4yiXQqGS', 'ibMV45qCw'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, QD8cW6QYGWAEa23pEf.csHigh entropy of concatenated method names: 'GjJeLmDFWJ', 'HCme95Mew2', 'FcTeKbWZ4o', 'Vyce1109Hn', 'NxMeJU9Bqn', 'zsEKtZeVKA', 'jMCKmmqSdK', 'p55K5yeiCD', 'AYQKEcavkn', 'SfWKUDUIWS'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, EVrMGL9wn5b3ZhtoWA.csHigh entropy of concatenated method names: 't6b0uDvSMK', 'faJ0xO1vWo', 'SaW0FM4xxn', 'LxA0OEmu8N', 'Sqg0IsSLD5', 'O290Se1Krr', 'jiw0gBeVbX', 'fUs0bRUdXm', 'yT40PkOrpq', 'FtR0hQ1l82'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, eSIbCv4g67m5RqgTQm.csHigh entropy of concatenated method names: 'B52a1dqsZs', 'UahaJBSbFv', 'qkGafoPrxc', 'mTLaYwH4vO', 'M9ta01vueb', 'Q4Yar64avu', 'sO1CSmv3jjqo3yAkrx', 'oiv177SQ2bJIGd5POj', 'yCTaa6XLCH', 'jvfaRMPHYx'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, DKlthmPWWLNRkw3Ofkh.csHigh entropy of concatenated method names: 'mvvqChYYy9', 'BDYqsBUTbU', 'vxmq4IXFKk', 'WvJq2oGHex', 'usTqn1jriY', 'sEpqWuceMp', 'BjIqTxW7Pp', 'xsvqcGjpLT', 'RkPqpJe5Q0', 'N47qGafu4o'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, C3IHPZhoafdfCmVdPx.csHigh entropy of concatenated method names: 'P9IKn1Gb4N', 'lq6KT07Ohe', 'nCkQSAHSds', 'J9KQgs5ijI', 'CTZQbj7jp7', 'CEZQPNlmIu', 'eDkQh6TlVT', 'T9xQjCc8kI', 'qtTQDWrKgA', 'HcgQu55M0K'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, MEggSNrSchJlDZ44U1.csHigh entropy of concatenated method names: 'kIjMcyx42Q', 'SCyMpZKpVf', 'rOUMoGT4QS', 'aD0MIyyX1u', 'k2CMghclIr', 'EZaMbGGsf7', 'O3GMhEGtVx', 'EUbMj299UV', 'GBlMuIQPfQ', 'JvmMBg0HCO'
          Source: 0.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.3dcfaf0.8.raw.unpack, U4gvU7PbL6NdfpqcPUs.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'COnVFHWEWW', 'ebMVOl6RIt', 'thuVkDow78', 'okYVHSxNdk', 'IFoVtxuvyo', 'GbyVmfLYC7', 'J9TV51wt19'
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeFile created: \ticari siparis belgesi 26 07 2024 17545000600.exe
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeFile created: \ticari siparis belgesi 26 07 2024 17545000600.exe
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeFile created: \ticari siparis belgesi 26 07 2024 17545000600.exe
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeFile created: \ticari siparis belgesi 26 07 2024 17545000600.exeJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeFile created: \ticari siparis belgesi 26 07 2024 17545000600.exeJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeFile created: \ticari siparis belgesi 26 07 2024 17545000600.exeJump to behavior

          Hooking and other Techniques for Hiding and Protection

          barindex
          Loading BitLocker PowerShell Module
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Yara detected AntiVM3
          Source: Yara matchFile source: Process Memory Space: Ticari Siparis Belgesi 26 07 2024 17545000600.exe PID: 6520, type: MEMORYSTR
          Switches to a custom stack to bypass stack traces
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeAPI/Special instruction interceptor: Address: 7FF8C88ED324
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeAPI/Special instruction interceptor: Address: 7FF8C88F0774
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeAPI/Special instruction interceptor: Address: 7FF8C88F0154
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeAPI/Special instruction interceptor: Address: 7FF8C88ED8A4
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeAPI/Special instruction interceptor: Address: 7FF8C88EDA44
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeAPI/Special instruction interceptor: Address: 7FF8C88ED1E4
          Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 7FF8C88ED324
          Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 7FF8C88F0774
          Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 7FF8C88ED944
          Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 7FF8C88ED504
          Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 7FF8C88ED544
          Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 7FF8C88ED1E4
          Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 7FF8C88F0154
          Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 7FF8C88ED8A4
          Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 7FF8C88EDA44
          Tries to detect virtualization through RDTSC time measurements
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeRDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeRDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cmd.exeRDTSC instruction interceptor: First address: 2E39904 second address: 2E3990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cmd.exeRDTSC instruction interceptor: First address: 2E39B7E second address: 2E39B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeMemory allocated: 10A0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeMemory allocated: 2A20000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeMemory allocated: 4A20000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeMemory allocated: 89B0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeMemory allocated: 99B0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeMemory allocated: 9BB0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeMemory allocated: ABB0000 memory reserve | memory write watchJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_00409AB0 rdtsc 6_2_00409AB0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8192Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1522Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 1594Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 8343Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 888Jump to behavior
          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 863Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeWindow / User API: threadDelayed 9843Jump to behavior
          Source: C:\Windows\explorer.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_7-13936
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeAPI coverage: 1.6 %
          Source: C:\Windows\SysWOW64\cmd.exeAPI coverage: 1.0 %
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe TID: 5340Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7300Thread sleep time: -3689348814741908s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 7644Thread sleep count: 1594 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 7644Thread sleep time: -3188000s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 7644Thread sleep count: 8343 > 30Jump to behavior
          Source: C:\Windows\explorer.exe TID: 7644Thread sleep time: -16686000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exe TID: 7580Thread sleep count: 128 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exe TID: 7580Thread sleep time: -256000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exe TID: 7580Thread sleep count: 9843 > 30Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exe TID: 7580Thread sleep time: -19686000s >= -30000sJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\cmd.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A589A FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,8_2_007A589A
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007B3E66 FindFirstFileW,FindNextFileW,FindClose,8_2_007B3E66
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A0207 FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,8_2_007A0207
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A4EC1 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,8_2_007A4EC1
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0079532E GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,??_V@YAXPAX@Z,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,8_2_0079532E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: explorer.exe, 00000007.00000002.4542934252.00000000076F8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
          Source: explorer.exe, 00000007.00000000.2144614594.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
          Source: explorer.exe, 00000007.00000002.4545593539.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0r
          Source: explorer.exe, 00000007.00000002.4546550713.0000000009C22000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
          Source: explorer.exe, 00000007.00000000.2144614594.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTcaVMWare
          Source: explorer.exe, 00000007.00000000.2144614594.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
          Source: explorer.exe, 00000007.00000002.4546607897.0000000009C96000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000007.00000002.4540828283.0000000003554000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
          Source: explorer.exe, 00000007.00000002.4546607897.0000000009C96000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
          Source: explorer.exe, 00000007.00000000.2131821278.0000000000F13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
          Source: explorer.exe, 00000007.00000002.4540828283.0000000003554000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 d9 2e dc 89 72 dX
          Source: explorer.exe, 00000007.00000002.4542934252.00000000076F8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
          Source: explorer.exe, 00000007.00000002.4545593539.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009B2C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: explorer.exe, 00000007.00000002.4540828283.0000000003554000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
          Source: explorer.exe, 00000007.00000002.4540828283.0000000003554000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware,p
          Source: explorer.exe, 00000007.00000002.4546550713.0000000009C22000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
          Source: explorer.exe, 00000007.00000000.2131821278.0000000000F13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
          Source: explorer.exe, 00000007.00000000.2144614594.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000007.00000002.4542934252.000000000769A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_00409AB0 rdtsc 6_2_00409AB0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0040ACF0 LdrLoadDll,6_2_0040ACF0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007B2E37 IsDebuggerPresent,8_2_007B2E37
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01230124 mov eax, dword ptr fs:[00000030h]6_2_01230124
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE10E mov eax, dword ptr fs:[00000030h]6_2_012AE10E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE10E mov ecx, dword ptr fs:[00000030h]6_2_012AE10E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE10E mov eax, dword ptr fs:[00000030h]6_2_012AE10E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE10E mov eax, dword ptr fs:[00000030h]6_2_012AE10E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE10E mov ecx, dword ptr fs:[00000030h]6_2_012AE10E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE10E mov eax, dword ptr fs:[00000030h]6_2_012AE10E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE10E mov eax, dword ptr fs:[00000030h]6_2_012AE10E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE10E mov ecx, dword ptr fs:[00000030h]6_2_012AE10E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE10E mov eax, dword ptr fs:[00000030h]6_2_012AE10E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE10E mov ecx, dword ptr fs:[00000030h]6_2_012AE10E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AA118 mov ecx, dword ptr fs:[00000030h]6_2_012AA118
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AA118 mov eax, dword ptr fs:[00000030h]6_2_012AA118
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AA118 mov eax, dword ptr fs:[00000030h]6_2_012AA118
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AA118 mov eax, dword ptr fs:[00000030h]6_2_012AA118
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C0115 mov eax, dword ptr fs:[00000030h]6_2_012C0115
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FC156 mov eax, dword ptr fs:[00000030h]6_2_011FC156
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D4164 mov eax, dword ptr fs:[00000030h]6_2_012D4164
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D4164 mov eax, dword ptr fs:[00000030h]6_2_012D4164
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01294144 mov eax, dword ptr fs:[00000030h]6_2_01294144
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01294144 mov eax, dword ptr fs:[00000030h]6_2_01294144
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01294144 mov ecx, dword ptr fs:[00000030h]6_2_01294144
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01294144 mov eax, dword ptr fs:[00000030h]6_2_01294144
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01294144 mov eax, dword ptr fs:[00000030h]6_2_01294144
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01298158 mov eax, dword ptr fs:[00000030h]6_2_01298158
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01206154 mov eax, dword ptr fs:[00000030h]6_2_01206154
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01206154 mov eax, dword ptr fs:[00000030h]6_2_01206154
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FA197 mov eax, dword ptr fs:[00000030h]6_2_011FA197
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FA197 mov eax, dword ptr fs:[00000030h]6_2_011FA197
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FA197 mov eax, dword ptr fs:[00000030h]6_2_011FA197
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01240185 mov eax, dword ptr fs:[00000030h]6_2_01240185
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012BC188 mov eax, dword ptr fs:[00000030h]6_2_012BC188
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012BC188 mov eax, dword ptr fs:[00000030h]6_2_012BC188
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A4180 mov eax, dword ptr fs:[00000030h]6_2_012A4180
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A4180 mov eax, dword ptr fs:[00000030h]6_2_012A4180
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128019F mov eax, dword ptr fs:[00000030h]6_2_0128019F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128019F mov eax, dword ptr fs:[00000030h]6_2_0128019F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128019F mov eax, dword ptr fs:[00000030h]6_2_0128019F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128019F mov eax, dword ptr fs:[00000030h]6_2_0128019F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D61E5 mov eax, dword ptr fs:[00000030h]6_2_012D61E5
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012301F8 mov eax, dword ptr fs:[00000030h]6_2_012301F8
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C61C3 mov eax, dword ptr fs:[00000030h]6_2_012C61C3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C61C3 mov eax, dword ptr fs:[00000030h]6_2_012C61C3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E1D0 mov eax, dword ptr fs:[00000030h]6_2_0127E1D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E1D0 mov eax, dword ptr fs:[00000030h]6_2_0127E1D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E1D0 mov ecx, dword ptr fs:[00000030h]6_2_0127E1D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E1D0 mov eax, dword ptr fs:[00000030h]6_2_0127E1D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E1D0 mov eax, dword ptr fs:[00000030h]6_2_0127E1D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01296030 mov eax, dword ptr fs:[00000030h]6_2_01296030
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01284000 mov ecx, dword ptr fs:[00000030h]6_2_01284000
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A2000 mov eax, dword ptr fs:[00000030h]6_2_012A2000
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A2000 mov eax, dword ptr fs:[00000030h]6_2_012A2000
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A2000 mov eax, dword ptr fs:[00000030h]6_2_012A2000
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A2000 mov eax, dword ptr fs:[00000030h]6_2_012A2000
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A2000 mov eax, dword ptr fs:[00000030h]6_2_012A2000
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A2000 mov eax, dword ptr fs:[00000030h]6_2_012A2000
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A2000 mov eax, dword ptr fs:[00000030h]6_2_012A2000
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A2000 mov eax, dword ptr fs:[00000030h]6_2_012A2000
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121E016 mov eax, dword ptr fs:[00000030h]6_2_0121E016
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121E016 mov eax, dword ptr fs:[00000030h]6_2_0121E016
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121E016 mov eax, dword ptr fs:[00000030h]6_2_0121E016
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121E016 mov eax, dword ptr fs:[00000030h]6_2_0121E016
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FA020 mov eax, dword ptr fs:[00000030h]6_2_011FA020
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FC020 mov eax, dword ptr fs:[00000030h]6_2_011FC020
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122C073 mov eax, dword ptr fs:[00000030h]6_2_0122C073
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01202050 mov eax, dword ptr fs:[00000030h]6_2_01202050
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01286050 mov eax, dword ptr fs:[00000030h]6_2_01286050
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012980A8 mov eax, dword ptr fs:[00000030h]6_2_012980A8
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C60B8 mov eax, dword ptr fs:[00000030h]6_2_012C60B8
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C60B8 mov ecx, dword ptr fs:[00000030h]6_2_012C60B8
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120208A mov eax, dword ptr fs:[00000030h]6_2_0120208A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011F80A0 mov eax, dword ptr fs:[00000030h]6_2_011F80A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012860E0 mov eax, dword ptr fs:[00000030h]6_2_012860E0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012080E9 mov eax, dword ptr fs:[00000030h]6_2_012080E9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012420F0 mov ecx, dword ptr fs:[00000030h]6_2_012420F0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FC0F0 mov eax, dword ptr fs:[00000030h]6_2_011FC0F0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012820DE mov eax, dword ptr fs:[00000030h]6_2_012820DE
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FA0E3 mov ecx, dword ptr fs:[00000030h]6_2_011FA0E3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D8324 mov eax, dword ptr fs:[00000030h]6_2_012D8324
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D8324 mov ecx, dword ptr fs:[00000030h]6_2_012D8324
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D8324 mov eax, dword ptr fs:[00000030h]6_2_012D8324
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D8324 mov eax, dword ptr fs:[00000030h]6_2_012D8324
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FC310 mov ecx, dword ptr fs:[00000030h]6_2_011FC310
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123A30B mov eax, dword ptr fs:[00000030h]6_2_0123A30B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123A30B mov eax, dword ptr fs:[00000030h]6_2_0123A30B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123A30B mov eax, dword ptr fs:[00000030h]6_2_0123A30B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01220310 mov ecx, dword ptr fs:[00000030h]6_2_01220310
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A437C mov eax, dword ptr fs:[00000030h]6_2_012A437C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01282349 mov eax, dword ptr fs:[00000030h]6_2_01282349
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D634F mov eax, dword ptr fs:[00000030h]6_2_012D634F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128035C mov eax, dword ptr fs:[00000030h]6_2_0128035C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128035C mov eax, dword ptr fs:[00000030h]6_2_0128035C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128035C mov eax, dword ptr fs:[00000030h]6_2_0128035C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128035C mov ecx, dword ptr fs:[00000030h]6_2_0128035C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128035C mov eax, dword ptr fs:[00000030h]6_2_0128035C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128035C mov eax, dword ptr fs:[00000030h]6_2_0128035C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A8350 mov ecx, dword ptr fs:[00000030h]6_2_012A8350
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CA352 mov eax, dword ptr fs:[00000030h]6_2_012CA352
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011F8397 mov eax, dword ptr fs:[00000030h]6_2_011F8397
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011F8397 mov eax, dword ptr fs:[00000030h]6_2_011F8397
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011F8397 mov eax, dword ptr fs:[00000030h]6_2_011F8397
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FE388 mov eax, dword ptr fs:[00000030h]6_2_011FE388
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FE388 mov eax, dword ptr fs:[00000030h]6_2_011FE388
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FE388 mov eax, dword ptr fs:[00000030h]6_2_011FE388
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122438F mov eax, dword ptr fs:[00000030h]6_2_0122438F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122438F mov eax, dword ptr fs:[00000030h]6_2_0122438F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012103E9 mov eax, dword ptr fs:[00000030h]6_2_012103E9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012103E9 mov eax, dword ptr fs:[00000030h]6_2_012103E9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012103E9 mov eax, dword ptr fs:[00000030h]6_2_012103E9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012103E9 mov eax, dword ptr fs:[00000030h]6_2_012103E9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012103E9 mov eax, dword ptr fs:[00000030h]6_2_012103E9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012103E9 mov eax, dword ptr fs:[00000030h]6_2_012103E9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012103E9 mov eax, dword ptr fs:[00000030h]6_2_012103E9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012103E9 mov eax, dword ptr fs:[00000030h]6_2_012103E9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121E3F0 mov eax, dword ptr fs:[00000030h]6_2_0121E3F0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121E3F0 mov eax, dword ptr fs:[00000030h]6_2_0121E3F0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121E3F0 mov eax, dword ptr fs:[00000030h]6_2_0121E3F0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012363FF mov eax, dword ptr fs:[00000030h]6_2_012363FF
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A3C0 mov eax, dword ptr fs:[00000030h]6_2_0120A3C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A3C0 mov eax, dword ptr fs:[00000030h]6_2_0120A3C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A3C0 mov eax, dword ptr fs:[00000030h]6_2_0120A3C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A3C0 mov eax, dword ptr fs:[00000030h]6_2_0120A3C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A3C0 mov eax, dword ptr fs:[00000030h]6_2_0120A3C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A3C0 mov eax, dword ptr fs:[00000030h]6_2_0120A3C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012083C0 mov eax, dword ptr fs:[00000030h]6_2_012083C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012083C0 mov eax, dword ptr fs:[00000030h]6_2_012083C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012083C0 mov eax, dword ptr fs:[00000030h]6_2_012083C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012083C0 mov eax, dword ptr fs:[00000030h]6_2_012083C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012BC3CD mov eax, dword ptr fs:[00000030h]6_2_012BC3CD
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012863C0 mov eax, dword ptr fs:[00000030h]6_2_012863C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE3DB mov eax, dword ptr fs:[00000030h]6_2_012AE3DB
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE3DB mov eax, dword ptr fs:[00000030h]6_2_012AE3DB
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE3DB mov ecx, dword ptr fs:[00000030h]6_2_012AE3DB
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AE3DB mov eax, dword ptr fs:[00000030h]6_2_012AE3DB
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A43D4 mov eax, dword ptr fs:[00000030h]6_2_012A43D4
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A43D4 mov eax, dword ptr fs:[00000030h]6_2_012A43D4
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011F823B mov eax, dword ptr fs:[00000030h]6_2_011F823B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01204260 mov eax, dword ptr fs:[00000030h]6_2_01204260
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01204260 mov eax, dword ptr fs:[00000030h]6_2_01204260
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01204260 mov eax, dword ptr fs:[00000030h]6_2_01204260
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FA250 mov eax, dword ptr fs:[00000030h]6_2_011FA250
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B0274 mov eax, dword ptr fs:[00000030h]6_2_012B0274
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01288243 mov eax, dword ptr fs:[00000030h]6_2_01288243
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01288243 mov ecx, dword ptr fs:[00000030h]6_2_01288243
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D625D mov eax, dword ptr fs:[00000030h]6_2_012D625D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011F826B mov eax, dword ptr fs:[00000030h]6_2_011F826B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01206259 mov eax, dword ptr fs:[00000030h]6_2_01206259
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012BA250 mov eax, dword ptr fs:[00000030h]6_2_012BA250
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012BA250 mov eax, dword ptr fs:[00000030h]6_2_012BA250
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012102A0 mov eax, dword ptr fs:[00000030h]6_2_012102A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012102A0 mov eax, dword ptr fs:[00000030h]6_2_012102A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012962A0 mov eax, dword ptr fs:[00000030h]6_2_012962A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012962A0 mov ecx, dword ptr fs:[00000030h]6_2_012962A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012962A0 mov eax, dword ptr fs:[00000030h]6_2_012962A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012962A0 mov eax, dword ptr fs:[00000030h]6_2_012962A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012962A0 mov eax, dword ptr fs:[00000030h]6_2_012962A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012962A0 mov eax, dword ptr fs:[00000030h]6_2_012962A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E284 mov eax, dword ptr fs:[00000030h]6_2_0123E284
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E284 mov eax, dword ptr fs:[00000030h]6_2_0123E284
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01280283 mov eax, dword ptr fs:[00000030h]6_2_01280283
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01280283 mov eax, dword ptr fs:[00000030h]6_2_01280283
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01280283 mov eax, dword ptr fs:[00000030h]6_2_01280283
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012102E1 mov eax, dword ptr fs:[00000030h]6_2_012102E1
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012102E1 mov eax, dword ptr fs:[00000030h]6_2_012102E1
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012102E1 mov eax, dword ptr fs:[00000030h]6_2_012102E1
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A2C3 mov eax, dword ptr fs:[00000030h]6_2_0120A2C3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A2C3 mov eax, dword ptr fs:[00000030h]6_2_0120A2C3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A2C3 mov eax, dword ptr fs:[00000030h]6_2_0120A2C3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A2C3 mov eax, dword ptr fs:[00000030h]6_2_0120A2C3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A2C3 mov eax, dword ptr fs:[00000030h]6_2_0120A2C3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D62D6 mov eax, dword ptr fs:[00000030h]6_2_012D62D6
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210535 mov eax, dword ptr fs:[00000030h]6_2_01210535
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210535 mov eax, dword ptr fs:[00000030h]6_2_01210535
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210535 mov eax, dword ptr fs:[00000030h]6_2_01210535
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210535 mov eax, dword ptr fs:[00000030h]6_2_01210535
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210535 mov eax, dword ptr fs:[00000030h]6_2_01210535
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210535 mov eax, dword ptr fs:[00000030h]6_2_01210535
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E53E mov eax, dword ptr fs:[00000030h]6_2_0122E53E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E53E mov eax, dword ptr fs:[00000030h]6_2_0122E53E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E53E mov eax, dword ptr fs:[00000030h]6_2_0122E53E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E53E mov eax, dword ptr fs:[00000030h]6_2_0122E53E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E53E mov eax, dword ptr fs:[00000030h]6_2_0122E53E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01296500 mov eax, dword ptr fs:[00000030h]6_2_01296500
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D4500 mov eax, dword ptr fs:[00000030h]6_2_012D4500
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D4500 mov eax, dword ptr fs:[00000030h]6_2_012D4500
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D4500 mov eax, dword ptr fs:[00000030h]6_2_012D4500
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D4500 mov eax, dword ptr fs:[00000030h]6_2_012D4500
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D4500 mov eax, dword ptr fs:[00000030h]6_2_012D4500
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D4500 mov eax, dword ptr fs:[00000030h]6_2_012D4500
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D4500 mov eax, dword ptr fs:[00000030h]6_2_012D4500
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123656A mov eax, dword ptr fs:[00000030h]6_2_0123656A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123656A mov eax, dword ptr fs:[00000030h]6_2_0123656A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123656A mov eax, dword ptr fs:[00000030h]6_2_0123656A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01208550 mov eax, dword ptr fs:[00000030h]6_2_01208550
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01208550 mov eax, dword ptr fs:[00000030h]6_2_01208550
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012805A7 mov eax, dword ptr fs:[00000030h]6_2_012805A7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012805A7 mov eax, dword ptr fs:[00000030h]6_2_012805A7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012805A7 mov eax, dword ptr fs:[00000030h]6_2_012805A7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012245B1 mov eax, dword ptr fs:[00000030h]6_2_012245B1
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012245B1 mov eax, dword ptr fs:[00000030h]6_2_012245B1
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01202582 mov eax, dword ptr fs:[00000030h]6_2_01202582
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01202582 mov ecx, dword ptr fs:[00000030h]6_2_01202582
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01234588 mov eax, dword ptr fs:[00000030h]6_2_01234588
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E59C mov eax, dword ptr fs:[00000030h]6_2_0123E59C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012025E0 mov eax, dword ptr fs:[00000030h]6_2_012025E0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E5E7 mov eax, dword ptr fs:[00000030h]6_2_0122E5E7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E5E7 mov eax, dword ptr fs:[00000030h]6_2_0122E5E7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E5E7 mov eax, dword ptr fs:[00000030h]6_2_0122E5E7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E5E7 mov eax, dword ptr fs:[00000030h]6_2_0122E5E7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E5E7 mov eax, dword ptr fs:[00000030h]6_2_0122E5E7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E5E7 mov eax, dword ptr fs:[00000030h]6_2_0122E5E7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E5E7 mov eax, dword ptr fs:[00000030h]6_2_0122E5E7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E5E7 mov eax, dword ptr fs:[00000030h]6_2_0122E5E7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123C5ED mov eax, dword ptr fs:[00000030h]6_2_0123C5ED
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123C5ED mov eax, dword ptr fs:[00000030h]6_2_0123C5ED
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E5CF mov eax, dword ptr fs:[00000030h]6_2_0123E5CF
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E5CF mov eax, dword ptr fs:[00000030h]6_2_0123E5CF
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012065D0 mov eax, dword ptr fs:[00000030h]6_2_012065D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123A5D0 mov eax, dword ptr fs:[00000030h]6_2_0123A5D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123A5D0 mov eax, dword ptr fs:[00000030h]6_2_0123A5D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01286420 mov eax, dword ptr fs:[00000030h]6_2_01286420
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01286420 mov eax, dword ptr fs:[00000030h]6_2_01286420
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01286420 mov eax, dword ptr fs:[00000030h]6_2_01286420
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01286420 mov eax, dword ptr fs:[00000030h]6_2_01286420
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01286420 mov eax, dword ptr fs:[00000030h]6_2_01286420
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01286420 mov eax, dword ptr fs:[00000030h]6_2_01286420
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01286420 mov eax, dword ptr fs:[00000030h]6_2_01286420
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123A430 mov eax, dword ptr fs:[00000030h]6_2_0123A430
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01238402 mov eax, dword ptr fs:[00000030h]6_2_01238402
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01238402 mov eax, dword ptr fs:[00000030h]6_2_01238402
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01238402 mov eax, dword ptr fs:[00000030h]6_2_01238402
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FC427 mov eax, dword ptr fs:[00000030h]6_2_011FC427
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FE420 mov eax, dword ptr fs:[00000030h]6_2_011FE420
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FE420 mov eax, dword ptr fs:[00000030h]6_2_011FE420
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FE420 mov eax, dword ptr fs:[00000030h]6_2_011FE420
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011F645D mov eax, dword ptr fs:[00000030h]6_2_011F645D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128C460 mov ecx, dword ptr fs:[00000030h]6_2_0128C460
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122A470 mov eax, dword ptr fs:[00000030h]6_2_0122A470
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122A470 mov eax, dword ptr fs:[00000030h]6_2_0122A470
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122A470 mov eax, dword ptr fs:[00000030h]6_2_0122A470
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E443 mov eax, dword ptr fs:[00000030h]6_2_0123E443
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E443 mov eax, dword ptr fs:[00000030h]6_2_0123E443
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E443 mov eax, dword ptr fs:[00000030h]6_2_0123E443
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E443 mov eax, dword ptr fs:[00000030h]6_2_0123E443
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E443 mov eax, dword ptr fs:[00000030h]6_2_0123E443
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E443 mov eax, dword ptr fs:[00000030h]6_2_0123E443
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E443 mov eax, dword ptr fs:[00000030h]6_2_0123E443
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123E443 mov eax, dword ptr fs:[00000030h]6_2_0123E443
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122245A mov eax, dword ptr fs:[00000030h]6_2_0122245A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012BA456 mov eax, dword ptr fs:[00000030h]6_2_012BA456
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012064AB mov eax, dword ptr fs:[00000030h]6_2_012064AB
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012344B0 mov ecx, dword ptr fs:[00000030h]6_2_012344B0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128A4B0 mov eax, dword ptr fs:[00000030h]6_2_0128A4B0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012BA49A mov eax, dword ptr fs:[00000030h]6_2_012BA49A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012004E5 mov ecx, dword ptr fs:[00000030h]6_2_012004E5
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123C720 mov eax, dword ptr fs:[00000030h]6_2_0123C720
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123C720 mov eax, dword ptr fs:[00000030h]6_2_0123C720
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127C730 mov eax, dword ptr fs:[00000030h]6_2_0127C730
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123273C mov eax, dword ptr fs:[00000030h]6_2_0123273C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123273C mov ecx, dword ptr fs:[00000030h]6_2_0123273C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123273C mov eax, dword ptr fs:[00000030h]6_2_0123273C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123C700 mov eax, dword ptr fs:[00000030h]6_2_0123C700
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01200710 mov eax, dword ptr fs:[00000030h]6_2_01200710
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01230710 mov eax, dword ptr fs:[00000030h]6_2_01230710
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01208770 mov eax, dword ptr fs:[00000030h]6_2_01208770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210770 mov eax, dword ptr fs:[00000030h]6_2_01210770
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123674D mov esi, dword ptr fs:[00000030h]6_2_0123674D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123674D mov eax, dword ptr fs:[00000030h]6_2_0123674D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123674D mov eax, dword ptr fs:[00000030h]6_2_0123674D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01200750 mov eax, dword ptr fs:[00000030h]6_2_01200750
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242750 mov eax, dword ptr fs:[00000030h]6_2_01242750
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242750 mov eax, dword ptr fs:[00000030h]6_2_01242750
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128E75D mov eax, dword ptr fs:[00000030h]6_2_0128E75D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01284755 mov eax, dword ptr fs:[00000030h]6_2_01284755
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B47A0 mov eax, dword ptr fs:[00000030h]6_2_012B47A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012007AF mov eax, dword ptr fs:[00000030h]6_2_012007AF
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A678E mov eax, dword ptr fs:[00000030h]6_2_012A678E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128E7E1 mov eax, dword ptr fs:[00000030h]6_2_0128E7E1
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012227ED mov eax, dword ptr fs:[00000030h]6_2_012227ED
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012227ED mov eax, dword ptr fs:[00000030h]6_2_012227ED
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012227ED mov eax, dword ptr fs:[00000030h]6_2_012227ED
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012047FB mov eax, dword ptr fs:[00000030h]6_2_012047FB
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012047FB mov eax, dword ptr fs:[00000030h]6_2_012047FB
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120C7C0 mov eax, dword ptr fs:[00000030h]6_2_0120C7C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012807C3 mov eax, dword ptr fs:[00000030h]6_2_012807C3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01236620 mov eax, dword ptr fs:[00000030h]6_2_01236620
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01238620 mov eax, dword ptr fs:[00000030h]6_2_01238620
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121E627 mov eax, dword ptr fs:[00000030h]6_2_0121E627
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120262C mov eax, dword ptr fs:[00000030h]6_2_0120262C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121260B mov eax, dword ptr fs:[00000030h]6_2_0121260B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121260B mov eax, dword ptr fs:[00000030h]6_2_0121260B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121260B mov eax, dword ptr fs:[00000030h]6_2_0121260B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121260B mov eax, dword ptr fs:[00000030h]6_2_0121260B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121260B mov eax, dword ptr fs:[00000030h]6_2_0121260B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121260B mov eax, dword ptr fs:[00000030h]6_2_0121260B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121260B mov eax, dword ptr fs:[00000030h]6_2_0121260B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E609 mov eax, dword ptr fs:[00000030h]6_2_0127E609
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01242619 mov eax, dword ptr fs:[00000030h]6_2_01242619
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C866E mov eax, dword ptr fs:[00000030h]6_2_012C866E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C866E mov eax, dword ptr fs:[00000030h]6_2_012C866E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123A660 mov eax, dword ptr fs:[00000030h]6_2_0123A660
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123A660 mov eax, dword ptr fs:[00000030h]6_2_0123A660
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01232674 mov eax, dword ptr fs:[00000030h]6_2_01232674
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0121C640 mov eax, dword ptr fs:[00000030h]6_2_0121C640
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123C6A6 mov eax, dword ptr fs:[00000030h]6_2_0123C6A6
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012366B0 mov eax, dword ptr fs:[00000030h]6_2_012366B0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01204690 mov eax, dword ptr fs:[00000030h]6_2_01204690
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01204690 mov eax, dword ptr fs:[00000030h]6_2_01204690
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E6F2 mov eax, dword ptr fs:[00000030h]6_2_0127E6F2
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E6F2 mov eax, dword ptr fs:[00000030h]6_2_0127E6F2
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E6F2 mov eax, dword ptr fs:[00000030h]6_2_0127E6F2
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E6F2 mov eax, dword ptr fs:[00000030h]6_2_0127E6F2
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012806F1 mov eax, dword ptr fs:[00000030h]6_2_012806F1
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012806F1 mov eax, dword ptr fs:[00000030h]6_2_012806F1
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123A6C7 mov ebx, dword ptr fs:[00000030h]6_2_0123A6C7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123A6C7 mov eax, dword ptr fs:[00000030h]6_2_0123A6C7
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128892A mov eax, dword ptr fs:[00000030h]6_2_0128892A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0129892B mov eax, dword ptr fs:[00000030h]6_2_0129892B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011F8918 mov eax, dword ptr fs:[00000030h]6_2_011F8918
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011F8918 mov eax, dword ptr fs:[00000030h]6_2_011F8918
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E908 mov eax, dword ptr fs:[00000030h]6_2_0127E908
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127E908 mov eax, dword ptr fs:[00000030h]6_2_0127E908
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128C912 mov eax, dword ptr fs:[00000030h]6_2_0128C912
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01226962 mov eax, dword ptr fs:[00000030h]6_2_01226962
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01226962 mov eax, dword ptr fs:[00000030h]6_2_01226962
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01226962 mov eax, dword ptr fs:[00000030h]6_2_01226962
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0124096E mov eax, dword ptr fs:[00000030h]6_2_0124096E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0124096E mov edx, dword ptr fs:[00000030h]6_2_0124096E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0124096E mov eax, dword ptr fs:[00000030h]6_2_0124096E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A4978 mov eax, dword ptr fs:[00000030h]6_2_012A4978
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A4978 mov eax, dword ptr fs:[00000030h]6_2_012A4978
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128C97C mov eax, dword ptr fs:[00000030h]6_2_0128C97C
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D4940 mov eax, dword ptr fs:[00000030h]6_2_012D4940
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01280946 mov eax, dword ptr fs:[00000030h]6_2_01280946
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012129A0 mov eax, dword ptr fs:[00000030h]6_2_012129A0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012009AD mov eax, dword ptr fs:[00000030h]6_2_012009AD
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012009AD mov eax, dword ptr fs:[00000030h]6_2_012009AD
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012889B3 mov esi, dword ptr fs:[00000030h]6_2_012889B3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012889B3 mov eax, dword ptr fs:[00000030h]6_2_012889B3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012889B3 mov eax, dword ptr fs:[00000030h]6_2_012889B3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128E9E0 mov eax, dword ptr fs:[00000030h]6_2_0128E9E0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012329F9 mov eax, dword ptr fs:[00000030h]6_2_012329F9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012329F9 mov eax, dword ptr fs:[00000030h]6_2_012329F9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012969C0 mov eax, dword ptr fs:[00000030h]6_2_012969C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A9D0 mov eax, dword ptr fs:[00000030h]6_2_0120A9D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A9D0 mov eax, dword ptr fs:[00000030h]6_2_0120A9D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A9D0 mov eax, dword ptr fs:[00000030h]6_2_0120A9D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A9D0 mov eax, dword ptr fs:[00000030h]6_2_0120A9D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A9D0 mov eax, dword ptr fs:[00000030h]6_2_0120A9D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120A9D0 mov eax, dword ptr fs:[00000030h]6_2_0120A9D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012349D0 mov eax, dword ptr fs:[00000030h]6_2_012349D0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CA9D3 mov eax, dword ptr fs:[00000030h]6_2_012CA9D3
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A483A mov eax, dword ptr fs:[00000030h]6_2_012A483A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A483A mov eax, dword ptr fs:[00000030h]6_2_012A483A
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123A830 mov eax, dword ptr fs:[00000030h]6_2_0123A830
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01222835 mov eax, dword ptr fs:[00000030h]6_2_01222835
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01222835 mov eax, dword ptr fs:[00000030h]6_2_01222835
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01222835 mov eax, dword ptr fs:[00000030h]6_2_01222835
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01222835 mov ecx, dword ptr fs:[00000030h]6_2_01222835
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01222835 mov eax, dword ptr fs:[00000030h]6_2_01222835
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01222835 mov eax, dword ptr fs:[00000030h]6_2_01222835
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128C810 mov eax, dword ptr fs:[00000030h]6_2_0128C810
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01296870 mov eax, dword ptr fs:[00000030h]6_2_01296870
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01296870 mov eax, dword ptr fs:[00000030h]6_2_01296870
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128E872 mov eax, dword ptr fs:[00000030h]6_2_0128E872
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128E872 mov eax, dword ptr fs:[00000030h]6_2_0128E872
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01212840 mov ecx, dword ptr fs:[00000030h]6_2_01212840
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01230854 mov eax, dword ptr fs:[00000030h]6_2_01230854
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01204859 mov eax, dword ptr fs:[00000030h]6_2_01204859
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01204859 mov eax, dword ptr fs:[00000030h]6_2_01204859
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01200887 mov eax, dword ptr fs:[00000030h]6_2_01200887
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128C89D mov eax, dword ptr fs:[00000030h]6_2_0128C89D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CA8E4 mov eax, dword ptr fs:[00000030h]6_2_012CA8E4
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123C8F9 mov eax, dword ptr fs:[00000030h]6_2_0123C8F9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123C8F9 mov eax, dword ptr fs:[00000030h]6_2_0123C8F9
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122E8C0 mov eax, dword ptr fs:[00000030h]6_2_0122E8C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D08C0 mov eax, dword ptr fs:[00000030h]6_2_012D08C0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122EB20 mov eax, dword ptr fs:[00000030h]6_2_0122EB20
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122EB20 mov eax, dword ptr fs:[00000030h]6_2_0122EB20
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C8B28 mov eax, dword ptr fs:[00000030h]6_2_012C8B28
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012C8B28 mov eax, dword ptr fs:[00000030h]6_2_012C8B28
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D4B00 mov eax, dword ptr fs:[00000030h]6_2_012D4B00
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127EB1D mov eax, dword ptr fs:[00000030h]6_2_0127EB1D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127EB1D mov eax, dword ptr fs:[00000030h]6_2_0127EB1D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127EB1D mov eax, dword ptr fs:[00000030h]6_2_0127EB1D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127EB1D mov eax, dword ptr fs:[00000030h]6_2_0127EB1D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127EB1D mov eax, dword ptr fs:[00000030h]6_2_0127EB1D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127EB1D mov eax, dword ptr fs:[00000030h]6_2_0127EB1D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127EB1D mov eax, dword ptr fs:[00000030h]6_2_0127EB1D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127EB1D mov eax, dword ptr fs:[00000030h]6_2_0127EB1D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127EB1D mov eax, dword ptr fs:[00000030h]6_2_0127EB1D
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011F8B50 mov eax, dword ptr fs:[00000030h]6_2_011F8B50
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B4B4B mov eax, dword ptr fs:[00000030h]6_2_012B4B4B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B4B4B mov eax, dword ptr fs:[00000030h]6_2_012B4B4B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_011FCB7E mov eax, dword ptr fs:[00000030h]6_2_011FCB7E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012A8B42 mov eax, dword ptr fs:[00000030h]6_2_012A8B42
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01296B40 mov eax, dword ptr fs:[00000030h]6_2_01296B40
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01296B40 mov eax, dword ptr fs:[00000030h]6_2_01296B40
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012CAB40 mov eax, dword ptr fs:[00000030h]6_2_012CAB40
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AEB50 mov eax, dword ptr fs:[00000030h]6_2_012AEB50
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D2B57 mov eax, dword ptr fs:[00000030h]6_2_012D2B57
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D2B57 mov eax, dword ptr fs:[00000030h]6_2_012D2B57
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D2B57 mov eax, dword ptr fs:[00000030h]6_2_012D2B57
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012D2B57 mov eax, dword ptr fs:[00000030h]6_2_012D2B57
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B4BB0 mov eax, dword ptr fs:[00000030h]6_2_012B4BB0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012B4BB0 mov eax, dword ptr fs:[00000030h]6_2_012B4BB0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210BBE mov eax, dword ptr fs:[00000030h]6_2_01210BBE
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210BBE mov eax, dword ptr fs:[00000030h]6_2_01210BBE
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01208BF0 mov eax, dword ptr fs:[00000030h]6_2_01208BF0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01208BF0 mov eax, dword ptr fs:[00000030h]6_2_01208BF0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01208BF0 mov eax, dword ptr fs:[00000030h]6_2_01208BF0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128CBF0 mov eax, dword ptr fs:[00000030h]6_2_0128CBF0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122EBFC mov eax, dword ptr fs:[00000030h]6_2_0122EBFC
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01220BCB mov eax, dword ptr fs:[00000030h]6_2_01220BCB
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01220BCB mov eax, dword ptr fs:[00000030h]6_2_01220BCB
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01220BCB mov eax, dword ptr fs:[00000030h]6_2_01220BCB
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01200BCD mov eax, dword ptr fs:[00000030h]6_2_01200BCD
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01200BCD mov eax, dword ptr fs:[00000030h]6_2_01200BCD
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01200BCD mov eax, dword ptr fs:[00000030h]6_2_01200BCD
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AEBD0 mov eax, dword ptr fs:[00000030h]6_2_012AEBD0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123CA24 mov eax, dword ptr fs:[00000030h]6_2_0123CA24
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0122EA2E mov eax, dword ptr fs:[00000030h]6_2_0122EA2E
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01224A35 mov eax, dword ptr fs:[00000030h]6_2_01224A35
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01224A35 mov eax, dword ptr fs:[00000030h]6_2_01224A35
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123CA38 mov eax, dword ptr fs:[00000030h]6_2_0123CA38
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0128CA11 mov eax, dword ptr fs:[00000030h]6_2_0128CA11
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_012AEA60 mov eax, dword ptr fs:[00000030h]6_2_012AEA60
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123CA6F mov eax, dword ptr fs:[00000030h]6_2_0123CA6F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123CA6F mov eax, dword ptr fs:[00000030h]6_2_0123CA6F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0123CA6F mov eax, dword ptr fs:[00000030h]6_2_0123CA6F
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127CA72 mov eax, dword ptr fs:[00000030h]6_2_0127CA72
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0127CA72 mov eax, dword ptr fs:[00000030h]6_2_0127CA72
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01206A50 mov eax, dword ptr fs:[00000030h]6_2_01206A50
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01206A50 mov eax, dword ptr fs:[00000030h]6_2_01206A50
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01206A50 mov eax, dword ptr fs:[00000030h]6_2_01206A50
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01206A50 mov eax, dword ptr fs:[00000030h]6_2_01206A50
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01206A50 mov eax, dword ptr fs:[00000030h]6_2_01206A50
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01206A50 mov eax, dword ptr fs:[00000030h]6_2_01206A50
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01206A50 mov eax, dword ptr fs:[00000030h]6_2_01206A50
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210A5B mov eax, dword ptr fs:[00000030h]6_2_01210A5B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01210A5B mov eax, dword ptr fs:[00000030h]6_2_01210A5B
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01208AA0 mov eax, dword ptr fs:[00000030h]6_2_01208AA0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01208AA0 mov eax, dword ptr fs:[00000030h]6_2_01208AA0
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_01256AA4 mov eax, dword ptr fs:[00000030h]6_2_01256AA4
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120EA80 mov eax, dword ptr fs:[00000030h]6_2_0120EA80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120EA80 mov eax, dword ptr fs:[00000030h]6_2_0120EA80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120EA80 mov eax, dword ptr fs:[00000030h]6_2_0120EA80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120EA80 mov eax, dword ptr fs:[00000030h]6_2_0120EA80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120EA80 mov eax, dword ptr fs:[00000030h]6_2_0120EA80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120EA80 mov eax, dword ptr fs:[00000030h]6_2_0120EA80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120EA80 mov eax, dword ptr fs:[00000030h]6_2_0120EA80
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeCode function: 6_2_0120EA80 mov eax, dword ptr fs:[00000030h]6_2_0120EA80
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_0079DC60 GetProcessHeap,RtlFreeHeap,8_2_0079DC60
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A6EC0 SetUnhandledExceptionFilter,8_2_007A6EC0
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_007A6B40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_007A6B40
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 207.241.198.3 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 108.157.194.11 80Jump to behavior
          Adds a directory exclusion to Windows Defender
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"Jump to behavior
          Found direct / indirect Syscall (likely to bypass EDR)
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeNtQueueApcThread: Indirect: 0x117A4F2Jump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeNtClose: Indirect: 0x117A56C
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeMemory written: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe base: 400000 value starts with: 4D5AJump to behavior
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeThread register set: target process: 1028Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeThread register set: target process: 1028Jump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Sample uses process hollowing technique
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeSection unmapped: C:\Windows\SysWOW64\cmd.exe base address: 790000Jump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess created: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"Jump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeProcess created: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"Jump to behavior
          Source: explorer.exe, 00000007.00000003.3105365605.0000000009C21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd=
          Source: explorer.exe, 00000007.00000002.4539768932.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.2132455186.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
          Source: explorer.exe, 00000007.00000000.2135190093.0000000004B00000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4539768932.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.2132455186.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000007.00000002.4539768932.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.2132455186.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000007.00000002.4539768932.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.2132455186.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: explorer.exe, 00000007.00000002.4538762767.0000000000EF0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2131821278.0000000000EF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PProgman
          Source: C:\Windows\SysWOW64\cmd.exeCode function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc,8_2_00796854
          Source: C:\Windows\SysWOW64\cmd.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,8_2_00798572
          Source: C:\Windows\SysWOW64\cmd.exeCode function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,8_2_00799310
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeQueries volume information: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_00796854 GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc,8_2_00796854
          Source: C:\Windows\SysWOW64\cmd.exeCode function: 8_2_00794D08 GetVersion,8_2_00794D08
          Source: C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 6.2.Ticari Siparis Belgesi 26 07 2024 17545000600.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire Infrastructure1
          Valid Accounts          		1
          Shared Modules          		1
          Valid Accounts          		1
          Valid Accounts          		1
          Masquerading          		OS Credential Dumping1
          System Time Discovery          		Remote Services1
          Archive Collected Data          		1
          Encrypted Channel          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault AccountsScheduled Task/Job1
          DLL Side-Loading          		1
          Access Token Manipulation          		1
          Valid Accounts          		LSASS Memory241
          Security Software Discovery          		Remote Desktop ProtocolData from Removable Media2
          Ingress Tool Transfer          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)612
          Process Injection          		1
          Access Token Manipulation          		Security Account Manager2
          Process Discovery          		SMB/Windows Admin SharesData from Network Shared Drive2
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
          Abuse Elevation Control Mechanism          		11
          Disable or Modify Tools          		NTDS41
          Virtualization/Sandbox Evasion          		Distributed Component Object ModelInput Capture12
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
          DLL Side-Loading          		41
          Virtualization/Sandbox Evasion          		LSA Secrets1
          Application Window Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts612
          Process Injection          		Cached Domain Credentials2
          File and Directory Discovery          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          Deobfuscate/Decode Files or Information          		DCSync225
          System Information Discovery          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
          Abuse Elevation Control Mechanism          		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt4
          Obfuscated Files or Information          		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
          IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron12
          Software Packing          		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
          Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
          DLL Side-Loading          		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1485412 Sample: Ticari Siparis Belgesi 26 0... Startdate: 31/07/2024 Architecture: WINDOWS Score: 100 37 www.xiangadvanced.site 2->37 39 www.xcxocef.shop 2->39 41 14 other IPs or domains 2->41 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus detection for URL or domain 2->53 55 12 other signatures 2->55 11 Ticari Siparis Belgesi 26 07 2024 17545000600.exe 4 2->11         started        signatures3 process4 file5 35 Ticari Siparis Bel...17545000600.exe.log, ASCII 11->35 dropped 59 Adds a directory exclusion to Windows Defender 11->59 61 Injects a PE file into a foreign processes 11->61 15 Ticari Siparis Belgesi 26 07 2024 17545000600.exe 11->15         started        18 powershell.exe 23 11->18         started        20 Ticari Siparis Belgesi 26 07 2024 17545000600.exe 11->20         started        signatures6 process7 signatures8 71 Modifies the context of a thread in another process (thread injection) 15->71 73 Maps a DLL or memory area into another process 15->73 75 Sample uses process hollowing technique 15->75 79 2 other signatures 15->79 22 explorer.exe 89 1 15->22 injected 77 Loading BitLocker PowerShell Module 18->77 26 conhost.exe 18->26         started        process9 dnsIp10 43 chalkandthimble.com 207.241.198.3, 52191, 80 LIGHTSOURCE-US United States 22->43 45 d1qrjwiza3wzm5.cloudfront.net 108.157.194.11, 52188, 80 AMAZON-02US United States 22->45 47 www.loyalbahis356.com 185.148.106.70, 52192, 80 TESONETLT Russian Federation 22->47 57 System process connects to network (likely due to code injection or exploit) 22->57 28 cmd.exe 22->28         started        signatures11 process12 signatures13 63 Modifies the context of a thread in another process (thread injection) 28->63 65 Maps a DLL or memory area into another process 28->65 67 Tries to detect virtualization through RDTSC time measurements 28->67 69 Switches to a custom stack to bypass stack traces 28->69 31 cmd.exe 1 28->31         started        process14 process15 33 conhost.exe 31->33         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          Ticari Siparis Belgesi 26 07 2024 17545000600.exe76%ReversingLabsWin32.Backdoor.FormBook
          Ticari Siparis Belgesi 26 07 2024 17545000600.exe100%AviraHEUR/AGEN.1357443
          Ticari Siparis Belgesi 26 07 2024 17545000600.exe100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          https://powerpoint.office.comcember0%URL Reputationsafe
          https://excel.office.com0%URL Reputationsafe
          http://schemas.micro0%URL Reputationsafe
          https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe0%URL Reputationsafe
          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
          https://outlook.com0%URL Reputationsafe
          https://android.notify.windows.com/iOS0%URL Reputationsafe
          https://api.msn.com/0%URL Reputationsafe
          http://crl.v0%URL Reputationsafe
          http://www.salesgymshark.shop0%Avira URL Cloudsafe
          http://www.datalakeflow.com0%Avira URL Cloudsafe
          http://www.salesgymshark.shopReferer:0%Avira URL Cloudsafe
          https://word.office.comon0%Avira URL Cloudsafe
          http://www.cripmz.xyz0%Avira URL Cloudsafe
          http://www.brenjitu1904.com/pz12/0%Avira URL Cloudsafe
          http://www.salesgymshark.shop/pz12/0%Avira URL Cloudsafe
          http://www.autonwheels.comReferer:0%Avira URL Cloudsafe
          http://www.cripmz.xyz/pz12/www.317wb.com0%Avira URL Cloudsafe
          http://www.autonwheels.com/pz12/www.vanessasmobilespa.com100%Avira URL Cloudmalware
          http://www.98980901.com/pz12/www.jnhdh8827.com0%Avira URL Cloudsafe
          www.jnhdh8827.com/pz12/0%Avira URL Cloudsafe
          http://www.datalakeflow.com/pz12/www.xcxocef.shop0%Avira URL Cloudsafe
          http://www.vanessasmobilespa.com/pz12/0%Avira URL Cloudsafe
          http://www.98980901.com0%Avira URL Cloudsafe
          http://www.jnhdh8827.com0%Avira URL Cloudsafe
          http://www.jnhdh8827.com/pz12/www.brenjitu1904.com0%Avira URL Cloudsafe
          http://www.chalkandthimble.com100%Avira URL Cloudmalware
          http://www.autonwheels.com100%Avira URL Cloudmalware
          http://www.loyalbahis356.comReferer:0%Avira URL Cloudsafe
          https://loyalbahis356.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=mhHbh1AUgvkDqhcxvrHPgmJxw//lx/100%Avira URL Cloudmalware
          http://www.jnhdh8827.comReferer:0%Avira URL Cloudsafe
          http://www.xcxocef.shopReferer:0%Avira URL Cloudsafe
          http://www.cripmz.xyzReferer:0%Avira URL Cloudsafe
          http://www.businessbroadway.com/pz12/www.qqfoodsolutions.com0%Avira URL Cloudsafe
          http://www.vanessasmobilespa.comReferer:0%Avira URL Cloudsafe
          http://www.xcxocef.shop/pz12/www.chalkandthimble.com100%Avira URL Cloudphishing
          http://www.businessbroadway.com0%Avira URL Cloudsafe
          http://www.xiangadvanced.site/pz12/www.cripmz.xyz0%Avira URL Cloudsafe
          http://www.salesgymshark.shop/pz12/www.businessbroadway.com0%Avira URL Cloudsafe
          http://www.vanessasmobilespa.com0%Avira URL Cloudsafe
          http://www.98980901.com/pz12/0%Avira URL Cloudsafe
          http://www.datalakeflow.com/pz12/0%Avira URL Cloudsafe
          http://www.xiangadvanced.siteReferer:0%Avira URL Cloudsafe
          http://www.businessbroadway.comReferer:0%Avira URL Cloudsafe
          http://www.vanessasmobilespa.com/pz12/www.98980901.com0%Avira URL Cloudsafe
          https://wns.windows.com/)s0%Avira URL Cloudsafe
          http://www.autoitscript.com/autoit3/J0%Avira URL Cloudsafe
          http://www.aromacuppa.comReferer:0%Avira URL Cloudsafe
          http://www.317wb.com/pz12/www.loyalbahis356.com0%Avira URL Cloudsafe
          http://www.98980901.comReferer:0%Avira URL Cloudsafe
          http://www.aromacuppa.com/pz12/0%Avira URL Cloudsafe
          http://www.autonwheels.com/pz12/100%Avira URL Cloudmalware
          http://www.chalkandthimble.com/pz12/100%Avira URL Cloudmalware
          http://www.brenjitu1904.comReferer:0%Avira URL Cloudsafe
          http://www.loyalbahis356.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=mhHbh1AUgvkDqhcxvrHPgmJxw//lx/+38lrQrf/b9xTaJsLm+Z3/RBaY9L1MEhp7dpaA100%Avira URL Cloudmalware
          http://www.brenjitu1904.com/pz12/www.salesgymshark.shop0%Avira URL Cloudsafe
          http://www.317wb.comReferer:0%Avira URL Cloudsafe
          http://www.chalkandthimble.com/pz12/www.xiangadvanced.site100%Avira URL Cloudmalware
          http://www.brenjitu1904.com0%Avira URL Cloudsafe
          http://www.317wb.com/pz12/0%Avira URL Cloudsafe
          http://www.chalkandthimble.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=9hrk18skSQhCCsrWhUPNj3yaKA8UlZiY5Un3cfGqWer7qRPGp2VeMQg9udTNeDooaK7+100%Avira URL Cloudmalware
          http://www.aromacuppa.com0%Avira URL Cloudsafe
          http://www.datalakeflow.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=XLxih9erqU5OQ/zVa2U9uayzQwvQYqwD+iUwcFTJkQJbXUUHI+Ws7VPKfbblI2vONd0o0%Avira URL Cloudsafe
          http://www.aromacuppa.com/pz12/www.autonwheels.com0%Avira URL Cloudsafe
          http://www.cripmz.xyz/pz12/0%Avira URL Cloudsafe
          http://www.xiangadvanced.site/pz12/0%Avira URL Cloudsafe
          http://www.qqfoodsolutions.comReferer:0%Avira URL Cloudsafe
          http://www.317wb.com0%Avira URL Cloudsafe
          http://www.loyalbahis356.com100%Avira URL Cloudmalware
          http://www.chalkandthimble.comReferer:0%Avira URL Cloudsafe
          http://www.xcxocef.shop/pz12/100%Avira URL Cloudmalware
          http://www.datalakeflow.comReferer:0%Avira URL Cloudsafe
          http://www.xiangadvanced.site0%Avira URL Cloudsafe
          http://www.xcxocef.shop100%Avira URL Cloudphishing
          http://www.jnhdh8827.com/pz12/0%Avira URL Cloudsafe
          http://www.businessbroadway.com/pz12/0%Avira URL Cloudsafe
          http://www.qqfoodsolutions.com/pz12/0%Avira URL Cloudsafe
          http://www.loyalbahis356.com/pz12/www.aromacuppa.com100%Avira URL Cloudmalware
          http://www.loyalbahis356.com/pz12/100%Avira URL Cloudmalware

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          chalkandthimble.com
          		207.241.198.3
          		truetrue
            		unknown
            aromacuppa.com
            		213.139.204.22
            		truetrue
              		unknown
              www.98980901.com
              		38.239.1.118
              		truefalse
                		unknown
                www.loyalbahis356.com
                		185.148.106.70
                		truefalse
                  		unknown
                  vanessasmobilespa.com
                  		75.101.134.27
                  		truetrue
                    		unknown
                    www.autonwheels.com
                    		104.21.80.197
                    		truefalse
                      		unknown
                      www.jnhdh8827.com
                      		188.114.96.3
                      		truetrue
                        		unknown
                        d1qrjwiza3wzm5.cloudfront.net
                        		108.157.194.11
                        		truetrue
                          		unknown
                          15.164.165.52.in-addr.arpa
                          		unknown
                          		unknowntrue
                            		unknown
                            www.chalkandthimble.com
                            		unknown
                            		unknowntrue
                              		unknown
                              www.aromacuppa.com
                              		unknown
                              		unknowntrue
                                		unknown
                                www.vanessasmobilespa.com
                                		unknown
                                		unknowntrue
                                  		unknown
                                  www.datalakeflow.com
                                  		unknown
                                  		unknowntrue
                                    		unknown
                                    www.317wb.com
                                    		unknown
                                    		unknowntrue
                                      		unknown
                                      www.xiangadvanced.site
                                      		unknown
                                      		unknowntrue
                                        		unknown
                                        www.xcxocef.shop
                                        		unknown
                                        		unknowntrue
                                          		unknown

                                          Contacted URLs

                                          NameMaliciousAntivirus DetectionReputation
                                          www.jnhdh8827.com/pz12/true
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.loyalbahis356.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=mhHbh1AUgvkDqhcxvrHPgmJxw//lx/+38lrQrf/b9xTaJsLm+Z3/RBaY9L1MEhp7dpaAfalse
                                          • Avira URL Cloud: malware
                                          		unknown
                                          http://www.datalakeflow.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=XLxih9erqU5OQ/zVa2U9uayzQwvQYqwD+iUwcFTJkQJbXUUHI+Ws7VPKfbblI2vONd0otrue
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.chalkandthimble.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=9hrk18skSQhCCsrWhUPNj3yaKA8UlZiY5Un3cfGqWer7qRPGp2VeMQg9udTNeDooaK7+true
                                          • Avira URL Cloud: malware
                                          		unknown

                                          URLs from Memory and Binaries

                                          NameSourceMaliciousAntivirus DetectionReputation
                                          https://word.office.comonexplorer.exe, 00000007.00000003.3094747325.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4545593539.00000000099C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.autonwheels.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.salesgymshark.shopexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.salesgymshark.shopReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.brenjitu1904.com/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.salesgymshark.shop/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.cripmz.xyzexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://powerpoint.office.comcemberexplorer.exe, 00000007.00000002.4551366329.000000000C460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2148003902.000000000C460000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.autonwheels.com/pz12/www.vanessasmobilespa.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: malware
                                          		unknown
                                          http://www.cripmz.xyz/pz12/www.317wb.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.datalakeflow.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.vanessasmobilespa.com/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.98980901.com/pz12/www.jnhdh8827.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.datalakeflow.com/pz12/www.xcxocef.shopexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.jnhdh8827.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://excel.office.comexplorer.exe, 00000007.00000003.3105365605.0000000009C21000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4546550713.0000000009C22000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.98980901.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://schemas.microexplorer.exe, 00000007.00000000.2137907662.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.2142461714.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000002.4544751645.0000000008870000.00000002.00000001.00040000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.autonwheels.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: malware
                                          		unknown
                                          http://www.chalkandthimble.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: malware
                                          		unknown
                                          http://www.loyalbahis356.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.jnhdh8827.com/pz12/www.brenjitu1904.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://loyalbahis356.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=mhHbh1AUgvkDqhcxvrHPgmJxw//lx/explorer.exe, 00000007.00000002.4556895478.0000000010FBF000.00000004.80000000.00040000.00000000.sdmp, cmd.exe, 00000008.00000002.4540713209.000000000418F000.00000004.10000000.00040000.00000000.sdmpfalse
                                          • Avira URL Cloud: malware
                                          		unknown
                                          http://www.businessbroadway.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.xcxocef.shopReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.qqfoodsolutions.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://www.jnhdh8827.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.xcxocef.shop/pz12/www.chalkandthimble.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: phishing
                                            		unknown
                                            http://www.businessbroadway.com/pz12/www.qqfoodsolutions.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.vanessasmobilespa.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.xiangadvanced.site/pz12/www.cripmz.xyzexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.cripmz.xyzReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.salesgymshark.shop/pz12/www.businessbroadway.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.vanessasmobilespa.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.datalakeflow.com/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.vanessasmobilespa.com/pz12/www.98980901.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exeexplorer.exe, 00000007.00000000.2148003902.000000000C4DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4552727694.000000000C54A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3100767881.000000000C547000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.98980901.com/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.businessbroadway.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameTicari Siparis Belgesi 26 07 2024 17545000600.exe, 00000000.00000002.2128019151.0000000002A21000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.xiangadvanced.siteReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://wns.windows.com/)sexplorer.exe, 00000007.00000003.3094747325.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.00000000099C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4545593539.00000000099C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.autoitscript.com/autoit3/Jexplorer.exe, 00000007.00000000.2149075288.000000000C860000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3103961985.000000000C860000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.317wb.com/pz12/www.loyalbahis356.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.98980901.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.aromacuppa.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.aromacuppa.com/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.autonwheels.com/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.brenjitu1904.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.brenjitu1904.com/pz12/www.salesgymshark.shopexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.chalkandthimble.com/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.chalkandthimble.com/pz12/www.xiangadvanced.siteexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.317wb.com/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.317wb.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.brenjitu1904.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://outlook.comexplorer.exe, 00000007.00000003.3100077346.0000000009C92000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3094747325.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009B41000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4546607897.0000000009C96000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.aromacuppa.com/pz12/www.autonwheels.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.aromacuppa.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.xiangadvanced.site/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.qqfoodsolutions.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.chalkandthimble.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.cripmz.xyz/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.317wb.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.loyalbahis356.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: malware
                                            		unknown
                                            https://android.notify.windows.com/iOSexplorer.exe, 00000007.00000000.2135493161.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3102199089.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3566241603.00000000076F8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4542934252.00000000076F8000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.xcxocef.shopexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: phishing
                                            		unknown
                                            http://www.datalakeflow.comReferer:explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.xiangadvanced.siteexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://api.msn.com/explorer.exe, 00000007.00000003.3094747325.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2144614594.0000000009ADB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4545593539.0000000009ADB000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.jnhdh8827.com/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.qqfoodsolutions.com/pz12/explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.xcxocef.shop/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://crl.vexplorer.exe, 00000007.00000002.4538762767.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.2131821278.0000000000F13000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.loyalbahis356.com/pz12/www.aromacuppa.comexplorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.businessbroadway.com/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.loyalbahis356.com/pz12/explorer.exe, 00000007.00000003.3094419868.000000000CA4E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.4556319565.000000000CA5C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3096157265.000000000CA57000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: malware
                                            		unknown

                                            World Map of Contacted IPs

                                            • No. of IPs < 25%
                                            • 25% < No. of IPs < 50%
                                            • 50% < No. of IPs < 75%
                                            • 75% < No. of IPs

                                            Public IPs

                                            IPDomainCountryFlagASNASN NameMalicious
                                            207.241.198.3
                                            		chalkandthimble.comUnited States
                                            		397300LIGHTSOURCE-UStrue
                                            185.148.106.70
                                            		www.loyalbahis356.comRussian Federation
                                            		201341TESONETLTfalse
                                            108.157.194.11
                                            		d1qrjwiza3wzm5.cloudfront.netUnited States
                                            		16509AMAZON-02UStrue

                                            General Information

                                            Joe Sandbox version:40.0.0 Tourmaline
                                            Analysis ID:1485412
                                            Start date and time:2024-07-31 15:57:09 +02:00
                                            Joe Sandbox product:CloudBasic
                                            Overall analysis duration:0h 12m 33s
                                            Hypervisor based Inspection enabled:false
                                            Report type:full
                                            Cookbook file name:default.jbs
                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                            Number of analysed new started processes analysed:13
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:1
                                            Technologies:
                                            • HCA enabled
                                            • EGA enabled
                                            • AMSI enabled
                                            Analysis Mode:default
                                            Sample name:Ticari Siparis Belgesi 26 07 2024 17545000600.exe
                                            Detection:MAL
                                            Classification:mal100.troj.evad.winEXE@13/6@12/3
                                            EGA Information:
                                            • Successful, ratio: 100%
                                            HCA Information:
                                            • Successful, ratio: 100%
                                            • Number of executed functions: 114
                                            • Number of non-executed functions: 326
                                            Cookbook Comments:
                                            • Found application associated with file extension: .exe
                                            • Override analysis time to 240000 for current running targets taking high CPU consumption

                                            Warnings

                                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                            • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                            • Not all processes where analyzed, report is missing behavior information
                                            • Report creation exceeded maximum time and may have missing disassembly code information.
                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                            • Report size getting too big, too many NtCreateKey calls found.
                                            • Report size getting too big, too many NtEnumerateKey calls found.
                                            • Report size getting too big, too many NtOpenKey calls found.
                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                            • VT rate limit hit for: Ticari Siparis Belgesi 26 07 2024 17545000600.exe

                                            Simulations

                                            Behavior and APIs

                                            TimeTypeDescription
                                            09:58:05API Interceptor1x Sleep call for process: Ticari Siparis Belgesi 26 07 2024 17545000600.exe modified
                                            09:58:10API Interceptor10x Sleep call for process: powershell.exe modified
                                            09:58:18API Interceptor7686173x Sleep call for process: explorer.exe modified
                                            09:58:55API Interceptor7126538x Sleep call for process: cmd.exe modified

                                            Joe Sandbox View / Context

                                            IPs

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            207.241.198.3qRNC6mtGhI.exeGet hashmaliciousFormBookBrowse
                                            • www.chalkandthimble.com/pz12/?GVrlQ=9hrk18tQSwkyfc2i9kPNj3yaKA8UlZiY5Un3cfGqWer7qRPGp2VeMQg9uez3OSIQAta5&6le=U0Gl
                                            WjhF.exeGet hashmaliciousFormBookBrowse
                                            • www.chalkandthimble.com/pz12/?ndyLnTq=9hrk18skSQhCCsrWhUPNj3yaKA8UlZiY5Un3cfGqWer7qRPGp2VeMQg9uezSVj4QAtG0&1bm=nnM0Ttr0NbXx3
                                            108.157.194.11https://i.mqz7or.com/l/#1barry.doan@firstontario.comGet hashmaliciousTycoon2FABrowse
                                              https://www.canva.com/design/DAGKpnKj4ws/mV0kEuC99HToqQojoQPKQw/edit?utm_content=DAGKpnKj4ws&utm_campaign=designshare&utm_medium=link2&utm_source=sharebuttonGet hashmaliciousTycoon2FABrowse
                                                https://www.kudoboard.com/boards/9yja32B2/Get hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                  http://plnbl.io/review/WX__Ro3YJP2_Get hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                    https://dd404011sl.balancasoriente.com.br/br1111YWNjb3VudHNAaW5maW5pdHkudWsuY29tVX1111Get hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                      https://m.exactag.com/ai.aspx?tc=d9498808bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Acatenconstrucoes.com%2Ffrest#Y2FybG9zLmNhYmFkYUBkYWlpY2hpLXNhbmt5by5lcw==Get hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                        https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//maansaa.com/new/auth//xp8tpwsulfhjn/%2F/YW5keS5ncmVmcmF0aEBrcHMuY29tGet hashmaliciousHTMLPhisherBrowse
                                                          paiement.xlsxGet hashmaliciousUnknownBrowse

                                                            Domains

                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            d1qrjwiza3wzm5.cloudfront.netWjhF.exeGet hashmaliciousFormBookBrowse
                                                            • 18.66.122.42
                                                            www.loyalbahis356.comDocumento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exeGet hashmaliciousFormBookBrowse
                                                            • 185.148.106.71
                                                            www.autonwheels.comDocumento di richiesta di preventivo NR_531 28 05 24.exeGet hashmaliciousFormBookBrowse
                                                            • 172.67.153.101
                                                            www.jnhdh8827.comrFormulariodeso.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • 188.114.96.3
                                                            Steel pipes material data sheets Bill of Quantity Valves chemicals KM C654e21011710050.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • 188.114.96.3
                                                            Material data sheets Bill of Quantity Steel pipes and chemicals KM C654e21011710050.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • 188.114.96.3
                                                            Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exeGet hashmaliciousFormBookBrowse
                                                            • 188.114.96.3

                                                            ASNs

                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            LIGHTSOURCE-USqRNC6mtGhI.exeGet hashmaliciousFormBookBrowse
                                                            • 207.241.198.3
                                                            WjhF.exeGet hashmaliciousFormBookBrowse
                                                            • 207.241.198.3
                                                            Parfumens.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                            • 207.241.198.5
                                                            Afklde.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                            • 207.241.198.5
                                                            38C6gV7JxBGet hashmaliciousMiraiBrowse
                                                            • 23.177.125.100
                                                            TESONETLTINVOICE - MV CNC BANGKOK - ST24PJ-278.exeGet hashmaliciousFormBookBrowse
                                                            • 156.67.74.121
                                                            Documento di bonifico bancario intesa Sanpaola 20240613 EUR23750.exeGet hashmaliciousFormBookBrowse
                                                            • 185.148.106.71
                                                            http://www.open-sora.orgGet hashmaliciousExela Stealer, Growtopia, Python StealerBrowse
                                                            • 156.67.75.29
                                                            OPs5j7Yjb8.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                            • 156.67.72.41
                                                            52cMXV8Al2.elfGet hashmaliciousMiraiBrowse
                                                            • 156.67.72.45
                                                            mips.elfGet hashmaliciousMirai, MoobotBrowse
                                                            • 195.158.206.227
                                                            TAVMCtVXa5.exeGet hashmaliciousUnknownBrowse
                                                            • 156.67.72.10
                                                            kn328E7C2B.exeGet hashmaliciousLummaC, Glupteba, LummaC Stealer, SmokeLoader, StealcBrowse
                                                            • 156.67.71.68
                                                            #U0111#U01a1n h#U00e0ng m#U1edbi pdf.exeGet hashmaliciousFormBookBrowse
                                                            • 156.67.71.229
                                                            0jwySdaiGH.exeGet hashmaliciousFormBookBrowse
                                                            • 156.67.71.229
                                                            AMAZON-02UShttps://updatingftsmkkoogjjjgjjhikvesdreal-vercel-app.translate.goog/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp#c2VydmljZS5uYUBnZWxpdGEuY29tGet hashmaliciousHtmlDropperBrowse
                                                            • 76.76.21.241
                                                            https://quicknitro.shop/Get hashmaliciousHTMLPhisherBrowse
                                                            • 76.76.21.22
                                                            https://url-shield.securence.com/?p=1.0&r=vic@brodtinsurance.com&sid=1722373351257-084-00215276&s=2cgbtu52&n=bsecxhls3&ms=0.1,0.1,0.0,0.0&u=https%3A%2F%2Fhihello.me%2Fp%2F8e6a4dfa-7e69-4649-8591-556374951f64%3Fsharer_id%3DrmwO6QfrRwZg9SBrgXYDqyYh0l12Get hashmaliciousUnknownBrowse
                                                            • 34.215.17.89
                                                            https://jobsnearmeusa.com/Exit?adgroupid=109677066428&adposition=&campaignid=10045193036&creative=487634015749&device=c&feeditemid=&keyword=clasificado&loc_interest_ms=&loc_physical_ms=9007454&matchtype=b&placement=&q=clasificado&targetid=kwd-24416206&utm_campaign=10045193036_109677066428&utm_content=487634015749&utm_medium=cpc&utm_source=google-sem&utm_term=clasificadoGet hashmaliciousUnknownBrowse
                                                            • 3.165.190.78
                                                            https://book.hotel-48581.eu/service/99012Get hashmaliciousUnknownBrowse
                                                            • 18.239.69.49
                                                            https://mtqr.me/springlakeboro.Get hashmaliciousHTMLPhisherBrowse
                                                            • 18.239.18.36
                                                            https://secure.bookipi.com/bpay/pay/66a8a106a4b309d1b595d02f/loadingGet hashmaliciousUnknownBrowse
                                                            • 13.224.189.74
                                                            https://ik.imagekit.io/f8tu20hqk/dgdeztgrse5te45tw3w6ye5yhrdgbsdegsz.html?updatedAt=073921461586027101#ooxlYIqzDwtkOwQUESuFYrjhhPqjkP&4RLApFDgnXu&130182/227/ktzqgzfxkc.home.php?sq=1570-397727&lk=256825-14&page=955Get hashmaliciousUnknownBrowse
                                                            • 65.9.7.21
                                                            r777528623004-FedEx-Shipping-Label.exeGet hashmaliciousFormBookBrowse
                                                            • 44.227.76.166
                                                            https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-6.0.16-signed.msiGet hashmaliciousUnknownBrowse
                                                            • 52.217.227.120

                                                            JA3 Fingerprints

                                                            ⊘No context

                                                            Dropped Files

                                                            ⊘No context

                                                            Created / dropped Files

                                                            C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ticari Siparis Belgesi 26 07 2024 17545000600.exe.log

                                                            Download File
                                                            Process:C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe
                                                            File Type:ASCII text, with CRLF line terminators
                                                            Category:dropped
                                                            Size (bytes):1216
                                                            Entropy (8bit):5.34331486778365
                                                            Encrypted:false
                                                            SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                            MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                            SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                            SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                            SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                            Malicious:true
                                                            Reputation:high, very likely benign file
                                                            Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Download File
                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):1172
                                                            Entropy (8bit):5.357042452875322
                                                            Encrypted:false
                                                            SSDEEP:24:3CytZWSKco4KmZjKbm51s4RPT6moUebIKo+mZ9t7J0gt/NKIl9r+q:yyjWSU4xymI4RfoUeW+mZ9tK8ND3
                                                            MD5:827C68C8F65D2B0800E6791B34AB6D2E
                                                            SHA1:151BC96F9C26C53E02D2E0DA64995A462D0C3B4E
                                                            SHA-256:6B22A727792EC2ACE1BC27BF00BECBBD842902F2FD0FC813CF45A21A986377D5
                                                            SHA-512:67E9E89C531B2CDF47FCBBA3F036EA66427631A8EBF287A26DD35AFB114AF6E2D945304CBF72B94358245FEED658F9BA6E19B29879AE6488D8DC7A143DCC146D
                                                            Malicious:false
                                                            Reputation:moderate, very likely benign file
                                                            Preview:@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxj5slfx.zvi.ps1

                                                            Download File
                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gf5ejnxc.nnp.psm1

                                                            Download File
                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2q4x0gu.y4z.ps1

                                                            Download File
                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xqtkt5qd.heg.psm1

                                                            Download File
                                                            Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            Static File Info

                                                            General

                                                            File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                            Entropy (8bit):7.973060700650944
                                                            TrID:
                                                            • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                            • Win32 Executable (generic) a (10002005/4) 49.78%
                                                            • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                            • Generic Win/DOS Executable (2004/3) 0.01%
                                                            • DOS Executable Generic (2002/1) 0.01%
                                                            File name:Ticari Siparis Belgesi 26 07 2024 17545000600.exe
                                                            File size:572'928 bytes
                                                            MD5:4a699c45efa52f13210361413ebd9358
                                                            SHA1:4243cc3717a371b2fdf4a7eb0387ea3b19a62764
                                                            SHA256:078b3704bde85e8ad84e4c21ca910f5d5367843bbecc2a384acc3fd89cd3553c
                                                            SHA512:376fa8883301ecf050277c9e4eeeb902f1cab14902bbedd0366918e5c4f010b1e83a00c641f00cb27d2fbd0e61c9dc278b59b553264682cc572dd36a3a246ed9
                                                            SSDEEP:12288:CLHaT8l/bECvA5LWZv31r3KXDtlv0eKpXcyoEFvR9FOv4Qx11:2aTC/bECvA5LWZv31r3gDtlcexENR9Fo
                                                            TLSH:74C423592E11CB78E66D3B7060E1C56103FA61A76ABBDF9C2CD420FC6E937014249F6B
                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0.............~.... ........@.. ....................... ............@................................

                                                            File Icon

                                                            Icon Hash:00928e8e8686b000

                                                            Static PE Info

                                                            General

                                                            Entrypoint:0x48d37e
                                                            Entrypoint Section:.text
                                                            Digitally signed:false
                                                            Imagebase:0x400000
                                                            Subsystem:windows gui
                                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                            Time Stamp:0x66A38513 [Fri Jul 26 11:14:27 2024 UTC]
                                                            TLS Callbacks:
                                                            CLR (.Net) Version:
                                                            OS Version Major:4
                                                            OS Version Minor:0
                                                            File Version Major:4
                                                            File Version Minor:0
                                                            Subsystem Version Major:4
                                                            Subsystem Version Minor:0
                                                            Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                            Entrypoint Preview

                                                            Instruction
                                                            jmp dword ptr [00402000h]
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al
                                                            add byte ptr [eax], al

                                                            Data Directories

                                                            NameVirtual AddressVirtual Size Is in Section
                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x8d3290x4f.text
                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x8e0000x5ac.rsrc
                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x900000xc.reloc
                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x8b9b40x54.text
                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                            Sections

                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                            .text0x20000x8b3840x8b40051c763ef7453d4faf0b14c36b7901c74False0.9733242397890485data7.978982023106639IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                            .rsrc0x8e0000x5ac0x60032207b233eed35f842d52c9b59e1b50fFalse0.4225260416666667data4.088954389995029IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .reloc0x900000xc0x2008d0543ad246b806bacabf90763763818False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                            Resources

                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                            RT_VERSION0x8e0900x31cdata0.43467336683417085
                                                            RT_MANIFEST0x8e3bc0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                            Imports

                                                            DLLImport
                                                            mscoree.dll_CorExeMain

                                                            Network Behavior

                                                            Suricata IDS Alerts

                                                            TimestampProtocolSIDSignatureSource PortDest PortSource IPDest IP
                                                            2024-07-31T16:01:32.709233+0200TCP2031453ET MALWARE FormBook CnC Checkin (GET)5219480192.168.2.5104.21.80.197
                                                            2024-07-31T16:02:34.625397+0200TCP2031453ET MALWARE FormBook CnC Checkin (GET)5219780192.168.2.5188.114.96.3
                                                            2024-07-31T16:02:15.959407+0200TCP2031453ET MALWARE FormBook CnC Checkin (GET)5219680192.168.2.538.239.1.118
                                                            2024-07-31T15:59:29.688565+0200TCP2031453ET MALWARE FormBook CnC Checkin (GET)5219180192.168.2.5207.241.198.3
                                                            2024-07-31T16:01:53.574872+0200TCP2031453ET MALWARE FormBook CnC Checkin (GET)5219580192.168.2.575.101.134.27
                                                            2024-07-31T16:01:12.188977+0200TCP2031453ET MALWARE FormBook CnC Checkin (GET)5219380192.168.2.5213.139.204.22
                                                            2024-07-31T16:00:51.151727+0200TCP2031453ET MALWARE FormBook CnC Checkin (GET)5219280192.168.2.5185.148.106.70
                                                            2024-07-31T15:58:50.266265+0200TCP2031453ET MALWARE FormBook CnC Checkin (GET)5218880192.168.2.5108.157.194.11

                                                            Network Port Distribution

                                                            TCP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Jul 31, 2024 15:58:49.756529093 CEST5218880192.168.2.5108.157.194.11
                                                            Jul 31, 2024 15:58:49.762644053 CEST8052188108.157.194.11192.168.2.5
                                                            Jul 31, 2024 15:58:49.762742996 CEST5218880192.168.2.5108.157.194.11
                                                            Jul 31, 2024 15:58:49.762784004 CEST5218880192.168.2.5108.157.194.11
                                                            Jul 31, 2024 15:58:49.769277096 CEST8052188108.157.194.11192.168.2.5
                                                            Jul 31, 2024 15:58:50.260117054 CEST5218880192.168.2.5108.157.194.11
                                                            Jul 31, 2024 15:58:50.266177893 CEST8052188108.157.194.11192.168.2.5
                                                            Jul 31, 2024 15:58:50.266264915 CEST5218880192.168.2.5108.157.194.11
                                                            Jul 31, 2024 15:59:29.186983109 CEST5219180192.168.2.5207.241.198.3
                                                            Jul 31, 2024 15:59:29.192287922 CEST8052191207.241.198.3192.168.2.5
                                                            Jul 31, 2024 15:59:29.192382097 CEST5219180192.168.2.5207.241.198.3
                                                            Jul 31, 2024 15:59:29.192430973 CEST5219180192.168.2.5207.241.198.3
                                                            Jul 31, 2024 15:59:29.197359085 CEST8052191207.241.198.3192.168.2.5
                                                            Jul 31, 2024 15:59:29.682009935 CEST5219180192.168.2.5207.241.198.3
                                                            Jul 31, 2024 15:59:29.688510895 CEST8052191207.241.198.3192.168.2.5
                                                            Jul 31, 2024 15:59:29.688565016 CEST5219180192.168.2.5207.241.198.3
                                                            Jul 31, 2024 16:00:50.668615103 CEST5219280192.168.2.5185.148.106.70
                                                            Jul 31, 2024 16:00:50.675534964 CEST8052192185.148.106.70192.168.2.5
                                                            Jul 31, 2024 16:00:50.675618887 CEST5219280192.168.2.5185.148.106.70
                                                            Jul 31, 2024 16:00:50.675733089 CEST5219280192.168.2.5185.148.106.70
                                                            Jul 31, 2024 16:00:50.681349039 CEST8052192185.148.106.70192.168.2.5
                                                            Jul 31, 2024 16:00:51.148498058 CEST8052192185.148.106.70192.168.2.5
                                                            Jul 31, 2024 16:00:51.148746967 CEST5219280192.168.2.5185.148.106.70
                                                            Jul 31, 2024 16:00:51.149961948 CEST8052192185.148.106.70192.168.2.5
                                                            Jul 31, 2024 16:00:51.151726961 CEST5219280192.168.2.5185.148.106.70
                                                            Jul 31, 2024 16:00:51.153522015 CEST8052192185.148.106.70192.168.2.5

                                                            UDP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Jul 31, 2024 15:58:36.064492941 CEST5356517162.159.36.2192.168.2.5
                                                            Jul 31, 2024 15:58:36.679088116 CEST5679653192.168.2.51.1.1.1
                                                            Jul 31, 2024 15:58:36.687817097 CEST53567961.1.1.1192.168.2.5
                                                            Jul 31, 2024 15:58:49.542361021 CEST6543853192.168.2.51.1.1.1
                                                            Jul 31, 2024 15:58:49.755422115 CEST53654381.1.1.1192.168.2.5
                                                            Jul 31, 2024 15:59:08.260679007 CEST5754353192.168.2.51.1.1.1
                                                            Jul 31, 2024 15:59:08.270699978 CEST53575431.1.1.1192.168.2.5
                                                            Jul 31, 2024 15:59:28.855667114 CEST6489553192.168.2.51.1.1.1
                                                            Jul 31, 2024 15:59:29.186208963 CEST53648951.1.1.1192.168.2.5
                                                            Jul 31, 2024 15:59:49.009880066 CEST5998453192.168.2.51.1.1.1
                                                            Jul 31, 2024 15:59:49.020596981 CEST53599841.1.1.1192.168.2.5
                                                            Jul 31, 2024 16:00:30.198699951 CEST6501853192.168.2.51.1.1.1
                                                            Jul 31, 2024 16:00:30.548365116 CEST53650181.1.1.1192.168.2.5
                                                            Jul 31, 2024 16:00:50.627090931 CEST5616153192.168.2.51.1.1.1
                                                            Jul 31, 2024 16:00:50.639444113 CEST53561611.1.1.1192.168.2.5
                                                            Jul 31, 2024 16:01:11.354378939 CEST5315153192.168.2.51.1.1.1
                                                            Jul 31, 2024 16:01:11.639980078 CEST53531511.1.1.1192.168.2.5
                                                            Jul 31, 2024 16:01:32.012541056 CEST5131153192.168.2.51.1.1.1
                                                            Jul 31, 2024 16:01:32.061033964 CEST53513111.1.1.1192.168.2.5
                                                            Jul 31, 2024 16:01:52.651820898 CEST6112453192.168.2.51.1.1.1
                                                            Jul 31, 2024 16:01:52.971532106 CEST53611241.1.1.1192.168.2.5
                                                            Jul 31, 2024 16:02:14.830511093 CEST6145253192.168.2.51.1.1.1
                                                            Jul 31, 2024 16:02:15.374789000 CEST53614521.1.1.1192.168.2.5
                                                            Jul 31, 2024 16:02:34.026571989 CEST6483053192.168.2.51.1.1.1
                                                            Jul 31, 2024 16:02:34.075836897 CEST53648301.1.1.1192.168.2.5

                                                            DNS Queries

                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                            Jul 31, 2024 15:58:36.679088116 CEST192.168.2.51.1.1.10xcbf0Standard query (0)15.164.165.52.in-addr.arpaPTR (Pointer record)IN (0x0001)false
                                                            Jul 31, 2024 15:58:49.542361021 CEST192.168.2.51.1.1.10x260cStandard query (0)www.datalakeflow.comA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 15:59:08.260679007 CEST192.168.2.51.1.1.10xa398Standard query (0)www.xcxocef.shopA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 15:59:28.855667114 CEST192.168.2.51.1.1.10x8b2Standard query (0)www.chalkandthimble.comA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 15:59:49.009880066 CEST192.168.2.51.1.1.10xfbe5Standard query (0)www.xiangadvanced.siteA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:00:30.198699951 CEST192.168.2.51.1.1.10xdbbcStandard query (0)www.317wb.comA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:00:50.627090931 CEST192.168.2.51.1.1.10x50b3Standard query (0)www.loyalbahis356.comA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:01:11.354378939 CEST192.168.2.51.1.1.10x8d65Standard query (0)www.aromacuppa.comA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:01:32.012541056 CEST192.168.2.51.1.1.10x7bccStandard query (0)www.autonwheels.comA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:01:52.651820898 CEST192.168.2.51.1.1.10xc09bStandard query (0)www.vanessasmobilespa.comA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:02:14.830511093 CEST192.168.2.51.1.1.10x50d8Standard query (0)www.98980901.comA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:02:34.026571989 CEST192.168.2.51.1.1.10xb2bfStandard query (0)www.jnhdh8827.comA (IP address)IN (0x0001)false

                                                            DNS Answers

                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                            Jul 31, 2024 15:58:36.687817097 CEST1.1.1.1192.168.2.50xcbf0Name error (3)15.164.165.52.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false
                                                            Jul 31, 2024 15:58:49.755422115 CEST1.1.1.1192.168.2.50x260cNo error (0)www.datalakeflow.comd1qrjwiza3wzm5.cloudfront.netCNAME (Canonical name)IN (0x0001)false
                                                            Jul 31, 2024 15:58:49.755422115 CEST1.1.1.1192.168.2.50x260cNo error (0)d1qrjwiza3wzm5.cloudfront.net108.157.194.11A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 15:58:49.755422115 CEST1.1.1.1192.168.2.50x260cNo error (0)d1qrjwiza3wzm5.cloudfront.net108.157.194.128A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 15:58:49.755422115 CEST1.1.1.1192.168.2.50x260cNo error (0)d1qrjwiza3wzm5.cloudfront.net108.157.194.119A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 15:58:49.755422115 CEST1.1.1.1192.168.2.50x260cNo error (0)d1qrjwiza3wzm5.cloudfront.net108.157.194.89A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 15:59:08.270699978 CEST1.1.1.1192.168.2.50xa398Name error (3)www.xcxocef.shopnonenoneA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 15:59:29.186208963 CEST1.1.1.1192.168.2.50x8b2No error (0)www.chalkandthimble.comchalkandthimble.comCNAME (Canonical name)IN (0x0001)false
                                                            Jul 31, 2024 15:59:29.186208963 CEST1.1.1.1192.168.2.50x8b2No error (0)chalkandthimble.com207.241.198.3A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 15:59:49.020596981 CEST1.1.1.1192.168.2.50xfbe5Name error (3)www.xiangadvanced.sitenonenoneA (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:00:50.639444113 CEST1.1.1.1192.168.2.50x50b3No error (0)www.loyalbahis356.com185.148.106.70A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:00:50.639444113 CEST1.1.1.1192.168.2.50x50b3No error (0)www.loyalbahis356.com185.148.106.71A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:01:11.639980078 CEST1.1.1.1192.168.2.50x8d65No error (0)www.aromacuppa.comaromacuppa.comCNAME (Canonical name)IN (0x0001)false
                                                            Jul 31, 2024 16:01:11.639980078 CEST1.1.1.1192.168.2.50x8d65No error (0)aromacuppa.com213.139.204.22A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:01:32.061033964 CEST1.1.1.1192.168.2.50x7bccNo error (0)www.autonwheels.com104.21.80.197A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:01:32.061033964 CEST1.1.1.1192.168.2.50x7bccNo error (0)www.autonwheels.com172.67.153.101A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:01:52.971532106 CEST1.1.1.1192.168.2.50xc09bNo error (0)www.vanessasmobilespa.comvanessasmobilespa.comCNAME (Canonical name)IN (0x0001)false
                                                            Jul 31, 2024 16:01:52.971532106 CEST1.1.1.1192.168.2.50xc09bNo error (0)vanessasmobilespa.com75.101.134.27A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:02:15.374789000 CEST1.1.1.1192.168.2.50x50d8No error (0)www.98980901.com38.239.1.118A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:02:34.075836897 CEST1.1.1.1192.168.2.50xb2bfNo error (0)www.jnhdh8827.com188.114.96.3A (IP address)IN (0x0001)false
                                                            Jul 31, 2024 16:02:34.075836897 CEST1.1.1.1192.168.2.50xb2bfNo error (0)www.jnhdh8827.com188.114.97.3A (IP address)IN (0x0001)false

                                                            HTTP Request Dependency Graph

                                                            • www.datalakeflow.com
                                                            • www.chalkandthimble.com
                                                            • www.loyalbahis356.com

                                                            HTTP Packets

                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            0192.168.2.552188108.157.194.11801028C:\Windows\explorer.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 31, 2024 15:58:49.762784004 CEST168OUTGET /pz12/?XvRxR=rTfdhh5hH2&NBtT=XLxih9erqU5OQ/zVa2U9uayzQwvQYqwD+iUwcFTJkQJbXUUHI+Ws7VPKfbblI2vONd0o HTTP/1.1
                                                            Host: www.datalakeflow.com
                                                            Connection: close
                                                            Data Raw: 00 00 00 00 00 00 00
                                                            Data Ascii:


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            1192.168.2.552191207.241.198.3801028C:\Windows\explorer.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 31, 2024 15:59:29.192430973 CEST171OUTGET /pz12/?XvRxR=rTfdhh5hH2&NBtT=9hrk18skSQhCCsrWhUPNj3yaKA8UlZiY5Un3cfGqWer7qRPGp2VeMQg9udTNeDooaK7+ HTTP/1.1
                                                            Host: www.chalkandthimble.com
                                                            Connection: close
                                                            Data Raw: 00 00 00 00 00 00 00
                                                            Data Ascii:


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            2192.168.2.552192185.148.106.70801028C:\Windows\explorer.exe
                                                            TimestampBytes transferredDirectionData
                                                            Jul 31, 2024 16:00:50.675733089 CEST169OUTGET /pz12/?XvRxR=rTfdhh5hH2&NBtT=mhHbh1AUgvkDqhcxvrHPgmJxw//lx/+38lrQrf/b9xTaJsLm+Z3/RBaY9L1MEhp7dpaA HTTP/1.1
                                                            Host: www.loyalbahis356.com
                                                            Connection: close
                                                            Data Raw: 00 00 00 00 00 00 00
                                                            Data Ascii:
                                                            Jul 31, 2024 16:00:51.148498058 CEST925INHTTP/1.1 301 Moved Permanently
                                                            Date: Wed, 31 Jul 2024 14:00:51 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 167
                                                            Connection: close
                                                            Cache-Control: max-age=3600
                                                            Expires: Wed, 31 Jul 2024 15:00:51 GMT
                                                            Location: https://loyalbahis356.com/pz12/?XvRxR=rTfdhh5hH2&NBtT=mhHbh1AUgvkDqhcxvrHPgmJxw//lx/+38lrQrf/b9xTaJsLm+Z3/RBaY9L1MEhp7dpaA
                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P%2By8jadAxcbJYBTFYLK8jDXIL1B9DTcVQFUVU%2B8LeE065%2BE2ejWnXDOiK5ec6aLtQjD7KOl14Kb8qlLPKeN2Xk%2F9%2BuygdbCoaJ9DIaCgWbLVj96vHc%2F6gqVjLBEjWEB5x4qHpfoZbfQ%3D"}],"group":"cf-nel","max_age":604800}
                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                            Server: cloudflare
                                                            CF-RAY: 8abe1df74dbf0c74-EWR
                                                            alt-svc: h3=":443"; ma=86400
                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                            Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>


                                                            Statistics

                                                            CPU Usage

                                                            Click to jump to process

                                                            Memory Usage

                                                            Click to jump to process

                                                            High Level Behavior Distribution

                                                            Click to dive into process behavior distribution

                                                            Behavior

                                                            Click to jump to process

                                                            System Behavior

                                                            General

                                                            Target ID:0
                                                            Start time:09:58:05
                                                            Start date:31/07/2024
                                                            Path:C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"
                                                            Imagebase:0x6d0000
                                                            File size:572'928 bytes
                                                            MD5 hash:4A699C45EFA52F13210361413EBD9358
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                            • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.2128443100.0000000003A29000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:3
                                                            Start time:09:58:10
                                                            Start date:31/07/2024
                                                            Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"
                                                            Imagebase:0x7b0000
                                                            File size:433'152 bytes
                                                            MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:4
                                                            Start time:09:58:10
                                                            Start date:31/07/2024
                                                            Path:C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"
                                                            Imagebase:0xf0000
                                                            File size:572'928 bytes
                                                            MD5 hash:4A699C45EFA52F13210361413EBD9358
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:5
                                                            Start time:09:58:10
                                                            Start date:31/07/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff6d64d0000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:6
                                                            Start time:09:58:10
                                                            Start date:31/07/2024
                                                            Path:C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"
                                                            Imagebase:0x7c0000
                                                            File size:572'928 bytes
                                                            MD5 hash:4A699C45EFA52F13210361413EBD9358
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                            • Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:7
                                                            Start time:09:58:10
                                                            Start date:31/07/2024
                                                            Path:C:\Windows\explorer.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\Explorer.EXE
                                                            Imagebase:0x7ff674740000
                                                            File size:5'141'208 bytes
                                                            MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: Windows_Trojan_Formbook_772cc62d, Description: unknown, Source: 00000007.00000002.4556728675.000000001047C000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                            Reputation:high
                                                            Has exited:false

                                                            General

                                                            Target ID:8
                                                            Start time:09:58:13
                                                            Start date:31/07/2024
                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\SysWOW64\cmd.exe"
                                                            Imagebase:0x790000
                                                            File size:236'544 bytes
                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                            • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.4539184982.0000000002ED0000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                            • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                            • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                            • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                            • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                            • Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000002.4539570666.0000000003250000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                            Reputation:high
                                                            Has exited:false

                                                            General

                                                            Target ID:9
                                                            Start time:09:58:16
                                                            Start date:31/07/2024
                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:/c del "C:\Users\user\Desktop\Ticari Siparis Belgesi 26 07 2024 17545000600.exe"
                                                            Imagebase:0x790000
                                                            File size:236'544 bytes
                                                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:10
                                                            Start time:09:58:16
                                                            Start date:31/07/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff6d64d0000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            Disassembly

                                                            Reset < >

                                                              Execution Graph

                                                              Execution Coverage:10.1%
                                                              Dynamic/Decrypted Code Coverage:100%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:208
                                                              Total number of Limit Nodes:12
                                                              execution_graph 39428 10a4668 39429 10a467a 39428->39429 39430 10a4686 39429->39430 39432 10a4778 39429->39432 39433 10a479d 39432->39433 39437 10a4888 39433->39437 39441 10a4879 39433->39441 39439 10a48af 39437->39439 39438 10a498c 39438->39438 39439->39438 39445 10a44c4 39439->39445 39442 10a48af 39441->39442 39443 10a44c4 CreateActCtxA 39442->39443 39444 10a498c 39442->39444 39443->39444 39446 10a5918 CreateActCtxA 39445->39446 39448 10a59db 39446->39448 39200 6f9d5f0 39201 6f9d77b 39200->39201 39203 6f9d616 39200->39203 39203->39201 39204 6f9d0d0 39203->39204 39205 6f9d870 PostMessageW 39204->39205 39206 6f9d8dc 39205->39206 39206->39203 39207 6f9b0b3 39208 6f9b0bd 39207->39208 39209 6f9b044 39207->39209 39213 6f9bea8 39208->39213 39231 6f9bf0e 39208->39231 39250 6f9be98 39208->39250 39214 6f9bec2 39213->39214 39215 6f9beca 39214->39215 39268 6f9c2fa 39214->39268 39273 6f9c386 39214->39273 39278 6f9c2e4 39214->39278 39283 6f9c945 39214->39283 39288 6f9c40f 39214->39288 39293 6f9c84a 39214->39293 39298 6f9c3c8 39214->39298 39306 6f9c8b5 39214->39306 39311 6f9c9d5 39214->39311 39316 6f9c7f0 39214->39316 39320 6f9c391 39214->39320 39328 6f9c6f1 39214->39328 39333 6f9c5de 39214->39333 39338 6f9c4ff 39214->39338 39343 6f9c65d 39214->39343 39215->39209 39232 6f9be9c 39231->39232 39233 6f9bf11 39231->39233 39234 6f9beca 39232->39234 39235 6f9c2fa 2 API calls 39232->39235 39236 6f9c65d 2 API calls 39232->39236 39237 6f9c4ff 2 API calls 39232->39237 39238 6f9c5de 2 API calls 39232->39238 39239 6f9c6f1 2 API calls 39232->39239 39240 6f9c391 4 API calls 39232->39240 39241 6f9c7f0 2 API calls 39232->39241 39242 6f9c9d5 2 API calls 39232->39242 39243 6f9c8b5 2 API calls 39232->39243 39244 6f9c3c8 2 API calls 39232->39244 39245 6f9c84a 2 API calls 39232->39245 39246 6f9c40f 2 API calls 39232->39246 39247 6f9c945 2 API calls 39232->39247 39248 6f9c2e4 2 API calls 39232->39248 39249 6f9c386 2 API calls 39232->39249 39233->39209 39234->39209 39235->39234 39236->39234 39237->39234 39238->39234 39239->39234 39240->39234 39241->39234 39242->39234 39243->39234 39244->39234 39245->39234 39246->39234 39247->39234 39248->39234 39249->39234 39251 6f9bea8 39250->39251 39252 6f9beca 39251->39252 39253 6f9c2fa 2 API calls 39251->39253 39254 6f9c65d 2 API calls 39251->39254 39255 6f9c4ff 2 API calls 39251->39255 39256 6f9c5de 2 API calls 39251->39256 39257 6f9c6f1 2 API calls 39251->39257 39258 6f9c391 4 API calls 39251->39258 39259 6f9c7f0 2 API calls 39251->39259 39260 6f9c9d5 2 API calls 39251->39260 39261 6f9c8b5 2 API calls 39251->39261 39262 6f9c3c8 2 API calls 39251->39262 39263 6f9c84a 2 API calls 39251->39263 39264 6f9c40f 2 API calls 39251->39264 39265 6f9c945 2 API calls 39251->39265 39266 6f9c2e4 2 API calls 39251->39266 39267 6f9c386 2 API calls 39251->39267 39252->39209 39253->39252 39254->39252 39255->39252 39256->39252 39257->39252 39258->39252 39259->39252 39260->39252 39261->39252 39262->39252 39263->39252 39264->39252 39265->39252 39266->39252 39267->39252 39270 6f9c2ed 39268->39270 39269 6f9cbd4 39269->39215 39270->39269 39348 6f9ac28 39270->39348 39352 6f9ac1c 39270->39352 39274 6f9c37c 39273->39274 39275 6f9c38e 39274->39275 39356 6f9a998 39274->39356 39360 6f9a9a0 39274->39360 39275->39215 39279 6f9c2ed 39278->39279 39280 6f9cbd4 39279->39280 39281 6f9ac28 CreateProcessA 39279->39281 39282 6f9ac1c CreateProcessA 39279->39282 39280->39215 39281->39279 39282->39279 39284 6f9c953 39283->39284 39286 6f9a998 WriteProcessMemory 39284->39286 39287 6f9a9a0 WriteProcessMemory 39284->39287 39285 6f9c98c 39286->39285 39287->39285 39289 6f9c438 39288->39289 39290 6f9c6ae 39289->39290 39364 6f9a3cf 39289->39364 39368 6f9a3d0 39289->39368 39290->39215 39294 6f9c85f 39293->39294 39296 6f9a998 WriteProcessMemory 39294->39296 39297 6f9a9a0 WriteProcessMemory 39294->39297 39295 6f9c98c 39296->39295 39297->39295 39299 6f9c3eb 39298->39299 39304 6f9a998 WriteProcessMemory 39299->39304 39305 6f9a9a0 WriteProcessMemory 39299->39305 39300 6f9c38e 39300->39215 39301 6f9c37c 39301->39300 39302 6f9a998 WriteProcessMemory 39301->39302 39303 6f9a9a0 WriteProcessMemory 39301->39303 39302->39301 39303->39301 39304->39301 39305->39301 39307 6f9c8de 39306->39307 39372 6f9a318 39307->39372 39376 6f9a320 39307->39376 39308 6f9cba8 39312 6f9c37c 39311->39312 39313 6f9c38e 39312->39313 39314 6f9a998 WriteProcessMemory 39312->39314 39315 6f9a9a0 WriteProcessMemory 39312->39315 39313->39215 39314->39312 39315->39312 39317 6f9c802 39316->39317 39380 6f9a8d9 39317->39380 39384 6f9a8e0 39317->39384 39321 6f9c399 39320->39321 39322 6f9c4a6 39321->39322 39326 6f9a3cf Wow64SetThreadContext 39321->39326 39327 6f9a3d0 Wow64SetThreadContext 39321->39327 39324 6f9a318 ResumeThread 39322->39324 39325 6f9a320 ResumeThread 39322->39325 39323 6f9cba8 39324->39323 39325->39323 39326->39321 39327->39321 39329 6f9c6f7 39328->39329 39388 6f9aa88 39329->39388 39392 6f9aa90 39329->39392 39330 6f9c71a 39334 6f9c5fe 39333->39334 39336 6f9a318 ResumeThread 39334->39336 39337 6f9a320 ResumeThread 39334->39337 39335 6f9cba8 39336->39335 39337->39335 39339 6f9c37c 39338->39339 39339->39338 39340 6f9c38e 39339->39340 39341 6f9a998 WriteProcessMemory 39339->39341 39342 6f9a9a0 WriteProcessMemory 39339->39342 39340->39215 39341->39339 39342->39339 39344 6f9c438 39343->39344 39345 6f9c6ae 39344->39345 39346 6f9a3cf Wow64SetThreadContext 39344->39346 39347 6f9a3d0 Wow64SetThreadContext 39344->39347 39345->39215 39346->39344 39347->39344 39349 6f9acb1 CreateProcessA 39348->39349 39351 6f9ae73 39349->39351 39353 6f9ac28 CreateProcessA 39352->39353 39355 6f9ae73 39353->39355 39357 6f9a9a0 WriteProcessMemory 39356->39357 39359 6f9aa3f 39357->39359 39359->39274 39361 6f9a9e8 WriteProcessMemory 39360->39361 39363 6f9aa3f 39361->39363 39363->39274 39365 6f9a3d0 Wow64SetThreadContext 39364->39365 39367 6f9a45d 39365->39367 39367->39289 39369 6f9a415 Wow64SetThreadContext 39368->39369 39371 6f9a45d 39369->39371 39371->39289 39373 6f9a320 ResumeThread 39372->39373 39375 6f9a391 39373->39375 39375->39308 39377 6f9a360 ResumeThread 39376->39377 39379 6f9a391 39377->39379 39379->39308 39381 6f9a8e0 VirtualAllocEx 39380->39381 39383 6f9a95d 39381->39383 39383->39317 39385 6f9a920 VirtualAllocEx 39384->39385 39387 6f9a95d 39385->39387 39387->39317 39389 6f9aa90 ReadProcessMemory 39388->39389 39391 6f9ab1f 39389->39391 39391->39330 39393 6f9aadb ReadProcessMemory 39392->39393 39395 6f9ab1f 39393->39395 39395->39330 39396 10aacd0 39397 10aacdf 39396->39397 39400 10aadc8 39396->39400 39408 10aadb7 39396->39408 39401 10aadd9 39400->39401 39402 10aadfc 39400->39402 39401->39402 39416 10ab060 39401->39416 39420 10ab051 39401->39420 39402->39397 39403 10aadf4 39403->39402 39404 10ab000 GetModuleHandleW 39403->39404 39405 10ab02d 39404->39405 39405->39397 39409 10aadd9 39408->39409 39410 10aadfc 39408->39410 39409->39410 39414 10ab060 LoadLibraryExW 39409->39414 39415 10ab051 LoadLibraryExW 39409->39415 39410->39397 39411 10aadf4 39411->39410 39412 10ab000 GetModuleHandleW 39411->39412 39413 10ab02d 39412->39413 39413->39397 39414->39411 39415->39411 39418 10ab074 39416->39418 39417 10ab099 39417->39403 39418->39417 39424 10aa150 39418->39424 39422 10ab060 39420->39422 39421 10ab099 39421->39403 39422->39421 39423 10aa150 LoadLibraryExW 39422->39423 39423->39421 39426 10ab240 LoadLibraryExW 39424->39426 39427 10ab2b9 39426->39427 39427->39417 39449 10ad060 39450 10ad0a6 39449->39450 39454 10ad638 39450->39454 39457 10ad648 39450->39457 39451 10ad193 39460 10ad29c 39454->39460 39458 10ad676 39457->39458 39459 10ad29c DuplicateHandle 39457->39459 39458->39451 39459->39458 39461 10ad6b0 DuplicateHandle 39460->39461 39462 10ad676 39461->39462 39462->39451 39463 4fd4040 39464 4fd4082 39463->39464 39465 4fd4089 39463->39465 39464->39465 39466 4fd40da CallWindowProcW 39464->39466 39466->39465

                                                              Executed Functions

                                                              Function 06F94128 Relevance: 2.7, Strings: 2, Instructions: 187COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 698 6f94128-6f9415b 699 6f9415d 698->699 700 6f94162-6f94344 698->700 699->700 738 6f94301 call 6f948f8 700->738 739 6f94301 call 6f948e8 700->739 712 6f94307-6f94308 call 6f940a0 717 6f941eb-6f941ec 712->717 718 6f941ad-6f941b2 712->718 717->718 720 6f941c4-6f941c5 718->720 721 6f941b4-6f941b5 718->721 722 6f941b7-6f941bb 720->722 721->720 723 6f942aa-6f942bf 722->723 724 6f941c1-6f9425e 722->724 723->722 735 6f94260 call 6f9527a 724->735 736 6f94260 call 6f94f80 724->736 737 6f94260 call 6f94f73 724->737 734 6f94266-6f94270 735->734 736->734 737->734 738->712 739->712
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Te]q$Te]q
                                                              • API String ID: 0-3320153681
                                                              • Opcode ID: 1de5b68f35c6db134d65216235f05ed715c92840512c79e5a01517f0af32902c
                                                              • Instruction ID: 6c2f899117fffb81e5aa4459e8747e7a12f8b795b2fb9bf3218c9bbb471b08c0
                                                              • Opcode Fuzzy Hash: 1de5b68f35c6db134d65216235f05ed715c92840512c79e5a01517f0af32902c
                                                              • Instruction Fuzzy Hash: 7C71E275E04218CFEF48CFA9C884AEDBBF6BF99300F20902AD519AB355D7345946CB60
                                                              Function 04FD7BB8 Relevance: 2.5, Strings: 1, Instructions: 1211COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 799 4fd7bb8-4fd7be3 800 4fd7bea-4fd8280 call 4fd729c call 4fd72ac call 4fd72bc * 2 call 4fd72cc call 4fd72bc call 4fd72cc call 4fd72dc call 4fd72ec call 4fd72fc call 4fd730c call 4fd77a4 call 4fd77b4 call 4fd77c4 call 4fd77d4 call 4fd77e4 call 4fd77f4 call 4fd730c call 4fd77a4 call 4fd77d4 call 4fd77e4 799->800 801 4fd7be5 799->801 892 4fd82aa 800->892 893 4fd8282-4fd828e 800->893 801->800 896 4fd82b0-4fd8440 call 4fd7804 call 4fd7814 call 4fd7824 892->896 894 4fd8298-4fd829e 893->894 895 4fd8290-4fd8296 893->895 897 4fd82a8 894->897 895->897 914 4fd846a 896->914 915 4fd8442-4fd844e 896->915 897->896 918 4fd8470-4fd8552 call 4fd7804 call 4fd7814 914->918 916 4fd8458-4fd845e 915->916 917 4fd8450-4fd8456 915->917 919 4fd8468 916->919 917->919 930 4fd87d6-4fd87ef 918->930 919->918 931 4fd87f5-4fd894e call 4fd7824 call 4fd7814 930->931 932 4fd8557-4fd855e 930->932 977 4fd8978 931->977 978 4fd8950-4fd895c 931->978 933 4fd857a-4fd858b 932->933 934 4fd858d-4fd859f 933->934 935 4fd8560-4fd8577 933->935 937 4fd85a6-4fd85b4 934->937 938 4fd85a1 934->938 935->933 940 4fd85cc-4fd85dd 937->940 938->937 941 4fd85df-4fd85f0 940->941 942 4fd85b6-4fd85c9 940->942 943 4fd8609-4fd861a 941->943 942->940 945 4fd861c-4fd8628 943->945 946 4fd85f2-4fd8606 943->946 947 4fd862f-4fd863d 945->947 948 4fd862a 945->948 946->943 950 4fd8656-4fd8667 947->950 948->947 952 4fd863f-4fd8653 950->952 953 4fd8669-4fd8675 950->953 952->950 955 4fd867c-4fd8695 953->955 956 4fd8677 953->956 958 4fd86a5-4fd86b6 955->958 956->955 960 4fd86b8-4fd86d2 958->960 961 4fd8697-4fd86a2 958->961 962 4fd86eb-4fd8702 960->962 961->958 964 4fd86d4-4fd86e8 962->964 965 4fd8704-4fd871b 962->965 964->962 966 4fd873d-4fd8757 965->966 968 4fd871d-4fd8737 966->968 969 4fd8759-4fd876d 966->969 968->966 970 4fd878f-4fd87a9 969->970 972 4fd876f-4fd8789 970->972 973 4fd87ab-4fd87c4 970->973 972->970 975 4fd87cb-4fd87d3 973->975 976 4fd87c6 973->976 975->930 976->975 981 4fd897e-4fd8cdd call 4fd7804 call 4fd7814 call 4fd7824 call 4fd7814 * 3 call 4fd7834 call 4fd7844 call 4fd7814 977->981 979 4fd895e-4fd8964 978->979 980 4fd8966-4fd896c 978->980 982 4fd8976 979->982 980->982 1021 4fd8cdf 981->1021 1022 4fd8ce4-4fd8db4 call 4fd7854 981->1022 982->981 1021->1022 1030 4fd8dbf-4fd8fba call 4fd7864 call 4fd7874 call 4fd7884 call 4fd7894 * 2 call 4fd77a4 call 4fd78a4 call 4fd78b4 * 2 1022->1030
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2131841680.0000000004FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_4fd0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Pp]q
                                                              • API String ID: 0-2528107101
                                                              • Opcode ID: 09d7131c09277426e36412dc2dc2661f2cffa6b144a4b9846a3a538e89b92056
                                                              • Instruction ID: 887faeaf597addf296aef80f3998cc753a6ea85abeae7e4c8ac0c03d3f9941be
                                                              • Opcode Fuzzy Hash: 09d7131c09277426e36412dc2dc2661f2cffa6b144a4b9846a3a538e89b92056
                                                              • Instruction Fuzzy Hash: 3CD2F934A01219CFDB24DF68C894AD9B7B2FF8A305F1581E9D409AB365DB31AE85CF50
                                                              Function 04FD7BA8 Relevance: 2.2, Strings: 1, Instructions: 994COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1060 4fd7ba8-4fd7be3 1061 4fd7bea-4fd7cb0 call 4fd729c 1060->1061 1062 4fd7be5 1060->1062 1071 4fd7cba-4fd7cc6 call 4fd72ac 1061->1071 1062->1061 1073 4fd7ccb-4fd7ce2 1071->1073 1075 4fd7cec-4fd7cf8 call 4fd72bc 1073->1075 1077 4fd7cfd-4fd7d46 call 4fd72bc 1075->1077 1083 4fd7d50-4fd7d5c call 4fd72cc 1077->1083 1085 4fd7d61-4fd7e0e call 4fd72bc call 4fd72cc call 4fd72dc 1083->1085 1099 4fd7e18-4fd7e24 call 4fd72ec 1085->1099 1101 4fd7e29-4fd7e40 1099->1101 1103 4fd7e4a-4fd7e56 call 4fd72fc 1101->1103 1105 4fd7e5b-4fd7ea4 1103->1105 1109 4fd7eb0-4fd7ec9 1105->1109 1110 4fd7ecf-4fd7f33 call 4fd730c 1109->1110 1114 4fd7f38-4fd7f4c 1110->1114 1115 4fd7f55-4fd8213 call 4fd77a4 call 4fd77b4 call 4fd77c4 call 4fd77d4 call 4fd77e4 call 4fd77f4 call 4fd730c call 4fd77a4 call 4fd77d4 call 4fd77e4 1114->1115 1149 4fd8218-4fd822d 1115->1149 1150 4fd8232-4fd8280 1149->1150 1153 4fd82aa 1150->1153 1154 4fd8282-4fd828e 1150->1154 1157 4fd82b0-4fd82c4 1153->1157 1155 4fd8298-4fd829e 1154->1155 1156 4fd8290-4fd8296 1154->1156 1158 4fd82a8 1155->1158 1156->1158 1159 4fd82ca-4fd8440 call 4fd7804 call 4fd7814 call 4fd7824 1157->1159 1158->1157 1175 4fd846a 1159->1175 1176 4fd8442-4fd844e 1159->1176 1179 4fd8470-4fd8552 call 4fd7804 call 4fd7814 1175->1179 1177 4fd8458-4fd845e 1176->1177 1178 4fd8450-4fd8456 1176->1178 1180 4fd8468 1177->1180 1178->1180 1191 4fd87d6-4fd87ef 1179->1191 1180->1179 1192 4fd87f5-4fd894e call 4fd7824 call 4fd7814 1191->1192 1193 4fd8557-4fd855e 1191->1193 1238 4fd8978 1192->1238 1239 4fd8950-4fd895c 1192->1239 1194 4fd857a-4fd858b 1193->1194 1195 4fd858d-4fd859f 1194->1195 1196 4fd8560-4fd8577 1194->1196 1198 4fd85a6-4fd85b4 1195->1198 1199 4fd85a1 1195->1199 1196->1194 1201 4fd85cc-4fd85dd 1198->1201 1199->1198 1202 4fd85df-4fd85f0 1201->1202 1203 4fd85b6-4fd85c9 1201->1203 1204 4fd8609-4fd861a 1202->1204 1203->1201 1206 4fd861c-4fd8628 1204->1206 1207 4fd85f2-4fd8606 1204->1207 1208 4fd862f-4fd863d 1206->1208 1209 4fd862a 1206->1209 1207->1204 1211 4fd8656-4fd8667 1208->1211 1209->1208 1213 4fd863f-4fd8653 1211->1213 1214 4fd8669-4fd8675 1211->1214 1213->1211 1216 4fd867c-4fd8695 1214->1216 1217 4fd8677 1214->1217 1219 4fd86a5-4fd86b6 1216->1219 1217->1216 1221 4fd86b8-4fd86d2 1219->1221 1222 4fd8697-4fd86a2 1219->1222 1223 4fd86eb-4fd8702 1221->1223 1222->1219 1225 4fd86d4-4fd86e8 1223->1225 1226 4fd8704-4fd871b 1223->1226 1225->1223 1227 4fd873d-4fd8757 1226->1227 1229 4fd871d-4fd8737 1227->1229 1230 4fd8759-4fd876d 1227->1230 1229->1227 1231 4fd878f-4fd87a9 1230->1231 1233 4fd876f-4fd8789 1231->1233 1234 4fd87ab-4fd87c4 1231->1234 1233->1231 1236 4fd87cb-4fd87d3 1234->1236 1237 4fd87c6 1234->1237 1236->1191 1237->1236 1242 4fd897e-4fd8c6f call 4fd7804 call 4fd7814 call 4fd7824 call 4fd7814 * 3 call 4fd7834 call 4fd7844 1238->1242 1240 4fd895e-4fd8964 1239->1240 1241 4fd8966-4fd896c 1239->1241 1243 4fd8976 1240->1243 1241->1243 1276 4fd8c79-4fd8c85 1242->1276 1243->1242 1277 4fd8c8d-4fd8ca2 call 4fd7814 1276->1277 1279 4fd8ca7-4fd8cc7 1277->1279 1281 4fd8ccd-4fd8cdd 1279->1281 1282 4fd8cdf 1281->1282 1283 4fd8ce4-4fd8d8b call 4fd7854 1281->1283 1282->1283 1290 4fd8d96-4fd8db4 1283->1290 1291 4fd8dbf-4fd8fba call 4fd7864 call 4fd7874 call 4fd7884 call 4fd7894 * 2 call 4fd77a4 call 4fd78a4 call 4fd78b4 * 2 1290->1291
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2131841680.0000000004FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_4fd0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Pp]q
                                                              • API String ID: 0-2528107101
                                                              • Opcode ID: 7d927ad0a9d97d8b315fc76614a7390a4e7d1a7d768d29316daeb844ecf9a893
                                                              • Instruction ID: 94cfa66c36c03d2d28158fe70478fbd3d531663dde5bce6bbe42707b8a426c2e
                                                              • Opcode Fuzzy Hash: 7d927ad0a9d97d8b315fc76614a7390a4e7d1a7d768d29316daeb844ecf9a893
                                                              • Instruction Fuzzy Hash: 0DB2D834A40219CFDB24EF68C894AD9B7B2FF8A305F1581E9D4096B365DB31AE85CF50
                                                              Function 06F9377C Relevance: .1, Instructions: 149COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: efaf9af7de8655e2ab7930fb0696b595e8a9cb875df0d16a5a6d5cbb7d89a007
                                                              • Instruction ID: 4718063bf487c43987386771e942f84ec9547714e2db471dcd080344ad68e754
                                                              • Opcode Fuzzy Hash: efaf9af7de8655e2ab7930fb0696b595e8a9cb875df0d16a5a6d5cbb7d89a007
                                                              • Instruction Fuzzy Hash: 30514A76D0A219CFEBA0CF59C984A9EBBB6FF49305F50D1D5D009A7212C7309A85CFA1
                                                              Function 06F94F73 Relevance: .1, Instructions: 63COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 92c2ba26ddb168a2416be518091e8a1bae66b98ee4fd7569008a8e4c3dd67034
                                                              • Instruction ID: 4da4adcb33dc368ea3652a315aef8237da4d49903fc69c0d75805fa6a52b41ee
                                                              • Opcode Fuzzy Hash: 92c2ba26ddb168a2416be518091e8a1bae66b98ee4fd7569008a8e4c3dd67034
                                                              • Instruction Fuzzy Hash: 4E21D8B1D056189BEB59CFABC8447DEBEF6AFC9300F14C06AD408A6255DB750A498FA0
                                                              Function 06F94F80 Relevance: .1, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: ace2143ef76e08a684e9e2df5e4ae9304e7d03419c315d9e3322fd14e5aa1b6f
                                                              • Instruction ID: a9a9b21a73d15c0632903256e16c947ecb8a53d37e3310578b8d4bacf9044807
                                                              • Opcode Fuzzy Hash: ace2143ef76e08a684e9e2df5e4ae9304e7d03419c315d9e3322fd14e5aa1b6f
                                                              • Instruction Fuzzy Hash: E521F6B1D006189BEB58CFABC9443DEFAF7AFC8304F14C06AD40876264DB740A468FA0
                                                              Function 06F9AC1C Relevance: 1.7, APIs: 1, Instructions: 248processCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1321 6f9ac1c-6f9acbd 1324 6f9acbf-6f9acc9 1321->1324 1325 6f9acf6-6f9ad16 1321->1325 1324->1325 1326 6f9accb-6f9accd 1324->1326 1332 6f9ad18-6f9ad22 1325->1332 1333 6f9ad4f-6f9ad7e 1325->1333 1327 6f9accf-6f9acd9 1326->1327 1328 6f9acf0-6f9acf3 1326->1328 1330 6f9acdb 1327->1330 1331 6f9acdd-6f9acec 1327->1331 1328->1325 1330->1331 1331->1331 1334 6f9acee 1331->1334 1332->1333 1335 6f9ad24-6f9ad26 1332->1335 1341 6f9ad80-6f9ad8a 1333->1341 1342 6f9adb7-6f9ae71 CreateProcessA 1333->1342 1334->1328 1337 6f9ad49-6f9ad4c 1335->1337 1338 6f9ad28-6f9ad32 1335->1338 1337->1333 1339 6f9ad34 1338->1339 1340 6f9ad36-6f9ad45 1338->1340 1339->1340 1340->1340 1343 6f9ad47 1340->1343 1341->1342 1344 6f9ad8c-6f9ad8e 1341->1344 1353 6f9ae7a-6f9af00 1342->1353 1354 6f9ae73-6f9ae79 1342->1354 1343->1337 1346 6f9adb1-6f9adb4 1344->1346 1347 6f9ad90-6f9ad9a 1344->1347 1346->1342 1348 6f9ad9c 1347->1348 1349 6f9ad9e-6f9adad 1347->1349 1348->1349 1349->1349 1351 6f9adaf 1349->1351 1351->1346 1364 6f9af10-6f9af14 1353->1364 1365 6f9af02-6f9af06 1353->1365 1354->1353 1367 6f9af24-6f9af28 1364->1367 1368 6f9af16-6f9af1a 1364->1368 1365->1364 1366 6f9af08 1365->1366 1366->1364 1370 6f9af38-6f9af3c 1367->1370 1371 6f9af2a-6f9af2e 1367->1371 1368->1367 1369 6f9af1c 1368->1369 1369->1367 1373 6f9af4e-6f9af55 1370->1373 1374 6f9af3e-6f9af44 1370->1374 1371->1370 1372 6f9af30 1371->1372 1372->1370 1375 6f9af6c 1373->1375 1376 6f9af57-6f9af66 1373->1376 1374->1373 1378 6f9af6d 1375->1378 1376->1375 1378->1378
                                                              APIs
                                                              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06F9AE5E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: CreateProcess
                                                              • String ID:
                                                              • API String ID: 963392458-0
                                                              • Opcode ID: 2d7f5511684de5a5d7e52f33fc4d4760966a5a882eef06077bfc517726a62259
                                                              • Instruction ID: dfefe6251eba7c3e2a4e081221fb62880beb5536e46774ab954edbde2fa0df24
                                                              • Opcode Fuzzy Hash: 2d7f5511684de5a5d7e52f33fc4d4760966a5a882eef06077bfc517726a62259
                                                              • Instruction Fuzzy Hash: 9DA16B71D00219DFEF64DF69C841BDEBBB2BF48314F14856AE818A7280DB749985CFA1
                                                              Function 06F9AC28 Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1379 6f9ac28-6f9acbd 1381 6f9acbf-6f9acc9 1379->1381 1382 6f9acf6-6f9ad16 1379->1382 1381->1382 1383 6f9accb-6f9accd 1381->1383 1389 6f9ad18-6f9ad22 1382->1389 1390 6f9ad4f-6f9ad7e 1382->1390 1384 6f9accf-6f9acd9 1383->1384 1385 6f9acf0-6f9acf3 1383->1385 1387 6f9acdb 1384->1387 1388 6f9acdd-6f9acec 1384->1388 1385->1382 1387->1388 1388->1388 1391 6f9acee 1388->1391 1389->1390 1392 6f9ad24-6f9ad26 1389->1392 1398 6f9ad80-6f9ad8a 1390->1398 1399 6f9adb7-6f9ae71 CreateProcessA 1390->1399 1391->1385 1394 6f9ad49-6f9ad4c 1392->1394 1395 6f9ad28-6f9ad32 1392->1395 1394->1390 1396 6f9ad34 1395->1396 1397 6f9ad36-6f9ad45 1395->1397 1396->1397 1397->1397 1400 6f9ad47 1397->1400 1398->1399 1401 6f9ad8c-6f9ad8e 1398->1401 1410 6f9ae7a-6f9af00 1399->1410 1411 6f9ae73-6f9ae79 1399->1411 1400->1394 1403 6f9adb1-6f9adb4 1401->1403 1404 6f9ad90-6f9ad9a 1401->1404 1403->1399 1405 6f9ad9c 1404->1405 1406 6f9ad9e-6f9adad 1404->1406 1405->1406 1406->1406 1408 6f9adaf 1406->1408 1408->1403 1421 6f9af10-6f9af14 1410->1421 1422 6f9af02-6f9af06 1410->1422 1411->1410 1424 6f9af24-6f9af28 1421->1424 1425 6f9af16-6f9af1a 1421->1425 1422->1421 1423 6f9af08 1422->1423 1423->1421 1427 6f9af38-6f9af3c 1424->1427 1428 6f9af2a-6f9af2e 1424->1428 1425->1424 1426 6f9af1c 1425->1426 1426->1424 1430 6f9af4e-6f9af55 1427->1430 1431 6f9af3e-6f9af44 1427->1431 1428->1427 1429 6f9af30 1428->1429 1429->1427 1432 6f9af6c 1430->1432 1433 6f9af57-6f9af66 1430->1433 1431->1430 1435 6f9af6d 1432->1435 1433->1432 1435->1435
                                                              APIs
                                                              • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06F9AE5E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: CreateProcess
                                                              • String ID:
                                                              • API String ID: 963392458-0
                                                              • Opcode ID: 965ae3ae1eec0fc585ace3deec1605a745b391be3805f36181c6291eac982a18
                                                              • Instruction ID: a2575ddabc4523168708a1733c3ba00df267f6dac5db8d8173e1f458dabf93f3
                                                              • Opcode Fuzzy Hash: 965ae3ae1eec0fc585ace3deec1605a745b391be3805f36181c6291eac982a18
                                                              • Instruction Fuzzy Hash: 4E915B71D00619CFEF64DF69C841BDEBBB2BF48314F14856AE808A7280DB749985CFA1
                                                              Function 010AADC8 Relevance: 1.7, APIs: 1, Instructions: 199COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1436 10aadc8-10aadd7 1437 10aadd9-10aade6 call 10aa0ec 1436->1437 1438 10aae03-10aae07 1436->1438 1445 10aade8 1437->1445 1446 10aadfc 1437->1446 1439 10aae1b-10aae5c 1438->1439 1440 10aae09-10aae13 1438->1440 1447 10aae69-10aae77 1439->1447 1448 10aae5e-10aae66 1439->1448 1440->1439 1493 10aadee call 10ab060 1445->1493 1494 10aadee call 10ab051 1445->1494 1446->1438 1449 10aae9b-10aae9d 1447->1449 1450 10aae79-10aae7e 1447->1450 1448->1447 1455 10aaea0-10aaea7 1449->1455 1453 10aae89 1450->1453 1454 10aae80-10aae87 call 10aa0f8 1450->1454 1451 10aadf4-10aadf6 1451->1446 1452 10aaf38-10aaf4f 1451->1452 1467 10aaf51-10aafb0 1452->1467 1458 10aae8b-10aae99 1453->1458 1454->1458 1456 10aaea9-10aaeb1 1455->1456 1457 10aaeb4-10aaebb 1455->1457 1456->1457 1461 10aaec8-10aaeca call 10aa108 1457->1461 1462 10aaebd-10aaec5 1457->1462 1458->1455 1466 10aaecf-10aaed1 1461->1466 1462->1461 1468 10aaede-10aaee3 1466->1468 1469 10aaed3-10aaedb 1466->1469 1487 10aafb2-10aaff8 1467->1487 1470 10aaf01-10aaf0e 1468->1470 1471 10aaee5-10aaeec 1468->1471 1469->1468 1476 10aaf10-10aaf2e 1470->1476 1477 10aaf31-10aaf37 1470->1477 1471->1470 1473 10aaeee-10aaefe call 10aa118 call 10aa128 1471->1473 1473->1470 1476->1477 1488 10aaffa-10aaffd 1487->1488 1489 10ab000-10ab02b GetModuleHandleW 1487->1489 1488->1489 1490 10ab02d-10ab033 1489->1490 1491 10ab034-10ab048 1489->1491 1490->1491 1493->1451 1494->1451
                                                              APIs
                                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 010AB01E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127850251.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_10a0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: HandleModule
                                                              • String ID:
                                                              • API String ID: 4139908857-0
                                                              • Opcode ID: 7d1a2656ab143a5b7283c51436ba216459f737a07bae211ae8adedf4438e729b
                                                              • Instruction ID: 5d1fc5f57b6c2c48172c220e57be4ac92a4c1124d4fb4e157abe040b40dd656f
                                                              • Opcode Fuzzy Hash: 7d1a2656ab143a5b7283c51436ba216459f737a07bae211ae8adedf4438e729b
                                                              • Instruction Fuzzy Hash: 08713270A00B05CFDB64DFA9D4447AABBF5FF48300F408A69D58A97A80D739E946CB90
                                                              Function 010A5A84 Relevance: 1.6, APIs: 1, Instructions: 105COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1495 10a5a84-10a5b14
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127850251.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_10a0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2b9bf964a33d510c6623bfceb03dc375bbb7e997a0545a41f7e4d24ae826ce96
                                                              • Instruction ID: 98ead56871db3fa86c2c3e1817196487a759e9eb3587221658b4a89709faea67
                                                              • Opcode Fuzzy Hash: 2b9bf964a33d510c6623bfceb03dc375bbb7e997a0545a41f7e4d24ae826ce96
                                                              • Instruction Fuzzy Hash: E631DB71804208CFDB15CFE8C8556EDBBF0FF56314F90818AC099AB261C775A846CB42
                                                              Function 010A590D Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1498 10a590d-10a598c 1499 10a598f-10a59d9 CreateActCtxA 1498->1499 1501 10a59db-10a59e1 1499->1501 1502 10a59e2-10a5a3c 1499->1502 1501->1502 1509 10a5a4b-10a5a4f 1502->1509 1510 10a5a3e-10a5a41 1502->1510 1511 10a5a60 1509->1511 1512 10a5a51-10a5a5d 1509->1512 1510->1509 1514 10a5a61 1511->1514 1512->1511 1514->1514
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 010A59C9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127850251.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_10a0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: a874c4f21ffca20a613e008794510d813aff33f69fb278745882abfc28fa2d40
                                                              • Instruction ID: b95af64d6a8b3aa3dd9e0351c89700690a00f3ed3fcd1b2bc8be604d1920baa9
                                                              • Opcode Fuzzy Hash: a874c4f21ffca20a613e008794510d813aff33f69fb278745882abfc28fa2d40
                                                              • Instruction Fuzzy Hash: 264112B1D00719CBDB24CFA9C885BCDBBF1BF48304F60806AD418AB250DB756986CF91
                                                              Function 010A44C4 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 010A59C9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127850251.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_10a0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: 5d0845e5a62d389471ebb8c54f038428c7e955ccf610eeee413a46247bb1d210
                                                              • Instruction ID: 4e8af12a6303e8f5523cc8718cd13807bced8650e1663ad2f72fd28d35f02a85
                                                              • Opcode Fuzzy Hash: 5d0845e5a62d389471ebb8c54f038428c7e955ccf610eeee413a46247bb1d210
                                                              • Instruction Fuzzy Hash: B04110B0D0071DCBDB24CFA9C884B8DBBF5BF49304F60806AD518AB261DB756946CF91
                                                              Function 04FD4040 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CallWindowProcW.USER32(?,?,?,?,?), ref: 04FD4101
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2131841680.0000000004FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_4fd0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: CallProcWindow
                                                              • String ID:
                                                              • API String ID: 2714655100-0
                                                              • Opcode ID: 6ce13d5fd8bd3032f8fad4a7a101a40078037e91181d9fb44760db49cfaa66b6
                                                              • Instruction ID: f1b8bbeea0be8d9b7dbab03a0339d4dc4cf40250b8de147b8244e95eb8f4144a
                                                              • Opcode Fuzzy Hash: 6ce13d5fd8bd3032f8fad4a7a101a40078037e91181d9fb44760db49cfaa66b6
                                                              • Instruction Fuzzy Hash: DD410BB5A00309DFDB15CF99C448AAABBF6FF88314F24C459D519A7321D375A841CFA1
                                                              Function 06F9A998 Relevance: 1.6, APIs: 1, Instructions: 74injectionCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06F9AA30
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: MemoryProcessWrite
                                                              • String ID:
                                                              • API String ID: 3559483778-0
                                                              • Opcode ID: d106c0913a88201ef54c557e02837d7ba896ced3f3179f6beecdb60f8f9fcff4
                                                              • Instruction ID: 730bf38c8f5725f2878b28e743c70fd4b81bfdc9d7b366c637cdacc597e8e232
                                                              • Opcode Fuzzy Hash: d106c0913a88201ef54c557e02837d7ba896ced3f3179f6beecdb60f8f9fcff4
                                                              • Instruction Fuzzy Hash: 292126B6D003499FDB10DFA9C885BDEBBF5FF48310F108429E958A7240D7789945CBA1
                                                              Function 06F9A9A0 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06F9AA30
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: MemoryProcessWrite
                                                              • String ID:
                                                              • API String ID: 3559483778-0
                                                              • Opcode ID: fcc48ccfd4a233b6c2e9bbe2ef49d72fddcbf13fb5e4e5fe055f2ee1b3a46860
                                                              • Instruction ID: cec117639a99b66e606778674fbf9b3b8ebd68749d42e1e0a0d33ae50c551d02
                                                              • Opcode Fuzzy Hash: fcc48ccfd4a233b6c2e9bbe2ef49d72fddcbf13fb5e4e5fe055f2ee1b3a46860
                                                              • Instruction Fuzzy Hash: 9B2113B5D003499FDB10DFAAC985BEEBBF5FF48310F10842AE959A7240C7789945CBA1
                                                              Function 06F9AA88 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06F9AB10
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: MemoryProcessRead
                                                              • String ID:
                                                              • API String ID: 1726664587-0
                                                              • Opcode ID: 2c12736c52957821c5eae67204ae52411d1673c560bc81782f1e3389c8d7eaa9
                                                              • Instruction ID: 4d71e3d670b6c39d83643a0d53d44afbcb18467daa6344662e0d5cb262b39949
                                                              • Opcode Fuzzy Hash: 2c12736c52957821c5eae67204ae52411d1673c560bc81782f1e3389c8d7eaa9
                                                              • Instruction Fuzzy Hash: 082139B1D003499FDB10DFAAC841AEEFBF5FF48320F10842AE958A3240D7389945DBA1
                                                              Function 010AD29C Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,010AD676,?,?,?,?,?), ref: 010AD737
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127850251.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_10a0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: 474a816c2115717a9a6dc454b880b030ef098e19e75ab1a9a0e98b51f70f9956
                                                              • Instruction ID: 1b1a3cbf306e3d9fc223393e78885c05c7933e295a232b641910109599e16db9
                                                              • Opcode Fuzzy Hash: 474a816c2115717a9a6dc454b880b030ef098e19e75ab1a9a0e98b51f70f9956
                                                              • Instruction Fuzzy Hash: E721D4B59002489FDB10CF9AD584ADEBFF9FB48310F14801AE958A7310D378A950CFA5
                                                              Function 06F9A3CF Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06F9A44E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: ContextThreadWow64
                                                              • String ID:
                                                              • API String ID: 983334009-0
                                                              • Opcode ID: 7b2b9af2a55ceff8e0e7d6a8155f5060322fa1ed52f45400dafdab38f48325eb
                                                              • Instruction ID: 01d7d57d617c3d34b9849f01720762dfa56783ec9ed64f288809a03639c853d2
                                                              • Opcode Fuzzy Hash: 7b2b9af2a55ceff8e0e7d6a8155f5060322fa1ed52f45400dafdab38f48325eb
                                                              • Instruction Fuzzy Hash: 332125B5D002098FDB10DFAAC485BAEBBF4FF48314F108429D519A7240CB789945CFA1
                                                              Function 06F9A3D0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06F9A44E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: ContextThreadWow64
                                                              • String ID:
                                                              • API String ID: 983334009-0
                                                              • Opcode ID: c69c2e3473a7596c3f4a76f3fc02f32cd08fdb48bb99ac308aa1cce894835098
                                                              • Instruction ID: 4af59b3b4e596e055c8254a6b245b0b7338b31840b989e25ac4b215ac971bef6
                                                              • Opcode Fuzzy Hash: c69c2e3473a7596c3f4a76f3fc02f32cd08fdb48bb99ac308aa1cce894835098
                                                              • Instruction Fuzzy Hash: 2C2137B1D003098FDB10DFAAC485BAEBBF4FF48314F108429D519A7240CB789945CFA1
                                                              Function 06F9AA90 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06F9AB10
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: MemoryProcessRead
                                                              • String ID:
                                                              • API String ID: 1726664587-0
                                                              • Opcode ID: ee76a583c56f231dc0f3b093bcb6cf575ff56ea4f2017e0fafc83e37fac06e92
                                                              • Instruction ID: 4b81b88159aefa324ae58d2cff01775a40ff8d83b803c00e8a330020ff485fb3
                                                              • Opcode Fuzzy Hash: ee76a583c56f231dc0f3b093bcb6cf575ff56ea4f2017e0fafc83e37fac06e92
                                                              • Instruction Fuzzy Hash: C42125B1D003499FDB10DFAAC884AEEFBF5FF48310F50842AE919A7240C7389941CBA1
                                                              Function 06F9A8D9 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06F9A94E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: AllocVirtual
                                                              • String ID:
                                                              • API String ID: 4275171209-0
                                                              • Opcode ID: 3a803f2997c1a388ca4145a7f3bd26cc4e78d116f8a0955f58a40f101e2b38a7
                                                              • Instruction ID: 27ead11b6b142cc9406da9d52c979bc28c7e906dc60b410af7819d8e3c721015
                                                              • Opcode Fuzzy Hash: 3a803f2997c1a388ca4145a7f3bd26cc4e78d116f8a0955f58a40f101e2b38a7
                                                              • Instruction Fuzzy Hash: 181136B6D002499BDB10DFAAC845AEEBBF5EF48324F108419E559A7250C739A941CBA1
                                                              Function 010AB239 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,010AB099,00000800,00000000,00000000), ref: 010AB2AA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127850251.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_10a0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: LibraryLoad
                                                              • String ID:
                                                              • API String ID: 1029625771-0
                                                              • Opcode ID: 558fe882c9d2152e7c422b6f06647faffb97ff548343745f5799552d72bf20e2
                                                              • Instruction ID: 0184537d3613448c2969cde95b8897c4a8cb9dc1bf4c5570e1deb8e1791343a1
                                                              • Opcode Fuzzy Hash: 558fe882c9d2152e7c422b6f06647faffb97ff548343745f5799552d72bf20e2
                                                              • Instruction Fuzzy Hash: 4F11F6B6D002498FDB20CFAAD944ADEFFF5EF88310F10852AD559A7600C379A546CFA5
                                                              Function 06F9A318 Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: ResumeThread
                                                              • String ID:
                                                              • API String ID: 947044025-0
                                                              • Opcode ID: 762707f574920709358e112e7d8dd18492c5703bc5ddc39464cb5ce8d59f4fd6
                                                              • Instruction ID: 1adbb0b68fd34ff35e1ffffa1f8f810f0e927d69d17ac459d7258d3ed9d2c4ad
                                                              • Opcode Fuzzy Hash: 762707f574920709358e112e7d8dd18492c5703bc5ddc39464cb5ce8d59f4fd6
                                                              • Instruction Fuzzy Hash: 65113AB5D007488BDB20DFAAC845BDEFBF5EB88324F208419D519A7250C739A545CBA1
                                                              Function 010AA150 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,010AB099,00000800,00000000,00000000), ref: 010AB2AA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127850251.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_10a0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: LibraryLoad
                                                              • String ID:
                                                              • API String ID: 1029625771-0
                                                              • Opcode ID: bcc40cd94c71bc2275a39bc9f637010533e74ff13141ed903b8035b0f1964017
                                                              • Instruction ID: 2a7f62bc3dc196ce1b707555e4e0c3044f0084aa55ff5ce7c29bc0e6cdcf279c
                                                              • Opcode Fuzzy Hash: bcc40cd94c71bc2275a39bc9f637010533e74ff13141ed903b8035b0f1964017
                                                              • Instruction Fuzzy Hash: 5B1114B69003499FDB10CF9AC844ADEFBF4EB88310F10842AD559A7600C379A545CFA5
                                                              Function 06F9A8E0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06F9A94E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: AllocVirtual
                                                              • String ID:
                                                              • API String ID: 4275171209-0
                                                              • Opcode ID: 7ccd2ecae4fb19c5b81cfef4a32d785f1f2549e6363b5a95901c681c816efef3
                                                              • Instruction ID: 73aebda8704ca9e18f409fb11c14f4a56123b70cc6025e3fc99dff8f30e90413
                                                              • Opcode Fuzzy Hash: 7ccd2ecae4fb19c5b81cfef4a32d785f1f2549e6363b5a95901c681c816efef3
                                                              • Instruction Fuzzy Hash: 2C1126759002499FDB10DFAAC845AEEBBF5FF88324F108419E519A7250C779A540CBA1
                                                              Function 06F9A320 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: ResumeThread
                                                              • String ID:
                                                              • API String ID: 947044025-0
                                                              • Opcode ID: 14b923fa06c096f774bb2b132fa171b2feff4ae081c075f7f1c25c4e85256afc
                                                              • Instruction ID: 49bc782e8ba6c60f0b6ef3a8daac5da34e516ae4fa35bec5363a84d908ba302d
                                                              • Opcode Fuzzy Hash: 14b923fa06c096f774bb2b132fa171b2feff4ae081c075f7f1c25c4e85256afc
                                                              • Instruction Fuzzy Hash: 35113AB1D003488FDB20DFAAC445BEEFBF5EF88324F208419D519A7240CB79A545CBA5
                                                              Function 06F9D0D0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • PostMessageW.USER32(?,00000010,00000000,?), ref: 06F9D8CD
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: MessagePost
                                                              • String ID:
                                                              • API String ID: 410705778-0
                                                              • Opcode ID: f59a135ceecc2aeb4a7bf782d6cc68824f472d100b67f2c412d7d21e15ae189c
                                                              • Instruction ID: 45686806a0267076244c7989a9dfd0057fb5c68b6ca3b8831b1aaa7b268cecec
                                                              • Opcode Fuzzy Hash: f59a135ceecc2aeb4a7bf782d6cc68824f472d100b67f2c412d7d21e15ae189c
                                                              • Instruction Fuzzy Hash: 7D11F5B5804748DFEB10DF99C944BDEBBF8FB48320F208419E518A7201C375A944CFA5
                                                              Function 06F9D868 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • PostMessageW.USER32(?,00000010,00000000,?), ref: 06F9D8CD
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: MessagePost
                                                              • String ID:
                                                              • API String ID: 410705778-0
                                                              • Opcode ID: 81605472aac48caeea4de427f637178a1ca1a3200573740c00f87a2222a09ca8
                                                              • Instruction ID: a6dbf1078aad244920f6235ed5707b3d730f67e4d13576d4a45b06916ceeb3aa
                                                              • Opcode Fuzzy Hash: 81605472aac48caeea4de427f637178a1ca1a3200573740c00f87a2222a09ca8
                                                              • Instruction Fuzzy Hash: C011E3B58002499FDB10DF99D885BDEFBF8FB48320F208419E558A7200C375A944CFA5
                                                              Function 010AAFB8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNELBASE(00000000), ref: 010AB01E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127850251.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_10a0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: HandleModule
                                                              • String ID:
                                                              • API String ID: 4139908857-0
                                                              • Opcode ID: c7a58b9cf5ff5db532e4e15e3303e9ea309fa72d281974b63578a022c9fcad6a
                                                              • Instruction ID: af2ce1197226dff155aa1a443f491485b6cbbc5c128efad561a65d288d3f0d31
                                                              • Opcode Fuzzy Hash: c7a58b9cf5ff5db532e4e15e3303e9ea309fa72d281974b63578a022c9fcad6a
                                                              • Instruction Fuzzy Hash: CE1102B5C003498FDB10DF9AC444BDEFBF4EB48214F10845AD569A7600D379A545CFA1
                                                              Function 00F2D4C4 Relevance: .1, Instructions: 75COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127287867.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_f2d000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: cbb881ed17bb239abde67c6db76c6c08ee582c2b53fd46a1137d3febda5eff03
                                                              • Instruction ID: f7da6ac6ea2ac5c8595a51246be447a11314e4e19a50010bb15a13ff28e9bcb8
                                                              • Opcode Fuzzy Hash: cbb881ed17bb239abde67c6db76c6c08ee582c2b53fd46a1137d3febda5eff03
                                                              • Instruction Fuzzy Hash: B6214872500240DFCB05DF14E9C0F26BF65FB98328F34C569E8090B256C376D846E7A2
                                                              Function 00F3D1D4 Relevance: .1, Instructions: 72COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127321617.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_f3d000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 073e625b518622c96245df0ddb38d3198e3de8db48443c2faf67df89af2c3401
                                                              • Instruction ID: 67347f13792eb360f84248ae6c0cfbd029e35e539476490f2cc9baf9d7cfaba2
                                                              • Opcode Fuzzy Hash: 073e625b518622c96245df0ddb38d3198e3de8db48443c2faf67df89af2c3401
                                                              • Instruction Fuzzy Hash: 6F210471904204EFDB05DF24E9C0F26BBA5FB88334F20C56DE9494B396C33AD806EA61
                                                              Function 00F3D01C Relevance: .1, Instructions: 72COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127321617.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_f3d000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 722cbd1180ff75159e23e856bb1ea8c567dc705fa2be699bd83ab7d47500a149
                                                              • Instruction ID: 1c87ae8ea96a82d5a38afe82fde99413ce8e73e8eace359f3a0b2f5296b9e18c
                                                              • Opcode Fuzzy Hash: 722cbd1180ff75159e23e856bb1ea8c567dc705fa2be699bd83ab7d47500a149
                                                              • Instruction Fuzzy Hash: 2121F5B1504204DFCB18DF24E5C4B16BF65FB84734F20C569D94A4B35AC33AD807EA61
                                                              Function 00F3D005 Relevance: .1, Instructions: 62COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127321617.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_f3d000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4692914284ad91fbfc5b5b3c6cceb7eda1e2033aa7d7d7015dcc5cce02302147
                                                              • Instruction ID: 9641912254b2682c07aea5a9bb9144214ae46cffdcdf2442d90d498666da700c
                                                              • Opcode Fuzzy Hash: 4692914284ad91fbfc5b5b3c6cceb7eda1e2033aa7d7d7015dcc5cce02302147
                                                              • Instruction Fuzzy Hash: 122192755093C08FCB06CF24D994715BF71EB46324F28C5EAD8498F2A7C33A980ADB62
                                                              Function 00F2D4BF Relevance: .1, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127287867.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_f2d000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
                                                              • Instruction ID: b5e54bc30ddcbd80164cd60a7a1ef58a34ea7c5a6e321277643546733f6fcde8
                                                              • Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
                                                              • Instruction Fuzzy Hash: 7C112672804280CFCB06CF10D5C4B16BF71FB98328F28C6A9D8490B256C336D85ADBA2
                                                              Function 00F3D1CF Relevance: .1, Instructions: 53COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127321617.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_f3d000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
                                                              • Instruction ID: 2715b44936d050932836df0be54e714cc5c6b66ddd9da62b51fefefa5f46b0d0
                                                              • Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
                                                              • Instruction Fuzzy Hash: 9E11BB75904280DFCB06CF10D9C4B16BBA1FB84324F24C6A9D8494B296C33AD80ADB62

                                                              Non-executed Functions

                                                              Function 06F9F050 Relevance: .4, Instructions: 355COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: ee58aba96dd7071bbd511c26f9068ef9fd7ab575bf845d459e4cd197e187fd00
                                                              • Instruction ID: b3a262641bc0dd572b9bf9c49052fba2d8136b89f27994c6d3f0a455d9695656
                                                              • Opcode Fuzzy Hash: ee58aba96dd7071bbd511c26f9068ef9fd7ab575bf845d459e4cd197e187fd00
                                                              • Instruction Fuzzy Hash: 4CD1BD31B027058FEBA5DB75C850BAEBBFAAF89700F544469D156DB2D0CB35E802CB61
                                                              Function 04FD0040 Relevance: .3, Instructions: 315COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2131841680.0000000004FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_4fd0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 752335f8d7080c92e66d18e7a71f9c88eaf7dc974813513c158630b896567a6a
                                                              • Instruction ID: aff6d0babdd2d6cb5c8a09fec513d7b6580ab4b35f484b1db5b5af483c02a847
                                                              • Opcode Fuzzy Hash: 752335f8d7080c92e66d18e7a71f9c88eaf7dc974813513c158630b896567a6a
                                                              • Instruction Fuzzy Hash: B512A5B2C8AB458BD3D0CF25E84C1A93BB1BB45328FD34A09C3665B2E5D7B4156ACF44
                                                              Function 06F97A80 Relevance: .3, Instructions: 313COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f8310e6153647d9ae0781078cea99e48ea5fd1b658a0f90c10ffae92942aa420
                                                              • Instruction ID: c83c0868258b9b352880360e909562eb893f7e3c9611dce16338d3ca9f015c80
                                                              • Opcode Fuzzy Hash: f8310e6153647d9ae0781078cea99e48ea5fd1b658a0f90c10ffae92942aa420
                                                              • Instruction Fuzzy Hash: 3BE11874E102198FDB54DFA8C5809AEFBB2FF89305F248169D414AB356D731AD82CFA1
                                                              Function 06F996C0 Relevance: .3, Instructions: 312COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: beb152692f7525329bfd0d0b4319a81935b722b24f84fd39023682fc5404ac17
                                                              • Instruction ID: e0fd708effe65fa0d07d228574414be3cd7478806ce3e4e17cbe5c4c433d9692
                                                              • Opcode Fuzzy Hash: beb152692f7525329bfd0d0b4319a81935b722b24f84fd39023682fc5404ac17
                                                              • Instruction Fuzzy Hash: 7DE13B74E001198FDB54DFA9C5809AEFBB2FF89305F288169D414AB35AD731A942CFA1
                                                              Function 06F9A4A8 Relevance: .3, Instructions: 312COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 464f9e23878a8e1e027f657c08956f1bad7e3e9c34e63f23d3c68769cec8d883
                                                              • Instruction ID: cc6af9160bdb2e847649d5ad17a3d093917c481c4199c8ad0dfffa858d9a9e39
                                                              • Opcode Fuzzy Hash: 464f9e23878a8e1e027f657c08956f1bad7e3e9c34e63f23d3c68769cec8d883
                                                              • Instruction Fuzzy Hash: 2FE11974E001198FDB54DFA8C5809AEFBF2FF89305F248169D414AB35AD731A982CFA1
                                                              Function 06F97EC0 Relevance: .3, Instructions: 312COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c57a26ddca9e578b46415ef25311691365f41ef6bd892db5a6fbdbd88175d749
                                                              • Instruction ID: fa7debf4b83fce2e4acdd1b7a243e921fd1ce0a63ed2ecc4d0020033f62682db
                                                              • Opcode Fuzzy Hash: c57a26ddca9e578b46415ef25311691365f41ef6bd892db5a6fbdbd88175d749
                                                              • Instruction Fuzzy Hash: 06E12C74E002198FDB54DFA8C5809AEFBB2FF89305F248569D414AB356D731AD82CFA1
                                                              Function 06F99AF8 Relevance: .3, Instructions: 312COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 543e3ecefb8c3efb12a95a4b511f5e523b2f1ef0f1ec432de02c0d2eeecd83af
                                                              • Instruction ID: 2592fe19c6b895130633e1a5dfb234c204c484d6a682d874e894d837c8039139
                                                              • Opcode Fuzzy Hash: 543e3ecefb8c3efb12a95a4b511f5e523b2f1ef0f1ec432de02c0d2eeecd83af
                                                              • Instruction Fuzzy Hash: 1CE12A74E001198FDB54DFA9C9809AEFBF2FF89305F248169D404AB356D771A982CFA1
                                                              Function 06F903F0 Relevance: .3, Instructions: 267COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2ee39232135aae54d24dd5ea8ab2b6a86cd0a83dd078dd282bd4e58f79769656
                                                              • Instruction ID: 60513867b6562c3c3feb66c2bfc63d57eda2a30195b2bb732ac7f3d5926f6d1a
                                                              • Opcode Fuzzy Hash: 2ee39232135aae54d24dd5ea8ab2b6a86cd0a83dd078dd282bd4e58f79769656
                                                              • Instruction Fuzzy Hash: FCD14D35D2065A9ACB11EF64D994AADB7B1FFD5300F10C79AE00937124EFB46AC9CB81
                                                              Function 06F90400 Relevance: .3, Instructions: 264COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2133246978.0000000006F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F90000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_6f90000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 1599eff51eec9942a9cef551e435bc94b2c3f5aebea5e3f9c4526731b178be57
                                                              • Instruction ID: 100c9569f442a558d8b75bcba780f6d7964fa0d1145ca208cfcbb977c6877b7b
                                                              • Opcode Fuzzy Hash: 1599eff51eec9942a9cef551e435bc94b2c3f5aebea5e3f9c4526731b178be57
                                                              • Instruction Fuzzy Hash: 24D14E35D2061A9ACB11EF64D994AADB7B1FFD5300F10C79AE00937214EFB46AC9CB81
                                                              Function 010AD5DC Relevance: .3, Instructions: 264COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2127850251.00000000010A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_10a0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7a21686bd86d7605b1df06e2eca43267fddd6d9c54c9300040808e5743f5faa6
                                                              • Instruction ID: 5275b60408b80ccefdc8dcfd0572645d905290d97347fac940ec22a72259d89a
                                                              • Opcode Fuzzy Hash: 7a21686bd86d7605b1df06e2eca43267fddd6d9c54c9300040808e5743f5faa6
                                                              • Instruction Fuzzy Hash: CAA17336E002168FCF15DFB4C8405EEBBF2FF89304B5545AAE905AB265DB71E916CB40
                                                              Function 04FD001E Relevance: .2, Instructions: 235COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.2131841680.0000000004FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FD0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_4fd0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 591527ef1f8c20c9abba5e1d6f36f654b0b25ea1b86571643e29089759732ad1
                                                              • Instruction ID: 0379d203b2e9938e523ff50c981f974a7499608a759001fe5e1942952f8ee371
                                                              • Opcode Fuzzy Hash: 591527ef1f8c20c9abba5e1d6f36f654b0b25ea1b86571643e29089759732ad1
                                                              • Instruction Fuzzy Hash: 0CC14BB2C8A7458BD7D0CF25E8481A93BB1FF85318F934A09D3616B2E5DBB4146ACF40

                                                              Execution Graph

                                                              Execution Coverage:1.3%
                                                              Dynamic/Decrypted Code Coverage:2.7%
                                                              Signature Coverage:5.9%
                                                              Total number of Nodes:557
                                                              Total number of Limit Nodes:71
                                                              execution_graph 99306 41f120 99309 41b970 99306->99309 99310 41b996 99309->99310 99317 409d40 99310->99317 99312 41b9a2 99313 41b9c3 99312->99313 99325 40c1c0 99312->99325 99315 41b9b5 99361 41a6b0 99315->99361 99364 409c90 99317->99364 99319 409d4d 99320 409d54 99319->99320 99376 409c30 99319->99376 99320->99312 99326 40c1e5 99325->99326 99795 40b1c0 99326->99795 99328 40c23c 99799 40ae40 99328->99799 99330 40c262 99360 40c4b3 99330->99360 99808 4143a0 99330->99808 99332 40c2a7 99332->99360 99811 408a60 99332->99811 99334 40c2eb 99334->99360 99818 41a500 99334->99818 99338 40c348 99341 41bdc0 2 API calls 99338->99341 99339 40c341 99339->99338 99830 41a010 99339->99830 99343 40c355 99341->99343 99343->99315 99344 40c392 99345 41bdc0 2 API calls 99344->99345 99346 40c399 99345->99346 99346->99315 99347 40c3a2 99348 40f4a0 3 API calls 99347->99348 99349 40c416 99348->99349 99349->99338 99350 40c421 99349->99350 99351 41bdc0 2 API calls 99350->99351 99352 40c445 99351->99352 99835 41a060 99352->99835 99355 41a010 2 API calls 99356 40c480 99355->99356 99356->99360 99840 419e20 99356->99840 99359 41a6b0 2 API calls 99359->99360 99360->99315 99362 41af60 LdrLoadDll 99361->99362 99363 41a6cf ExitProcess 99362->99363 99363->99313 99365 409ca3 99364->99365 99415 418bc0 LdrLoadDll 99364->99415 99395 418a70 99365->99395 99368 409cb6 99368->99319 99369 409cac 99369->99368 99398 41b2b0 99369->99398 99371 409cf3 99371->99368 99409 409ab0 99371->99409 99373 409d13 99416 409620 LdrLoadDll 99373->99416 99375 409d25 99375->99319 99377 409c4a 99376->99377 99378 41b5a0 LdrLoadDll 99376->99378 99769 41b5a0 99377->99769 99378->99377 99381 41b5a0 LdrLoadDll 99382 409c71 99381->99382 99383 40f180 99382->99383 99384 40f199 99383->99384 99778 40b040 99384->99778 99386 40f1ac 99782 41a1e0 99386->99782 99389 409d65 99389->99312 99391 40f1d2 99392 40f1fd 99391->99392 99788 41a260 99391->99788 99393 41a490 2 API calls 99392->99393 99393->99389 99417 41a600 99395->99417 99399 41b2c9 99398->99399 99431 414a50 99399->99431 99401 41b2e1 99402 41b2ea 99401->99402 99470 41b0f0 99401->99470 99402->99371 99404 41b2fe 99404->99402 99488 419f00 99404->99488 99747 407ea0 99409->99747 99411 409ad1 99411->99373 99412 409aca 99412->99411 99760 408160 99412->99760 99415->99365 99416->99375 99418 41a616 99417->99418 99421 41af60 99418->99421 99420 418a85 99420->99369 99422 41af92 99421->99422 99423 41af70 99421->99423 99422->99420 99425 414e50 99423->99425 99426 414e6a 99425->99426 99427 414e5e 99425->99427 99426->99422 99427->99426 99430 4152d0 LdrLoadDll 99427->99430 99429 414fbc 99429->99422 99430->99429 99432 414d85 99431->99432 99442 414a64 99431->99442 99432->99401 99435 414b90 99500 41a360 99435->99500 99436 414b73 99557 41a460 LdrLoadDll 99436->99557 99439 414bb7 99441 41bdc0 2 API calls 99439->99441 99440 414b7d 99440->99401 99444 414bc3 99441->99444 99442->99432 99497 419c50 99442->99497 99443 414d49 99446 41a490 2 API calls 99443->99446 99444->99440 99444->99443 99445 414d5f 99444->99445 99450 414c52 99444->99450 99566 414790 LdrLoadDll NtReadFile NtClose 99445->99566 99447 414d50 99446->99447 99447->99401 99449 414d72 99449->99401 99451 414cb9 99450->99451 99453 414c61 99450->99453 99451->99443 99452 414ccc 99451->99452 99559 41a2e0 99452->99559 99454 414c66 99453->99454 99455 414c7a 99453->99455 99558 414650 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 99454->99558 99458 414c97 99455->99458 99459 414c7f 99455->99459 99458->99447 99515 414410 99458->99515 99503 4146f0 99459->99503 99462 414c70 99462->99401 99464 414d2c 99563 41a490 99464->99563 99465 414c8d 99465->99401 99468 414caf 99468->99401 99469 414d38 99469->99401 99472 41b101 99470->99472 99471 41b113 99471->99404 99472->99471 99584 41bd40 99472->99584 99474 41b134 99477 41b157 99474->99477 99587 414070 99474->99587 99476 41b180 99476->99404 99477->99476 99478 414070 3 API calls 99477->99478 99480 41b179 99478->99480 99480->99476 99619 415390 99480->99619 99481 41b20a 99482 41b21a 99481->99482 99713 41af00 LdrLoadDll 99481->99713 99629 41ad70 99482->99629 99485 41b248 99708 419ec0 99485->99708 99489 419f0c 99488->99489 99490 41af60 LdrLoadDll 99489->99490 99491 419f1c 99490->99491 99741 1242c0a 99491->99741 99492 419f37 99494 41bdc0 99492->99494 99744 41a670 99494->99744 99496 41b359 99496->99371 99498 414b44 99497->99498 99499 41af60 LdrLoadDll 99497->99499 99498->99435 99498->99436 99498->99440 99499->99498 99501 41a37c NtCreateFile 99500->99501 99502 41af60 LdrLoadDll 99500->99502 99501->99439 99502->99501 99504 41470c 99503->99504 99505 41a2e0 LdrLoadDll 99504->99505 99506 41472d 99505->99506 99507 414734 99506->99507 99508 414748 99506->99508 99509 41a490 2 API calls 99507->99509 99510 41a490 2 API calls 99508->99510 99512 41473d 99509->99512 99511 414751 99510->99511 99567 41bfd0 LdrLoadDll RtlAllocateHeap 99511->99567 99512->99465 99514 41475c 99514->99465 99516 41445b 99515->99516 99517 41448e 99515->99517 99519 41a2e0 LdrLoadDll 99516->99519 99518 4145d9 99517->99518 99523 4144aa 99517->99523 99520 41a2e0 LdrLoadDll 99518->99520 99521 414476 99519->99521 99526 4145f4 99520->99526 99522 41a490 2 API calls 99521->99522 99524 41447f 99522->99524 99525 41a2e0 LdrLoadDll 99523->99525 99524->99468 99527 4144c5 99525->99527 99580 41a320 LdrLoadDll 99526->99580 99529 4144e1 99527->99529 99530 4144cc 99527->99530 99533 4144e6 99529->99533 99534 4144fc 99529->99534 99532 41a490 2 API calls 99530->99532 99531 41462e 99535 41a490 2 API calls 99531->99535 99536 4144d5 99532->99536 99537 41a490 2 API calls 99533->99537 99542 414501 99534->99542 99568 41bf90 99534->99568 99538 414639 99535->99538 99536->99468 99539 4144ef 99537->99539 99538->99468 99539->99468 99550 414513 99542->99550 99571 41a410 99542->99571 99543 414567 99544 41457e 99543->99544 99579 41a2a0 LdrLoadDll 99543->99579 99546 414585 99544->99546 99547 41459a 99544->99547 99548 41a490 2 API calls 99546->99548 99549 41a490 2 API calls 99547->99549 99548->99550 99551 4145a3 99549->99551 99550->99468 99552 4145cf 99551->99552 99574 41bb90 99551->99574 99552->99468 99554 4145ba 99555 41bdc0 2 API calls 99554->99555 99556 4145c3 99555->99556 99556->99468 99557->99440 99558->99462 99560 414d14 99559->99560 99561 41af60 LdrLoadDll 99559->99561 99562 41a320 LdrLoadDll 99560->99562 99561->99560 99562->99464 99564 41af60 LdrLoadDll 99563->99564 99565 41a4ac NtClose 99564->99565 99565->99469 99566->99449 99567->99514 99570 41bfa8 99568->99570 99581 41a630 99568->99581 99570->99542 99572 41a42c NtReadFile 99571->99572 99573 41af60 LdrLoadDll 99571->99573 99572->99543 99573->99572 99575 41bbb4 99574->99575 99576 41bb9d 99574->99576 99575->99554 99576->99575 99577 41bf90 2 API calls 99576->99577 99578 41bbcb 99577->99578 99578->99554 99579->99544 99580->99531 99582 41af60 LdrLoadDll 99581->99582 99583 41a64c RtlAllocateHeap 99582->99583 99583->99570 99714 41a540 99584->99714 99586 41bd6d 99586->99474 99588 414081 99587->99588 99590 414089 99587->99590 99588->99477 99589 41435c 99589->99477 99590->99589 99717 41cf30 99590->99717 99592 4140dd 99593 41cf30 2 API calls 99592->99593 99597 4140e8 99593->99597 99594 414136 99596 41cf30 2 API calls 99594->99596 99600 41414a 99596->99600 99597->99594 99598 41d060 3 API calls 99597->99598 99728 41cfd0 LdrLoadDll RtlAllocateHeap RtlFreeHeap 99597->99728 99598->99597 99599 4141a7 99601 41cf30 2 API calls 99599->99601 99600->99599 99722 41d060 99600->99722 99603 4141bd 99601->99603 99604 4141fa 99603->99604 99606 41d060 3 API calls 99603->99606 99605 41cf30 2 API calls 99604->99605 99607 414205 99605->99607 99606->99603 99608 41d060 3 API calls 99607->99608 99614 41423f 99607->99614 99608->99607 99610 414334 99730 41cf90 LdrLoadDll RtlFreeHeap 99610->99730 99612 41433e 99731 41cf90 LdrLoadDll RtlFreeHeap 99612->99731 99729 41cf90 LdrLoadDll RtlFreeHeap 99614->99729 99615 414348 99732 41cf90 LdrLoadDll RtlFreeHeap 99615->99732 99617 414352 99733 41cf90 LdrLoadDll RtlFreeHeap 99617->99733 99620 4153a1 99619->99620 99621 414a50 8 API calls 99620->99621 99623 4153b7 99621->99623 99622 41540a 99622->99481 99623->99622 99624 4153f2 99623->99624 99625 415405 99623->99625 99626 41bdc0 2 API calls 99624->99626 99627 41bdc0 2 API calls 99625->99627 99628 4153f7 99626->99628 99627->99622 99628->99481 99630 41ad84 99629->99630 99631 41ac30 LdrLoadDll 99629->99631 99734 41ac30 99630->99734 99631->99630 99634 41ac30 LdrLoadDll 99635 41ad96 99634->99635 99636 41ac30 LdrLoadDll 99635->99636 99637 41ad9f 99636->99637 99638 41ac30 LdrLoadDll 99637->99638 99639 41ada8 99638->99639 99640 41ac30 LdrLoadDll 99639->99640 99641 41adb1 99640->99641 99642 41ac30 LdrLoadDll 99641->99642 99643 41adbd 99642->99643 99644 41ac30 LdrLoadDll 99643->99644 99645 41adc6 99644->99645 99646 41ac30 LdrLoadDll 99645->99646 99647 41adcf 99646->99647 99648 41ac30 LdrLoadDll 99647->99648 99649 41add8 99648->99649 99650 41ac30 LdrLoadDll 99649->99650 99651 41ade1 99650->99651 99652 41ac30 LdrLoadDll 99651->99652 99653 41adea 99652->99653 99654 41ac30 LdrLoadDll 99653->99654 99655 41adf6 99654->99655 99656 41ac30 LdrLoadDll 99655->99656 99657 41adff 99656->99657 99658 41ac30 LdrLoadDll 99657->99658 99659 41ae08 99658->99659 99660 41ac30 LdrLoadDll 99659->99660 99661 41ae11 99660->99661 99662 41ac30 LdrLoadDll 99661->99662 99663 41ae1a 99662->99663 99664 41ac30 LdrLoadDll 99663->99664 99665 41ae23 99664->99665 99666 41ac30 LdrLoadDll 99665->99666 99667 41ae2f 99666->99667 99668 41ac30 LdrLoadDll 99667->99668 99669 41ae38 99668->99669 99670 41ac30 LdrLoadDll 99669->99670 99671 41ae41 99670->99671 99672 41ac30 LdrLoadDll 99671->99672 99673 41ae4a 99672->99673 99674 41ac30 LdrLoadDll 99673->99674 99675 41ae53 99674->99675 99676 41ac30 LdrLoadDll 99675->99676 99677 41ae5c 99676->99677 99678 41ac30 LdrLoadDll 99677->99678 99679 41ae68 99678->99679 99680 41ac30 LdrLoadDll 99679->99680 99681 41ae71 99680->99681 99682 41ac30 LdrLoadDll 99681->99682 99683 41ae7a 99682->99683 99684 41ac30 LdrLoadDll 99683->99684 99685 41ae83 99684->99685 99686 41ac30 LdrLoadDll 99685->99686 99687 41ae8c 99686->99687 99688 41ac30 LdrLoadDll 99687->99688 99689 41ae95 99688->99689 99690 41ac30 LdrLoadDll 99689->99690 99691 41aea1 99690->99691 99692 41ac30 LdrLoadDll 99691->99692 99693 41aeaa 99692->99693 99694 41ac30 LdrLoadDll 99693->99694 99695 41aeb3 99694->99695 99696 41ac30 LdrLoadDll 99695->99696 99697 41aebc 99696->99697 99698 41ac30 LdrLoadDll 99697->99698 99699 41aec5 99698->99699 99700 41ac30 LdrLoadDll 99699->99700 99701 41aece 99700->99701 99702 41ac30 LdrLoadDll 99701->99702 99703 41aeda 99702->99703 99704 41ac30 LdrLoadDll 99703->99704 99705 41aee3 99704->99705 99706 41ac30 LdrLoadDll 99705->99706 99707 41aeec 99706->99707 99707->99485 99709 41af60 LdrLoadDll 99708->99709 99710 419edc 99709->99710 99740 1242df0 LdrInitializeThunk 99710->99740 99711 419ef3 99711->99404 99713->99482 99715 41af60 LdrLoadDll 99714->99715 99716 41a55c NtAllocateVirtualMemory 99715->99716 99716->99586 99718 41cf40 99717->99718 99719 41cf46 99717->99719 99718->99592 99720 41bf90 2 API calls 99719->99720 99721 41cf6c 99720->99721 99721->99592 99723 41cfd0 99722->99723 99724 41d02d 99723->99724 99725 41bf90 2 API calls 99723->99725 99724->99600 99726 41d00a 99725->99726 99727 41bdc0 2 API calls 99726->99727 99727->99724 99728->99597 99729->99610 99730->99612 99731->99615 99732->99617 99733->99589 99735 41ac4b 99734->99735 99736 414e50 LdrLoadDll 99735->99736 99737 41ac6b 99736->99737 99738 414e50 LdrLoadDll 99737->99738 99739 41ad17 99737->99739 99738->99739 99739->99634 99740->99711 99742 1242c11 99741->99742 99743 1242c1f LdrInitializeThunk 99741->99743 99742->99492 99743->99492 99745 41a68c RtlFreeHeap 99744->99745 99746 41af60 LdrLoadDll 99744->99746 99745->99496 99746->99745 99748 407eb0 99747->99748 99749 407eab 99747->99749 99750 41bd40 2 API calls 99748->99750 99749->99412 99751 407ed5 99750->99751 99752 407f38 99751->99752 99753 419ec0 2 API calls 99751->99753 99754 407f3e 99751->99754 99759 41bd40 2 API calls 99751->99759 99763 41a5c0 99751->99763 99752->99412 99753->99751 99755 407f64 99754->99755 99757 41a5c0 2 API calls 99754->99757 99755->99412 99758 407f55 99757->99758 99758->99412 99759->99751 99761 40817e 99760->99761 99762 41a5c0 2 API calls 99760->99762 99761->99373 99762->99761 99764 41af60 LdrLoadDll 99763->99764 99765 41a5dc 99764->99765 99768 1242c70 LdrInitializeThunk 99765->99768 99766 41a5f3 99766->99751 99768->99766 99770 41b5c3 99769->99770 99773 40acf0 99770->99773 99772 409c5b 99772->99381 99775 40ad14 99773->99775 99774 40ad1b 99774->99772 99775->99774 99776 40ad50 LdrLoadDll 99775->99776 99777 40ad67 99775->99777 99776->99777 99777->99772 99779 40b063 99778->99779 99779->99779 99781 40b0e0 99779->99781 99793 419c90 LdrLoadDll 99779->99793 99781->99386 99783 41af60 LdrLoadDll 99782->99783 99784 40f1bb 99783->99784 99784->99389 99785 41a7d0 99784->99785 99786 41a7ef LookupPrivilegeValueW 99785->99786 99787 41af60 LdrLoadDll 99785->99787 99786->99391 99787->99786 99789 41a27c 99788->99789 99790 41af60 LdrLoadDll 99788->99790 99794 1242ea0 LdrInitializeThunk 99789->99794 99790->99789 99791 41a29b 99791->99392 99793->99781 99794->99791 99796 40b1f0 99795->99796 99797 40b040 LdrLoadDll 99796->99797 99798 40b204 99797->99798 99798->99328 99800 40ae51 99799->99800 99801 40ae4d 99799->99801 99802 40ae6a 99800->99802 99803 40ae9c 99800->99803 99801->99330 99845 419cd0 LdrLoadDll 99802->99845 99846 419cd0 LdrLoadDll 99803->99846 99805 40aead 99805->99330 99807 40ae8c 99807->99330 99809 40f4a0 3 API calls 99808->99809 99810 4143c6 99808->99810 99809->99810 99810->99332 99813 408a79 99811->99813 99847 4087a0 99811->99847 99814 4087a0 19 API calls 99813->99814 99817 408a9d 99813->99817 99815 408a8a 99814->99815 99815->99817 99865 40f710 10 API calls 99815->99865 99817->99334 99819 41af60 LdrLoadDll 99818->99819 99820 41a51c 99819->99820 99984 1242e80 LdrInitializeThunk 99820->99984 99821 40c322 99823 40f4a0 99821->99823 99824 40f4bd 99823->99824 99985 419fc0 99824->99985 99827 40f505 99827->99339 99828 41a010 2 API calls 99829 40f52e 99828->99829 99829->99339 99831 41af60 LdrLoadDll 99830->99831 99832 41a02c 99831->99832 99991 1242d10 LdrInitializeThunk 99832->99991 99833 40c385 99833->99344 99833->99347 99836 41af60 LdrLoadDll 99835->99836 99837 41a07c 99836->99837 99992 1242d30 LdrInitializeThunk 99837->99992 99838 40c459 99838->99355 99841 41af60 LdrLoadDll 99840->99841 99842 419e3c 99841->99842 99993 1242fb0 LdrInitializeThunk 99842->99993 99843 40c4ac 99843->99359 99845->99807 99846->99805 99848 407ea0 4 API calls 99847->99848 99855 4087ba 99847->99855 99848->99855 99849 408a49 99849->99813 99850 408a3f 99851 408160 2 API calls 99850->99851 99851->99849 99854 419f00 2 API calls 99854->99855 99855->99849 99855->99850 99855->99854 99857 41a490 LdrLoadDll NtClose 99855->99857 99860 40c4c0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk LdrInitializeThunk 99855->99860 99863 419e20 2 API calls 99855->99863 99866 419d10 99855->99866 99869 4085d0 99855->99869 99881 40f5f0 LdrLoadDll NtClose 99855->99881 99882 419d90 LdrLoadDll 99855->99882 99883 419dc0 LdrLoadDll 99855->99883 99884 419e50 LdrLoadDll 99855->99884 99885 4083a0 99855->99885 99901 405f60 LdrLoadDll 99855->99901 99857->99855 99860->99855 99863->99855 99865->99817 99867 41af60 LdrLoadDll 99866->99867 99868 419d2c 99867->99868 99868->99855 99870 4085e6 99869->99870 99902 419880 99870->99902 99872 4085ff 99877 408771 99872->99877 99923 4081a0 99872->99923 99874 4086e5 99875 4083a0 11 API calls 99874->99875 99874->99877 99876 408713 99875->99876 99876->99877 99878 419f00 2 API calls 99876->99878 99877->99855 99879 408748 99878->99879 99879->99877 99880 41a500 2 API calls 99879->99880 99880->99877 99881->99855 99882->99855 99883->99855 99884->99855 99886 4083c9 99885->99886 99963 408310 99886->99963 99889 41a500 2 API calls 99891 4083dc 99889->99891 99890 408467 99890->99855 99891->99889 99891->99890 99892 408462 99891->99892 99971 40f670 99891->99971 99893 41a490 2 API calls 99892->99893 99894 40849a 99893->99894 99894->99890 99895 419d10 LdrLoadDll 99894->99895 99896 4084ff 99895->99896 99896->99890 99975 419d50 99896->99975 99898 408563 99898->99890 99899 414a50 8 API calls 99898->99899 99900 4085b8 99899->99900 99900->99855 99901->99855 99903 41bf90 2 API calls 99902->99903 99904 419897 99903->99904 99930 409310 99904->99930 99906 4198b2 99907 4198f0 99906->99907 99908 4198d9 99906->99908 99911 41bd40 2 API calls 99907->99911 99909 41bdc0 2 API calls 99908->99909 99910 4198e6 99909->99910 99910->99872 99912 41992a 99911->99912 99913 41bd40 2 API calls 99912->99913 99914 419943 99913->99914 99920 419be4 99914->99920 99936 41bd80 99914->99936 99917 419bd0 99918 41bdc0 2 API calls 99917->99918 99919 419bda 99918->99919 99919->99872 99921 41bdc0 2 API calls 99920->99921 99922 419c39 99921->99922 99922->99872 99924 40829f 99923->99924 99925 4081b5 99923->99925 99924->99874 99925->99924 99926 414a50 8 API calls 99925->99926 99927 408222 99926->99927 99928 41bdc0 2 API calls 99927->99928 99929 408249 99927->99929 99928->99929 99929->99874 99931 409335 99930->99931 99932 40acf0 LdrLoadDll 99931->99932 99933 409368 99932->99933 99935 40938d 99933->99935 99939 40cf20 99933->99939 99935->99906 99957 41a580 99936->99957 99940 40cf4c 99939->99940 99941 41a1e0 LdrLoadDll 99940->99941 99942 40cf65 99941->99942 99943 40cf6c 99942->99943 99950 41a220 99942->99950 99943->99935 99947 40cfa7 99948 41a490 2 API calls 99947->99948 99949 40cfca 99948->99949 99949->99935 99951 41a23c 99950->99951 99952 41af60 LdrLoadDll 99950->99952 99956 1242ca0 LdrInitializeThunk 99951->99956 99952->99951 99953 40cf8f 99953->99943 99955 41a810 LdrLoadDll 99953->99955 99955->99947 99956->99953 99958 41af60 LdrLoadDll 99957->99958 99959 41a59c 99958->99959 99962 1242f90 LdrInitializeThunk 99959->99962 99960 419bc9 99960->99917 99960->99920 99962->99960 99964 408328 99963->99964 99965 40acf0 LdrLoadDll 99964->99965 99966 408343 99965->99966 99967 414e50 LdrLoadDll 99966->99967 99968 408353 99967->99968 99969 40835c PostThreadMessageW 99968->99969 99970 408370 99968->99970 99969->99970 99970->99891 99972 40f683 99971->99972 99978 419e90 99972->99978 99976 41af60 LdrLoadDll 99975->99976 99977 419d6c 99976->99977 99977->99898 99979 419eac 99978->99979 99980 41af60 LdrLoadDll 99978->99980 99983 1242dd0 LdrInitializeThunk 99979->99983 99980->99979 99981 40f6ae 99981->99891 99983->99981 99984->99821 99986 41af60 LdrLoadDll 99985->99986 99987 419fdc 99986->99987 99990 1242f30 LdrInitializeThunk 99987->99990 99988 40f4fe 99988->99827 99988->99828 99990->99988 99991->99833 99992->99838 99993->99843 99997 1242ad0 LdrInitializeThunk

                                                              Executed Functions

                                                              Function 0041A410 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36filenativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 0 41a410-41a426 1 41a42c-41a459 NtReadFile 0->1 2 41a427 call 41af60 0->2 2->1
                                                              APIs
                                                              • NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A455
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FileRead
                                                              • String ID: 1JA$rMA$rMA
                                                              • API String ID: 2738559852-782607585
                                                              • Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                              • Instruction ID: c6e97d42c3e85b78cd3a41c20c82dd28da71633a8e67c8174f08c115ef6e08ba
                                                              • Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
                                                              • Instruction Fuzzy Hash: 87F0B7B2200208AFCB14DF89DC81EEB77ADEF8C754F158249BE1D97241D630E851CBA4
                                                              Function 0041A40A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 33filenativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 3 41a40a-41a459 call 41af60 NtReadFile
                                                              APIs
                                                              • NtReadFile.NTDLL(rMA,5EB65239,FFFFFFFF,?,?,?,rMA,?,1JA,FFFFFFFF,5EB65239,00414D72,?,00000000), ref: 0041A455
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FileRead
                                                              • String ID: 1JA$rMA$rMA
                                                              • API String ID: 2738559852-782607585
                                                              • Opcode ID: 04ce376e678edcdb9751289a0f82548d436417c29a13e682c939fe5dcdc6d76c
                                                              • Instruction ID: b0d4b4de7d76c8bf591afcef4104654b5335bd7ab6703c25e51113693fc8203e
                                                              • Opcode Fuzzy Hash: 04ce376e678edcdb9751289a0f82548d436417c29a13e682c939fe5dcdc6d76c
                                                              • Instruction Fuzzy Hash: B1F01DB6200149ABCB04DF98D990CEB77ADFF8C314B15864DF95D97201C634E8558BA4
                                                              Function 0040ACF0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 219 40acf0-40ad0c 220 40ad14-40ad19 219->220 221 40ad0f call 41cc50 219->221 222 40ad1b-40ad1e 220->222 223 40ad1f-40ad2d call 41d070 220->223 221->220 226 40ad3d-40ad4e call 41b4a0 223->226 227 40ad2f-40ad3a call 41d2f0 223->227 232 40ad50-40ad64 LdrLoadDll 226->232 233 40ad67-40ad6a 226->233 227->226 232->233
                                                              APIs
                                                              • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD62
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: Load
                                                              • String ID:
                                                              • API String ID: 2234796835-0
                                                              • Opcode ID: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                                              • Instruction ID: bd03027937dafe21d6f438616a486266aae6a772261e1344982784e00def1180
                                                              • Opcode Fuzzy Hash: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                                              • Instruction Fuzzy Hash: 80015EB5E0020DBBDF10DBA1DC42FDEB3789F54308F0045AAA908A7281F634EB548B95
                                                              Function 0041A35A Relevance: 1.5, APIs: 1, Instructions: 44filenativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 234 41a35a-41a3b1 call 41af60 NtCreateFile
                                                              APIs
                                                              • NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A3AD
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: CreateFile
                                                              • String ID:
                                                              • API String ID: 823142352-0
                                                              • Opcode ID: b7c82dd204dac21fe647372479e01c61b9d40f16f17e88d6db4b886f29bcc5fb
                                                              • Instruction ID: 159411f34822f584cba13318e380b0e6d4baf2e06112cf03047d7a0e9d554c69
                                                              • Opcode Fuzzy Hash: b7c82dd204dac21fe647372479e01c61b9d40f16f17e88d6db4b886f29bcc5fb
                                                              • Instruction Fuzzy Hash: 4401EFB2201208AFCB48CF88CC81EEB37E9AF8C754F158609FA0DD7241D630E8518BA0
                                                              Function 0041A360 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 243 41a360-41a376 244 41a37c-41a3b1 NtCreateFile 243->244 245 41a377 call 41af60 243->245 245->244
                                                              APIs
                                                              • NtCreateFile.NTDLL(00000060,00409CF3,?,00414BB7,00409CF3,FFFFFFFF,?,?,FFFFFFFF,00409CF3,00414BB7,?,00409CF3,00000060,00000000,00000000), ref: 0041A3AD
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: CreateFile
                                                              • String ID:
                                                              • API String ID: 823142352-0
                                                              • Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                              • Instruction ID: 1571a74e51eef41835f20cf1113afde9e84efeac6e640e2865a3d9423fa4fe5b
                                                              • Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
                                                              • Instruction Fuzzy Hash: FEF0BDB2201208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4
                                                              Function 0041A540 Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 246 41a540-41a57d call 41af60 NtAllocateVirtualMemory
                                                              APIs
                                                              • NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041B134,?,00000000,?,00003000,00000040,00000000,00000000,00409CF3), ref: 0041A579
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: AllocateMemoryVirtual
                                                              • String ID:
                                                              • API String ID: 2167126740-0
                                                              • Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                              • Instruction ID: 60dc777ab2a5703fe93ec60752bbea5a413bae98553eb5929f98badcd8fbe991
                                                              • Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
                                                              • Instruction Fuzzy Hash: B2F015B2200208ABCB14DF89CC81EEB77ADEF8C754F158149BE0897241C630F811CBA4
                                                              Function 0041A490 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 258 41a490-41a4b9 call 41af60 NtClose
                                                              APIs
                                                              • NtClose.NTDLL(00414D50,?,?,00414D50,00409CF3,FFFFFFFF), ref: 0041A4B5
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: Close
                                                              • String ID:
                                                              • API String ID: 3535843008-0
                                                              • Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                              • Instruction ID: a008c5d5ec14fa9f5013d94ab86a46559dd82bf248144eb087863a0ac6a31d62
                                                              • Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
                                                              • Instruction Fuzzy Hash: F7D01776200218ABD710EB99CC85EE77BACEF48B64F158499BA1C9B242C530FA1086E0
                                                              Function 01242B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 4746441f029d4c570bcbd91c3b6132a75a92ff0bbf6a93f9a94eae21dca33a2b
                                                              • Instruction ID: 5c7c0238fba1c73f7cc83625b2fe6c2888bc1f533dca3138dad41bad6e2145fb
                                                              • Opcode Fuzzy Hash: 4746441f029d4c570bcbd91c3b6132a75a92ff0bbf6a93f9a94eae21dca33a2b
                                                              • Instruction Fuzzy Hash: 7190027121240003424571594454616400A97E0201B55C021F6014590DC57589916625
                                                              Function 01242BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 279e924aeabcabe01ace42e67d5f8ea81c3507051967c90c612ce67f42805029
                                                              • Instruction ID: 94f665e70004cc09e0cadb6935f9d426334cd8af84c8823ffd237d98bf110875
                                                              • Opcode Fuzzy Hash: 279e924aeabcabe01ace42e67d5f8ea81c3507051967c90c612ce67f42805029
                                                              • Instruction Fuzzy Hash: 2590023121140802D2C07159444464A000597D1301F95C015B5025654DCA658B597BA1
                                                              Function 01242AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 07f580e769a1c30165985320416c917caa2dbba632c90bbb7d5d228851de15bd
                                                              • Instruction ID: a2d77afac31d66b7a1d0d4f98fe0a40b2774339dbda4608dc6b417ac93384ba9
                                                              • Opcode Fuzzy Hash: 07f580e769a1c30165985320416c917caa2dbba632c90bbb7d5d228851de15bd
                                                              • Instruction Fuzzy Hash: 9F900435331400030345F55D07445070047D7D5351355C031F7015550CD771CD715731
                                                              Function 01242D30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 0cd7ae13155315505a68ac50261cca2b3ea7ee2012d14ad8bc31f27d682a74b2
                                                              • Instruction ID: a580fc5e8a49403d7bcba487ccb7f0a1ebb0bfa54a22c7247eea2c7afa0ca49a
                                                              • Opcode Fuzzy Hash: 0cd7ae13155315505a68ac50261cca2b3ea7ee2012d14ad8bc31f27d682a74b2
                                                              • Instruction Fuzzy Hash: 9F90043131140003D3C0715D545C7074005F7F1301F55D011F5414554CDD75CD575733
                                                              Function 01242D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 09a9ee31208c3108162fda930ea9726602ca580d1fee62eb394c20f7f07cc63d
                                                              • Instruction ID: ffb5d689857f4f88c05f7065ce917ff1630b03ce4db7116b9276bbdf6a19ae05
                                                              • Opcode Fuzzy Hash: 09a9ee31208c3108162fda930ea9726602ca580d1fee62eb394c20f7f07cc63d
                                                              • Instruction Fuzzy Hash: DF90023922340002D2C07159544860A000597D1202F95D415B5015558CC96589695721
                                                              Function 01242DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 84247be2328a993e9c58b58bafeb15945a9e811c39b06e41c8d4d544a75318f7
                                                              • Instruction ID: 98db21d988034ed16a87f758177aebc08f776dc87f6f9440308af2bd87f75647
                                                              • Opcode Fuzzy Hash: 84247be2328a993e9c58b58bafeb15945a9e811c39b06e41c8d4d544a75318f7
                                                              • Instruction Fuzzy Hash: CC90023121140413D25171594544707000997D0241F95C412B5424558DD6A68A52A621
                                                              Function 01242DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 272c9a57a1eefe008bea2f3cf549958b62e7b2ca6a66a51ae53bbc6caf10377b
                                                              • Instruction ID: ead16f174bc6f39f7e8c888af5871e6bb84235d6314fe6cea0e21be988a39fbe
                                                              • Opcode Fuzzy Hash: 272c9a57a1eefe008bea2f3cf549958b62e7b2ca6a66a51ae53bbc6caf10377b
                                                              • Instruction Fuzzy Hash: 7E900231252441525685B15944445074006A7E0241795C012B6414950CC5769956DB21
                                                              Function 01242C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: bc6d07b9b6cdc8bdaca0271b510c3bdcc3a4b085af10d17437b1fc5dc4194ee8
                                                              • Instruction ID: 7930b4c06c5b7e417946dcf5a6a56061c38e1acede83bfd8a73b4c8eb29d6120
                                                              • Opcode Fuzzy Hash: bc6d07b9b6cdc8bdaca0271b510c3bdcc3a4b085af10d17437b1fc5dc4194ee8
                                                              • Instruction Fuzzy Hash: F890023121148802D2507159844474A000597D0301F59C411B9424658DC6E589917621
                                                              Function 01242CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 61cfd23165aa84d4b3ec5224bb64382a13ac3c0d1c31533bd3cf01c65f99a233
                                                              • Instruction ID: b0383bdd84baa7e1cc8dbdf43aa429df889ceb90b4f7cc1bce2d5a1f3fec9331
                                                              • Opcode Fuzzy Hash: 61cfd23165aa84d4b3ec5224bb64382a13ac3c0d1c31533bd3cf01c65f99a233
                                                              • Instruction Fuzzy Hash: 1C90023121140402D24075995448646000597E0301F55D011BA024555EC6B589916631
                                                              Function 01242F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: c9fcfbea35eecd90e5efc1f2cf63b685748ab2a1fd8fac965fb1993292b1c9f4
                                                              • Instruction ID: da3090ad5d0eddd5acb94cd77dea3138e0d28238524230579af08d6733388f94
                                                              • Opcode Fuzzy Hash: c9fcfbea35eecd90e5efc1f2cf63b685748ab2a1fd8fac965fb1993292b1c9f4
                                                              • Instruction Fuzzy Hash: CF90027135140442D24071594454B060005D7E1301F55C015F6064554DC669CD526626
                                                              Function 01242FB0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 4820eb0728baf28c27cd8fa6ad1e40a9e3f6fbb547a5415b652f6776498d8430
                                                              • Instruction ID: 6baf02e025c69868321cc0575ad541d6f84238380a8d7abab2545b33fb79ff04
                                                              • Opcode Fuzzy Hash: 4820eb0728baf28c27cd8fa6ad1e40a9e3f6fbb547a5415b652f6776498d8430
                                                              • Instruction Fuzzy Hash: 71900231611400424280716988849064005BBE1211755C121B5998550DC5A989655B65
                                                              Function 01242F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 897ae593f114aa6d79bd420e5dfa279f76bb8dcbecbb80318896703b63c68dea
                                                              • Instruction ID: 5762d9ac3ccf03b4265bbaadb9d957fc4a4091f2cbb8c477cdd2f4b414cbbdd6
                                                              • Opcode Fuzzy Hash: 897ae593f114aa6d79bd420e5dfa279f76bb8dcbecbb80318896703b63c68dea
                                                              • Instruction Fuzzy Hash: 2D90023121180402D2407159485470B000597D0302F55C011B6164555DC67589516A71
                                                              Function 01242FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 808d0b99c0098296049c8b628c8554b8f371abb8d30830a3f941a3943a3c9ce9
                                                              • Instruction ID: 3e5da7e740c34551531ac2745760ba8e6c50e368f8d3aa56d0f0ba9a78e7e4a8
                                                              • Opcode Fuzzy Hash: 808d0b99c0098296049c8b628c8554b8f371abb8d30830a3f941a3943a3c9ce9
                                                              • Instruction Fuzzy Hash: 21900231221C0042D34075694C54B07000597D0303F55C115B5154554CC96589615A21
                                                              Function 01242EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 7c6756c321e1c8792dbe5810b9552b8a1cf91a5c0be5f40f3c017803f28f7fb8
                                                              • Instruction ID: 7c10b9d7efe5c3d4004282a2bb692aeb5fe9051274957aaf34b9dd05aabec876
                                                              • Opcode Fuzzy Hash: 7c6756c321e1c8792dbe5810b9552b8a1cf91a5c0be5f40f3c017803f28f7fb8
                                                              • Instruction Fuzzy Hash: 7190027121140402D28071594444746000597D0301F55C011BA064554EC6A98ED56B65
                                                              Function 01242E80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 18283f478527c96135878eaf690bc2f5156f7c427867ce1b8025c598206eb8b5
                                                              • Instruction ID: ace02c67bdb3ecb4835ef858f626092117084e08289153d2b9c9f325b3ee66ab
                                                              • Opcode Fuzzy Hash: 18283f478527c96135878eaf690bc2f5156f7c427867ce1b8025c598206eb8b5
                                                              • Instruction Fuzzy Hash: 9190023161140502D24171594444616000A97D0241F95C022B6024555ECA758A92A631
                                                              Function 00409AB0 Relevance: .1, Instructions: 92COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: bf70d19deb8b7dbf65a1c14f2d3141162741e3067e6603a799ea80fa30cdc1c2
                                                              • Instruction ID: 0b46cc9625fd597f0f1293e0fe630cc8c1f9f1e3f005c30533d49d025d22dd75
                                                              • Opcode Fuzzy Hash: bf70d19deb8b7dbf65a1c14f2d3141162741e3067e6603a799ea80fa30cdc1c2
                                                              • Instruction Fuzzy Hash: 97210AB2D4020857CB25D674AD52BFF73BCAB54314F04007FE949A3182F638BE498BA5
                                                              Function 0041A630 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 6 41a630-41a661 call 41af60 RtlAllocateHeap
                                                              APIs
                                                              • RtlAllocateHeap.NTDLL(6EA,?,00414CAF,00414CAF,?,00414536,?,?,?,?,?,00000000,00409CF3,?), ref: 0041A65D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: AllocateHeap
                                                              • String ID: 6EA
                                                              • API String ID: 1279760036-1400015478
                                                              • Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                              • Instruction ID: b63900df46c74d48569035b2bcc9be016157083d4ef88d1b541c797289a4eec1
                                                              • Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
                                                              • Instruction Fuzzy Hash: 46E012B1200208ABDB14EF99CC41EA777ACEF88664F158559BA085B242C630F9118AB0
                                                              Function 00408310 Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 204 408310-40835a call 41be60 call 41ca00 call 40acf0 call 414e50 213 40835c-40836e PostThreadMessageW 204->213 214 40838e-408392 204->214 215 408370-40838a call 40a480 213->215 216 40838d 213->216 215->216 216->214
                                                              APIs
                                                              • PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040836A
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: MessagePostThread
                                                              • String ID:
                                                              • API String ID: 1836367815-0
                                                              • Opcode ID: eeb461d9a93cfa80389428809ed4c10d2a707c26e4e5d313531af448f679d8da
                                                              • Instruction ID: fe648ddaccc693dff6b318d6e20673cc1517f8ca6da234ac2c2ad493b9bfa733
                                                              • Opcode Fuzzy Hash: eeb461d9a93cfa80389428809ed4c10d2a707c26e4e5d313531af448f679d8da
                                                              • Instruction Fuzzy Hash: FF018431A8032C76E721A6959C43FFE776C5B40F54F05011AFF04BA1C2EAA8690546EA
                                                              Function 0041A7C2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 237 41a7c2-41a7cb 238 41a7cd-41a7ea call 41af60 237->238 239 41a7ac-41a7c0 237->239 242 41a7ef-41a804 LookupPrivilegeValueW 238->242
                                                              APIs
                                                              • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A800
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: LookupPrivilegeValue
                                                              • String ID:
                                                              • API String ID: 3899507212-0
                                                              • Opcode ID: a496f38d62274ef6293b7414ddfcee86aa1f2983a0e4186dedcc86b2506cb2a9
                                                              • Instruction ID: d99af1ccc2e3a41905549a2c7186a1e47417f692c9093ccbc51682857587e646
                                                              • Opcode Fuzzy Hash: a496f38d62274ef6293b7414ddfcee86aa1f2983a0e4186dedcc86b2506cb2a9
                                                              • Instruction Fuzzy Hash: 3AF049B62001187FDB14DFA9DC84EEB37A9EF88350F108519F91CD7281C631E9518BB4
                                                              Function 0041A662 Relevance: 1.5, APIs: 1, Instructions: 25memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 249 41a662-41a687 call 41af60 251 41a68c-41a6a1 RtlFreeHeap 249->251
                                                              APIs
                                                              • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A69D
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FreeHeap
                                                              • String ID:
                                                              • API String ID: 3298025750-0
                                                              • Opcode ID: f328f87049165c24a51f13d9e7a0f1effd32b804806cab775e60eade8b30b86c
                                                              • Instruction ID: 361753aced8246878da85d9549347fae3a264afc1108e3ae6c6f607104c80fd3
                                                              • Opcode Fuzzy Hash: f328f87049165c24a51f13d9e7a0f1effd32b804806cab775e60eade8b30b86c
                                                              • Instruction Fuzzy Hash: 53E068B41042850FD700EE79949049F37D4FF80328724865BEC584B307D024C45B8761
                                                              Function 0041A670 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 252 41a670-41a686 253 41a68c-41a6a1 RtlFreeHeap 252->253 254 41a687 call 41af60 252->254 254->253
                                                              APIs
                                                              • RtlFreeHeap.NTDLL(00000060,00409CF3,?,?,00409CF3,00000060,00000000,00000000,?,?,00409CF3,?,00000000), ref: 0041A69D
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FreeHeap
                                                              • String ID:
                                                              • API String ID: 3298025750-0
                                                              • Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                              • Instruction ID: 086aab0bc8c344d6c60c9bbd5a0512cabfd8005857d16272e4a7e29987098a06
                                                              • Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
                                                              • Instruction Fuzzy Hash: C1E012B1200208ABDB18EF99CC49EA777ACEF88764F118559BA085B242C630E9108AB0
                                                              Function 0041A7D0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 255 41a7d0-41a7e9 256 41a7ef-41a804 LookupPrivilegeValueW 255->256 257 41a7ea call 41af60 255->257 257->256
                                                              APIs
                                                              • LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1D2,0040F1D2,0000003C,00000000,?,00409D65), ref: 0041A800
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: LookupPrivilegeValue
                                                              • String ID:
                                                              • API String ID: 3899507212-0
                                                              • Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                              • Instruction ID: 3f9aab8e47c10174471559fee5d267dc63a882ce56825bdd12c8e63267ac542a
                                                              • Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
                                                              • Instruction Fuzzy Hash: 23E01AB12002086BDB10DF49CC85EE737ADEF88654F118155BA0C57241C934E8118BF5
                                                              Function 0041A6B0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A6D8
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ExitProcess
                                                              • String ID:
                                                              • API String ID: 621844428-0
                                                              • Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                              • Instruction ID: 671013aba82168957284564a3a9f05bc2528e3e40ec9789e05460755300894f7
                                                              • Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
                                                              • Instruction Fuzzy Hash: 68D017726002187BD620EB99CC85FD777ACDF48BA4F1580A9BA1C6B242C531BA108AE1
                                                              Function 01242C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 213c354f2c1a88c10484b0fc24d2b6fac4c9404f18d22cf5a4318083a4cef361
                                                              • Instruction ID: 75162655c44f582924a55691d7ee7324698b66e9679f3ba7ce2d8b524c546d63
                                                              • Opcode Fuzzy Hash: 213c354f2c1a88c10484b0fc24d2b6fac4c9404f18d22cf5a4318083a4cef361
                                                              • Instruction Fuzzy Hash: D9B09B719115D5C6DB56E7655608717790077D0701F16C061F3030641F4778C1D1E775

                                                              Non-executed Functions

                                                              Function 01282349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
                                                              • API String ID: 0-2160512332
                                                              • Opcode ID: 594728e40b0bdb571b656a2aa92218ba52bb5c2f421070530680581074288216
                                                              • Instruction ID: d7d4a4e6b80a6ddd2a25f44cc52028f2d6e173ac1d31a78a41de82846d1f82a3
                                                              • Opcode Fuzzy Hash: 594728e40b0bdb571b656a2aa92218ba52bb5c2f421070530680581074288216
                                                              • Instruction Fuzzy Hash: F0929D71625742EFE725EE19C840B6BBBE8BB84714F04492DFB94D7290D770E844CB92
                                                              Function 01238620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • Thread is in a state in which it cannot own a critical section, xrefs: 01275543
                                                              • Invalid debug info address of this critical section, xrefs: 012754B6
                                                              • Address of the debug info found in the active list., xrefs: 012754AE, 012754FA
                                                              • Critical section address., xrefs: 01275502
                                                              • Critical section debug info address, xrefs: 0127541F, 0127552E
                                                              • double initialized or corrupted critical section, xrefs: 01275508
                                                              • 8, xrefs: 012752E3
                                                              • Critical section address, xrefs: 01275425, 012754BC, 01275534
                                                              • Thread identifier, xrefs: 0127553A
                                                              • First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 012754E2
                                                              • corrupted critical section, xrefs: 012754C2
                                                              • Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 012754CE
                                                              • undeleted critical section in freed memory, xrefs: 0127542B
                                                              • Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 0127540A, 01275496, 01275519
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
                                                              • API String ID: 0-2368682639
                                                              • Opcode ID: 541d82d5ceb9f51d834bb588a241fea960cff265c464f8883655fe21d2c6f360
                                                              • Instruction ID: 88cb6c60a1352525848147c6ffe7a78c1969c3113926f76f86f9a0e1f959cdc5
                                                              • Opcode Fuzzy Hash: 541d82d5ceb9f51d834bb588a241fea960cff265c464f8883655fe21d2c6f360
                                                              • Instruction Fuzzy Hash: B781A9B1A10759EFDB24CF9AC849BAEBBF5FB48B14F144119F604B7280C3B1A841CB60
                                                              Function 012329F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 01272498
                                                              • SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 012722E4
                                                              • SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 01272602
                                                              • RtlpResolveAssemblyStorageMapEntry, xrefs: 0127261F
                                                              • @, xrefs: 0127259B
                                                              • SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 012725EB
                                                              • SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 01272412
                                                              • SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 01272506
                                                              • SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 01272624
                                                              • SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 01272409
                                                              • SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 012724C0
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
                                                              • API String ID: 0-4009184096
                                                              • Opcode ID: 8f0d800b85e23fa9306b8cafa165e03c862388d6229765e67eadaea9ec941284
                                                              • Instruction ID: 6a1be1752eb41e09c2c471f45ddac0a08e54d81e2ca3983ea799f1f47b304c55
                                                              • Opcode Fuzzy Hash: 8f0d800b85e23fa9306b8cafa165e03c862388d6229765e67eadaea9ec941284
                                                              • Instruction Fuzzy Hash: 8A028EF1D10229DFDB21DB54CC81BAAB7B8AB54314F0145DAE709A7241EB709E84CF59
                                                              Function 012A8B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
                                                              • API String ID: 0-2515994595
                                                              • Opcode ID: 04579803c2a84761b5aa097d8bd59764f7277c7666a697806448924cfd4f78da
                                                              • Instruction ID: d06398aaeeca6fc5f52b21505fba00d59138f96f0cc4250b64333256aa66a89e
                                                              • Opcode Fuzzy Hash: 04579803c2a84761b5aa097d8bd59764f7277c7666a697806448924cfd4f78da
                                                              • Instruction Fuzzy Hash: 4F51F2711247529BC32DDF288844BABBBE8FF98354F94491DEA58C3280E770D608CBD2
                                                              Function 012B0274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
                                                              • API String ID: 0-1700792311
                                                              • Opcode ID: 090d4696ae24cd2f195c31e26248ee395ac9abcf57c50d2857222cdb4590e35d
                                                              • Instruction ID: 496d1a1af28cecd3e5d2fbc1d117465c19e780c57538c39482f34bde3867b93c
                                                              • Opcode Fuzzy Hash: 090d4696ae24cd2f195c31e26248ee395ac9abcf57c50d2857222cdb4590e35d
                                                              • Instruction Fuzzy Hash: B1D10B30620286DFDB2AEF68D481AEEBBF1FF49754F08805DF6459B252C7749981CB18
                                                              Function 012889B3 Relevance: 9.0, Strings: 7, Instructions: 259COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • VerifierDlls, xrefs: 01288CBD
                                                              • AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 01288A67
                                                              • AVRF: -*- final list of providers -*- , xrefs: 01288B8F
                                                              • VerifierFlags, xrefs: 01288C50
                                                              • VerifierDebug, xrefs: 01288CA5
                                                              • HandleTraces, xrefs: 01288C8F
                                                              • AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 01288A3D
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
                                                              • API String ID: 0-3223716464
                                                              • Opcode ID: 645ddc141d5ebd14432b78346274f236a3f4bdfb2c1d840efd2b54785b9a4125
                                                              • Instruction ID: 08d93bdc47535566de15c9b177904406708b4e5d8aced443d81392c3d560a2c3
                                                              • Opcode Fuzzy Hash: 645ddc141d5ebd14432b78346274f236a3f4bdfb2c1d840efd2b54785b9a4125
                                                              • Instruction Fuzzy Hash: 65913671662702AFD725FF689885F2ABBE4AF94724F45052CFB40AB2C5D7709C00CB95
                                                              Function 0120EA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
                                                              • API String ID: 0-1109411897
                                                              • Opcode ID: 0785433789568c76a606d8c1ec7bace880219a5cc8aee012dffdea48c7dc91cb
                                                              • Instruction ID: c120fd38b99f1966dfe9a7eadfb9d6a01f2228b0ee2b4b6585381de88c1c9433
                                                              • Opcode Fuzzy Hash: 0785433789568c76a606d8c1ec7bace880219a5cc8aee012dffdea48c7dc91cb
                                                              • Instruction Fuzzy Hash: BBA27870A2566A8FDB75DF18CD887A9BBB5AF45304F2042E9D94DA7291DB709EC0CF00
                                                              Function 012363FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
                                                              • API String ID: 0-792281065
                                                              • Opcode ID: 50fc5ab5945ca1234ef30f397834634e00ba536c7060a600c7ea078d3ddc0a1e
                                                              • Instruction ID: 72cac13d5bfb3516adf3888bb20c36e8fb2c35ddf89e292d1b38bf8c189e62fc
                                                              • Opcode Fuzzy Hash: 50fc5ab5945ca1234ef30f397834634e00ba536c7060a600c7ea078d3ddc0a1e
                                                              • Instruction Fuzzy Hash: 89913670F21756ABEB39EF58E849BAA7BA5FB50B24F00012DEB0067281D7B09901C790
                                                              Function 011F645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • LdrpInitShimEngine, xrefs: 012599F4, 01259A07, 01259A30
                                                              • Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 012599ED
                                                              • Getting the shim engine exports failed with status 0x%08lx, xrefs: 01259A01
                                                              • minkernel\ntdll\ldrinit.c, xrefs: 01259A11, 01259A3A
                                                              • apphelp.dll, xrefs: 011F6496
                                                              • Loading the shim engine DLL failed with status 0x%08lx, xrefs: 01259A2A
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                              • API String ID: 0-204845295
                                                              • Opcode ID: c95a980ae2499ce8f3f8474769b73f8b6e75a6c8dfe783fb6f6a80df0a7e69bc
                                                              • Instruction ID: 5a307a16f1f69f74f0d28e435c59ee7cd25f83e683df7a2f429bf4c76fcbe1cb
                                                              • Opcode Fuzzy Hash: c95a980ae2499ce8f3f8474769b73f8b6e75a6c8dfe783fb6f6a80df0a7e69bc
                                                              • Instruction Fuzzy Hash: 9451C371268305DFEB28DF24D895B6B77E8FB84758F00092DFA8597160D770E944CBA2
                                                              Function 01232674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 01272178
                                                              • SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 0127219F
                                                              • RtlGetAssemblyStorageRoot, xrefs: 01272160, 0127219A, 012721BA
                                                              • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 012721BF
                                                              • SXS: %s() passed the empty activation context, xrefs: 01272165
                                                              • SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 01272180
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
                                                              • API String ID: 0-861424205
                                                              • Opcode ID: c6e0a9c686784c9dba6e7c8f398cf44df7c2541bf78d78b6bc4e044150c8c571
                                                              • Instruction ID: be1487f54c2bff607f9785396fe6d3dae3dba266f9c21c6573e3df1407882858
                                                              • Opcode Fuzzy Hash: c6e0a9c686784c9dba6e7c8f398cf44df7c2541bf78d78b6bc4e044150c8c571
                                                              • Instruction Fuzzy Hash: 6A310776B61216F7F7269A999C45F6B7BB8FBA4A90F090059FB0477281D3709A00C7E0
                                                              Function 0123C6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • minkernel\ntdll\ldrinit.c, xrefs: 0123C6C3
                                                              • minkernel\ntdll\ldrredirect.c, xrefs: 01278181, 012781F5
                                                              • LdrpInitializeProcess, xrefs: 0123C6C4
                                                              • Loading import redirection DLL: '%wZ', xrefs: 01278170
                                                              • LdrpInitializeImportRedirection, xrefs: 01278177, 012781EB
                                                              • Unable to build import redirection Table, Status = 0x%x, xrefs: 012781E5
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
                                                              • API String ID: 0-475462383
                                                              • Opcode ID: e07f093b695c53ece41c81049ec51f015e6f58758b1645a8d48914178b943dc8
                                                              • Instruction ID: a2f248eecc748791d5dcce6dc18fa881085930e8dc6d5584b584204591f8df3e
                                                              • Opcode Fuzzy Hash: e07f093b695c53ece41c81049ec51f015e6f58758b1645a8d48914178b943dc8
                                                              • Instruction Fuzzy Hash: 223106B1664746AFD314EF29D84AE2B77D4EFD4B14F00056DF9406B291DB60EC04C7A2
                                                              Function 0124096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 01242DF0: LdrInitializeThunk.NTDLL ref: 01242DFA
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01240BA3
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01240BB6
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01240D60
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01240D74
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
                                                              • String ID:
                                                              • API String ID: 1404860816-0
                                                              • Opcode ID: cacdc1c10ba1a119c56a9b61448d5deecc26a0e208c7976db5c7fb9fb4703c5c
                                                              • Instruction ID: 16150cc7a9c37e034767e0193c6d58ff78d415c46bee278e0589b4ebcef69b22
                                                              • Opcode Fuzzy Hash: cacdc1c10ba1a119c56a9b61448d5deecc26a0e208c7976db5c7fb9fb4703c5c
                                                              • Instruction Fuzzy Hash: 49425A71A10716DFDB25CF28C881BEAB7F5FF04314F1445A9EA899B241E770AA84CF61
                                                              Function 00407B1B Relevance: 6.4, Strings: 5, Instructions: 116COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID:
                                                              • String ID: C$a$b$d$i
                                                              • API String ID: 0-2334916691
                                                              • Opcode ID: ce659b5985c4fda143c39d2f74d73e31e2ae076c581b5363530e5f821b7790bf
                                                              • Instruction ID: 9cefb149102013ebc1c11f0c7370e417644ed2b8a2a06f7475ac7e254a961867
                                                              • Opcode Fuzzy Hash: ce659b5985c4fda143c39d2f74d73e31e2ae076c581b5363530e5f821b7790bf
                                                              • Instruction Fuzzy Hash: 6731C371E44208ABE714EFE5EC82BEFB7B8EF45308F00451EF508A7241E779654187A9
                                                              Function 0120A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
                                                              • API String ID: 0-379654539
                                                              • Opcode ID: 8574718d4539632c5dd14a835848d2871029ce7c3983954a94684351cc80923e
                                                              • Instruction ID: 73e5012a13f47aad19bc4ad1460cfb0d97ef58b61e5d1ea6e90d38a055ac2bb2
                                                              • Opcode Fuzzy Hash: 8574718d4539632c5dd14a835848d2871029ce7c3983954a94684351cc80923e
                                                              • Instruction Fuzzy Hash: ECC1CE74528382CFD716CF68C040B6ABBE4FF84704F458A6DFA958B292E375C949CB52
                                                              Function 01238402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • minkernel\ntdll\ldrinit.c, xrefs: 01238421
                                                              • @, xrefs: 01238591
                                                              • LdrpInitializeProcess, xrefs: 01238422
                                                              • \Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 0123855E
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
                                                              • API String ID: 0-1918872054
                                                              • Opcode ID: e206708fd5fc773ff838d6bfdb1229d0625783455385f0e1d253d02c32b5be32
                                                              • Instruction ID: abb25d9750ca259a6a5d0cec528c4c1ad3ead45dbe444b5cef2c7476ba16b649
                                                              • Opcode Fuzzy Hash: e206708fd5fc773ff838d6bfdb1229d0625783455385f0e1d253d02c32b5be32
                                                              • Instruction Fuzzy Hash: 8391ACB1568346AFD722DF65DC41FBBBAE8FF84654F400A2EFA8496141E334D904CB62
                                                              Function 0123273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • .Local, xrefs: 012328D8
                                                              • RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 012721D9, 012722B1
                                                              • SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 012722B6
                                                              • SXS: %s() passed the empty activation context, xrefs: 012721DE
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
                                                              • API String ID: 0-1239276146
                                                              • Opcode ID: 8bba39e2ec397daa973613bc17161438e0efeb9f14b0d8300fe563d31eea8946
                                                              • Instruction ID: 7152367d1656cb989b89f4fcb853e5523ee3cfedd1f298d517c76da77e202558
                                                              • Opcode Fuzzy Hash: 8bba39e2ec397daa973613bc17161438e0efeb9f14b0d8300fe563d31eea8946
                                                              • Instruction Fuzzy Hash: A6A1C57592022ADBDB25CF68DC84BA9B7B1BF98314F2441E9DA08A7251D770DE81CF90
                                                              Function 012064AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 01260FE5
                                                              • ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 012610AE
                                                              • ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 0126106B
                                                              • ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 01261028
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
                                                              • API String ID: 0-1468400865
                                                              • Opcode ID: bb2be476b0b9706c6133278ceb33a324e56a656db2f0eb4b14d3d5af1964cbff
                                                              • Instruction ID: c99dd98082b12208abe57d88acc0bef0ffbae585883e6a509ed460e03a101ee4
                                                              • Opcode Fuzzy Hash: bb2be476b0b9706c6133278ceb33a324e56a656db2f0eb4b14d3d5af1964cbff
                                                              • Instruction Fuzzy Hash: 2A7101B19243069FCB21DF14C885BAB7FA8AF54764F000528FE488B287D771D588CBD1
                                                              Function 0122245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • LdrpDynamicShimModule, xrefs: 0126A998
                                                              • Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 0126A992
                                                              • minkernel\ntdll\ldrinit.c, xrefs: 0126A9A2
                                                              • apphelp.dll, xrefs: 01222462
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
                                                              • API String ID: 0-176724104
                                                              • Opcode ID: 51172e77aa425032177820e737027f0262303e47b523e664ba7df52f43c1ee50
                                                              • Instruction ID: 31437c29af394a7a6c530d8947903edf8c042a5279184accd9eff926e66f188b
                                                              • Opcode Fuzzy Hash: 51172e77aa425032177820e737027f0262303e47b523e664ba7df52f43c1ee50
                                                              • Instruction Fuzzy Hash: 2A312A75620202EBDB35DF5DE949AAE77B9FB84724F25002DEA0177285D7B059C1CB80
                                                              Function 012129A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 0121327D
                                                              • HEAP: , xrefs: 01213264
                                                              • HEAP[%wZ]: , xrefs: 01213255
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
                                                              • API String ID: 0-617086771
                                                              • Opcode ID: c2a3c330dbdfc1636200474cb5e7f01faee0d26ee68bba3b331100feb3bd7d70
                                                              • Instruction ID: 498abc83595940dc1b7a099d53540a3c9b636608c2f72e343ff8ac70208931f2
                                                              • Opcode Fuzzy Hash: c2a3c330dbdfc1636200474cb5e7f01faee0d26ee68bba3b331100feb3bd7d70
                                                              • Instruction Fuzzy Hash: 7D92EF71A2424ADFDB29CF68C4407AEBBF2FF18310F248459E949AB359D375A941CF50
                                                              Function 01210770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
                                                              • API String ID: 0-4253913091
                                                              • Opcode ID: f23c439783f4ebe35e14410615852d6806b6d0df5402f59703d36e518a984e5c
                                                              • Instruction ID: f7377bce1de797fc02c62effdbfc562b2e379b6f1596c345f5dc1bc561bee173
                                                              • Opcode Fuzzy Hash: f23c439783f4ebe35e14410615852d6806b6d0df5402f59703d36e518a984e5c
                                                              • Instruction Fuzzy Hash: EBF1BE30620606DFEB25CF68C894B6AB7F6FF54704F1481A8E6169B385D770E981CB94
                                                              Function 01226962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID: $@
                                                              • API String ID: 2994545307-1077428164
                                                              • Opcode ID: 859ac1f2bf4b31688096c0b04fe01315e97d06318ac151117a74410996c2bd1f
                                                              • Instruction ID: e9f43563a7e1d5ea933b2c810d2ee0faeab2d7a6bf742ccdc63f26c471aff4b6
                                                              • Opcode Fuzzy Hash: 859ac1f2bf4b31688096c0b04fe01315e97d06318ac151117a74410996c2bd1f
                                                              • Instruction Fuzzy Hash: 34C27F7162C352AFDB25CF28C841BAFBBE5AF98714F04892DEAC987241D774D844CB52
                                                              Function 011FA197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: FilterFullPath$UseFilter$\??\
                                                              • API String ID: 0-2779062949
                                                              • Opcode ID: 21b9cf630f33d956bb82da5491edd317f6494be7dea701b0892978c314e6467f
                                                              • Instruction ID: dea702bf22ae5ac652ad599002ba2c36293973f530ef3e1c62e035b7575d4c30
                                                              • Opcode Fuzzy Hash: 21b9cf630f33d956bb82da5491edd317f6494be7dea701b0892978c314e6467f
                                                              • Instruction Fuzzy Hash: 70A17F759216299BDB71DF68DC88BEAB7B8FF44710F1001E9EA08A7250E7359E84CF50
                                                              Function 01220BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • minkernel\ntdll\ldrinit.c, xrefs: 0126A121
                                                              • Failed to allocated memory for shimmed module list, xrefs: 0126A10F
                                                              • LdrpCheckModule, xrefs: 0126A117
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
                                                              • API String ID: 0-161242083
                                                              • Opcode ID: f52e591b8bda45a7707a005c32361d8a7d4ebaedb4e5b72263ff83d59eda7733
                                                              • Instruction ID: a6b1d591c488e836bcb8f856b08499f49a181c11479ec0033ac5676e336b7ef5
                                                              • Opcode Fuzzy Hash: f52e591b8bda45a7707a005c32361d8a7d4ebaedb4e5b72263ff83d59eda7733
                                                              • Instruction Fuzzy Hash: 1271F1B0A20206EFDB29DF68D985BBEB7F8FB44314F14406DE602A7255E770AD81CB54
                                                              Function 01210A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
                                                              • API String ID: 0-1334570610
                                                              • Opcode ID: a8666d8387a95aa64c2829c933f3a03207e33f70a3d4e60a84fcfd465bdd3cd6
                                                              • Instruction ID: 98a8399b6237d961e35c0ae243d9db3b8e3c0a85095196abae622c0130d0deee
                                                              • Opcode Fuzzy Hash: a8666d8387a95aa64c2829c933f3a03207e33f70a3d4e60a84fcfd465bdd3cd6
                                                              • Instruction Fuzzy Hash: B361EE71620302DFDB29CF28C481B6ABBE5FF54704F14856DF6498B286E7B0E891CB94
                                                              Function 0123C720 Relevance: 3.9, Strings: 3, Instructions: 141COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • minkernel\ntdll\ldrinit.c, xrefs: 012782E8
                                                              • LdrpInitializePerUserWindowsDirectory, xrefs: 012782DE
                                                              • Failed to reallocate the system dirs string !, xrefs: 012782D7
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
                                                              • API String ID: 0-1783798831
                                                              • Opcode ID: 825d05c14b77828e7c242ea1d1279d774524ef0526c5cda779087dd259cca88e
                                                              • Instruction ID: 9ba2977a69e74fdbb0676cd0bded21b9bfe6a5509fa80158cee6e29ee7544ae0
                                                              • Opcode Fuzzy Hash: 825d05c14b77828e7c242ea1d1279d774524ef0526c5cda779087dd259cca88e
                                                              • Instruction Fuzzy Hash: 5941F6B1564302ABD735EB68E849B6B77ECEF94660F00453EFA44D3294E774D810CB91
                                                              Function 012BC188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • @, xrefs: 012BC1F1
                                                              • PreferredUILanguages, xrefs: 012BC212
                                                              • \Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 012BC1C5
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
                                                              • API String ID: 0-2968386058
                                                              • Opcode ID: 11eb85e19fbe1d286bfe86f4c5ad2755fd123061f612d9961c62e9ceaf15ae6c
                                                              • Instruction ID: 6ab24cd4d337856faf9bf1404d4682f4a66169c3a64cc0d3cd53776ee43d5ff7
                                                              • Opcode Fuzzy Hash: 11eb85e19fbe1d286bfe86f4c5ad2755fd123061f612d9961c62e9ceaf15ae6c
                                                              • Instruction Fuzzy Hash: 26417471E2020AEBEF15DBD9C881FEEBBB8AB14754F14406AE609F7240D7749A45CB50
                                                              Function 01294144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
                                                              • API String ID: 0-1373925480
                                                              • Opcode ID: 99d74a6ba64d797ec3abbf82529b66505ddd8b0f1682e10ea133770c8043a670
                                                              • Instruction ID: ccc05e3f68ef8cd609ea371adb64d119dcec0bb674ad0d8f6e30299efc4b547b
                                                              • Opcode Fuzzy Hash: 99d74a6ba64d797ec3abbf82529b66505ddd8b0f1682e10ea133770c8043a670
                                                              • Instruction Fuzzy Hash: 4B411671A206898BEF26EBDCCA40BADBBF5FF65340F14045ADA01EB381D7749902CB10
                                                              Function 01284755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • minkernel\ntdll\ldrredirect.c, xrefs: 01284899
                                                              • Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 01284888
                                                              • LdrpCheckRedirection, xrefs: 0128488F
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
                                                              • API String ID: 0-3154609507
                                                              • Opcode ID: 23fca297105b7c76107767e0cb8c28b51e15eb53f48824bb643072541faad4e6
                                                              • Instruction ID: 31f1451842a85be4e78d59d1c2743dd07570db0c14e3fb72581313a9672e5799
                                                              • Opcode Fuzzy Hash: 23fca297105b7c76107767e0cb8c28b51e15eb53f48824bb643072541faad4e6
                                                              • Instruction Fuzzy Hash: 6E41C332A362939BDB25FE5CD840B267BE4FF49650F05056DEE44972D5E730E800CB91
                                                              Function 01210BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
                                                              • API String ID: 0-2558761708
                                                              • Opcode ID: d6087362c4fc834362606ce18113b765bfea300e7e3957468efcc5875fb78191
                                                              • Instruction ID: 81827829d8ecbb02c4cf9f3c0a1f2544d659dc6595da300ebbb7ddf211c80457
                                                              • Opcode Fuzzy Hash: d6087362c4fc834362606ce18113b765bfea300e7e3957468efcc5875fb78191
                                                              • Instruction Fuzzy Hash: BB11CD313351429FDB29CE18C885B7AB3A9FF60659F2881ADF506CB295EB74D8C0C758
                                                              Function 012820DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • minkernel\ntdll\ldrinit.c, xrefs: 01282104
                                                              • Process initialization failed with status 0x%08lx, xrefs: 012820F3
                                                              • LdrpInitializationFailure, xrefs: 012820FA
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
                                                              • API String ID: 0-2986994758
                                                              • Opcode ID: e1904994fe189a69ad83f85b981c6a3bd22ff3572bad2772785e3f1be7c37e21
                                                              • Instruction ID: 17839db1c19e61a8600e277150a452bf4935395978481d90f43a02a8c559ab75
                                                              • Opcode Fuzzy Hash: e1904994fe189a69ad83f85b981c6a3bd22ff3572bad2772785e3f1be7c37e21
                                                              • Instruction Fuzzy Hash: 76F02235651309BFE728F64CDC1AFAA37ACEB40B54F200068F700776C2D3B0A900CA90
                                                              Function 012103E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: ___swprintf_l
                                                              • String ID: #%u
                                                              • API String ID: 48624451-232158463
                                                              • Opcode ID: 56859b265fb75681394a8c4b8c0811a89da2dd51f8df57665ba8fc619dd5ed41
                                                              • Instruction ID: 2295165c898418149b7e7a411bc7ab7a86cc70c48557ce5bdb6de231989f1ac3
                                                              • Opcode Fuzzy Hash: 56859b265fb75681394a8c4b8c0811a89da2dd51f8df57665ba8fc619dd5ed41
                                                              • Instruction Fuzzy Hash: 52715A71A2014A9FDB05EFA8C980BAEB7F8FF18304F144065EA01E7295EA34ED41CB64
                                                              Function 0120A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • LdrResSearchResource Enter, xrefs: 0120AA13
                                                              • LdrResSearchResource Exit, xrefs: 0120AA25
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
                                                              • API String ID: 0-4066393604
                                                              • Opcode ID: e3d27f7ac980987f19918e61d2be4fa4c3ab69c3490e3c2a5b0ecd761a8d7c2f
                                                              • Instruction ID: ceb746a36074b5c08fccc4c0e9cb24f4339b61502aeb967d9f1cd493c809c0e7
                                                              • Opcode Fuzzy Hash: e3d27f7ac980987f19918e61d2be4fa4c3ab69c3490e3c2a5b0ecd761a8d7c2f
                                                              • Instruction Fuzzy Hash: D8E16571E20716DBEF22CE99C940BADBBB9FF54310F504525EA01E72D2E7749981CB50
                                                              Function 012CA352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: `$`
                                                              • API String ID: 0-197956300
                                                              • Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                              • Instruction ID: a82955cced675cce2a0f1c6e5b2cc6ca48d1f6d9d684353d313465b213772d03
                                                              • Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
                                                              • Instruction Fuzzy Hash: 25C1AF3122434A9BEB25CF28C841B6ABBE5BFD4B58F144B2CF79687290E774D505CB41
                                                              Function 0127E6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID: Legacy$UEFI
                                                              • API String ID: 2994545307-634100481
                                                              • Opcode ID: aab206ef6e18d98c17a0e021e0660df4b01a3f27d340b6946920dcddd5b03766
                                                              • Instruction ID: 8b029415ffc7e1cc033065dfac0f19056f5111d4299b0e85186311c4e812ee26
                                                              • Opcode Fuzzy Hash: aab206ef6e18d98c17a0e021e0660df4b01a3f27d340b6946920dcddd5b03766
                                                              • Instruction Fuzzy Hash: 31617F71E206199FDB19DFA9C840BBEBBF5FB58700F1540ADE649EB251D731A900CB60
                                                              Function 012A43D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: @$MUI
                                                              • API String ID: 0-17815947
                                                              • Opcode ID: c5100d9ae51780b9f67b3c5e4c6994eb4d0c30a7400a68c9082f05b758228783
                                                              • Instruction ID: 2400b5996344147063c6065876aa30664fde3bf6e26d5c494b2ccad718fd79ca
                                                              • Opcode Fuzzy Hash: c5100d9ae51780b9f67b3c5e4c6994eb4d0c30a7400a68c9082f05b758228783
                                                              • Instruction Fuzzy Hash: 54514A71D1025EAFDB11EFA9DC80EEEBBB8EB14754F540529EA11B7280D6709D05CB60
                                                              Function 012004E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 0120063D
                                                              • kLsE, xrefs: 01200540
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
                                                              • API String ID: 0-2547482624
                                                              • Opcode ID: b91096b8f4d27f10135071ec4a2cbacc8c41ce847cbf4fb86713f2a6b0c80e4d
                                                              • Instruction ID: f9f1287bcb08115773f7ae07b74c0d43ce4f36483b1603c3ca7b62e42363ec37
                                                              • Opcode Fuzzy Hash: b91096b8f4d27f10135071ec4a2cbacc8c41ce847cbf4fb86713f2a6b0c80e4d
                                                              • Instruction Fuzzy Hash: CC51CF715207428FE726DF28C8407A7BBE5AF84340F104A3EFAA987282E7749545CB99
                                                              Function 0120A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • RtlpResUltimateFallbackInfo Exit, xrefs: 0120A309
                                                              • RtlpResUltimateFallbackInfo Enter, xrefs: 0120A2FB
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
                                                              • API String ID: 0-2876891731
                                                              • Opcode ID: e39d84870a8116101e5c3ff2c578a4dfd48a8e4b0ec8c35d14a1b0340ad5288d
                                                              • Instruction ID: bd97b7ec9c123340946d52ec6df948d051da6cc810488089a6f4beeff74be4ea
                                                              • Opcode Fuzzy Hash: e39d84870a8116101e5c3ff2c578a4dfd48a8e4b0ec8c35d14a1b0340ad5288d
                                                              • Instruction Fuzzy Hash: 7B41AF30A24746DBDB16CF59C840B69BBB9FF95700F248165EA01DB2D2E7B5D940CB50
                                                              Function 0123A5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID: Cleanup Group$Threadpool!
                                                              • API String ID: 2994545307-4008356553
                                                              • Opcode ID: cdf276c4a06dc64552440f7ee0a956781c567b0e5b896b3f3955d228935a3549
                                                              • Instruction ID: 0d2432ecd2bc173534abcb1ee87cf9fa44e5f5fc962996122177bc39c343690b
                                                              • Opcode Fuzzy Hash: cdf276c4a06dc64552440f7ee0a956781c567b0e5b896b3f3955d228935a3549
                                                              • Instruction Fuzzy Hash: 5901D1B2260700AFD311DF14DE4AB2677E8E794725F018939A688C7594E378D804DB46
                                                              Function 0120C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: MUI
                                                              • API String ID: 0-1339004836
                                                              • Opcode ID: 37d8a19f53110982cbdc1673029384025134d3313e13fba02ac05b4f6a647228
                                                              • Instruction ID: 1f280a382f4c5dd151461e3f4839723c7bfe8d2c76da7642c9ec5d267f84e47b
                                                              • Opcode Fuzzy Hash: 37d8a19f53110982cbdc1673029384025134d3313e13fba02ac05b4f6a647228
                                                              • Instruction Fuzzy Hash: 1B824075E212199FDB26CFA9C8807EDBBB1FF44310F1482A9DA19AB292D7709D41CF50
                                                              Function 01286420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID: 0-3916222277
                                                              • Opcode ID: 5709100cb5cecc34c3fe17eb7f28ed83c9685ca4e54578f08f3cba435af8afb6
                                                              • Instruction ID: 6460d37f939d862e7616172c47ac1d9422ae5a67d614638aeccd598ff276cd07
                                                              • Opcode Fuzzy Hash: 5709100cb5cecc34c3fe17eb7f28ed83c9685ca4e54578f08f3cba435af8afb6
                                                              • Instruction Fuzzy Hash: 0291617195122AAFEB21EB95DD85FAE7BB8EF18B50F100065F700AB191D775A900CBA0
                                                              Function 012AE10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID: 0-3916222277
                                                              • Opcode ID: f4ff9e12a49058c86de50c6d7760b9c2a52027f9644e15758d3772d39c8c2b31
                                                              • Instruction ID: 863322ee843e21602786330b6fbef80ac7715e60fe5a17a018d2e611e903c678
                                                              • Opcode Fuzzy Hash: f4ff9e12a49058c86de50c6d7760b9c2a52027f9644e15758d3772d39c8c2b31
                                                              • Instruction Fuzzy Hash: 6691B07192060ABFDB26EBA4DC44FBFBBB9EF95750F510029F600A7250E7749902CB90
                                                              Function 0123A660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: GlobalTags
                                                              • API String ID: 0-1106856819
                                                              • Opcode ID: 688399a7fde35960810841cae45858fd419cb5a778437b86ddf215c8d5849ba1
                                                              • Instruction ID: a61f24de4618e56a92819ecd415ad7a5825ec8847b4980ab7f89856b98b00902
                                                              • Opcode Fuzzy Hash: 688399a7fde35960810841cae45858fd419cb5a778437b86ddf215c8d5849ba1
                                                              • Instruction Fuzzy Hash: 9D719FB5E2061ADFEF28CF9DC5916AEBBB1FF48750F14812EE505A7241E7718805CB50
                                                              Function 012A4978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: .mui
                                                              • API String ID: 0-1199573805
                                                              • Opcode ID: e48a01cf4a97a1ce7e50477191ad11e7843a9d41cd85d64136acacd7d9d604ea
                                                              • Instruction ID: 73c5462cb7e187fee08fbc56fee3fb0479cf4e06cc904898b928b881a4fb7d76
                                                              • Opcode Fuzzy Hash: e48a01cf4a97a1ce7e50477191ad11e7843a9d41cd85d64136acacd7d9d604ea
                                                              • Instruction Fuzzy Hash: 4151C472D2026ADBDB11EF9DD850AAEBBB4BF14710F494129EA11BB241D7B4DD01CBE0
                                                              Function 0121E627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: EXT-
                                                              • API String ID: 0-1948896318
                                                              • Opcode ID: e9d8ac7381c446c683608a69bf693422477069f7e230ef9aba5e32a01adbb61d
                                                              • Instruction ID: 819fbb5e267b1619281b426a6916a23336d5f9cf735c229e22b767a5fb1081fa
                                                              • Opcode Fuzzy Hash: e9d8ac7381c446c683608a69bf693422477069f7e230ef9aba5e32a01adbb61d
                                                              • Instruction Fuzzy Hash: D341D172528302ABE716DB75CC40B6BBBE8AFA8714F05092DFA84D7184E774D905C792
                                                              Function 0127C730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: BinaryHash
                                                              • API String ID: 0-2202222882
                                                              • Opcode ID: d8456df40a52e4ec20bbf46dbf6b7937bd1a3c0ed23e9fb9cb978e23be363816
                                                              • Instruction ID: e98af402c51969a5da6f530e4e6958f58b30233d9c9d8ba44181168fbc289c49
                                                              • Opcode Fuzzy Hash: d8456df40a52e4ec20bbf46dbf6b7937bd1a3c0ed23e9fb9cb978e23be363816
                                                              • Instruction Fuzzy Hash: 7D4143B1D1052EABDB21DA60DC84FEFB77CAB45714F0045A5EB08AB140DB709E998FA4
                                                              Function 01296B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: #
                                                              • API String ID: 0-1885708031
                                                              • Opcode ID: 5a0d739918735f412dc4090cb4807f4e852d574da2fa010d57e6b965cacb4ffd
                                                              • Instruction ID: f85fcb76c8b2c9295dc07b3fac04b3d86c4e885836a43e8240f3a69211db7b3e
                                                              • Opcode Fuzzy Hash: 5a0d739918735f412dc4090cb4807f4e852d574da2fa010d57e6b965cacb4ffd
                                                              • Instruction Fuzzy Hash: 08312C31A2079A9BDF22DF6DC854FAE7BE8DF05704F144028FA40AB282D775E805CB54
                                                              Function 0127CA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: BinaryName
                                                              • API String ID: 0-215506332
                                                              • Opcode ID: 9462b4315f42ca60704b3c9102cdc9fc1ea98684ba7705ec32a0baecc505adf7
                                                              • Instruction ID: f104f7fd3894e125ace1badde65949dbf4108a8ffbc408c8a51bd890fb90c47c
                                                              • Opcode Fuzzy Hash: 9462b4315f42ca60704b3c9102cdc9fc1ea98684ba7705ec32a0baecc505adf7
                                                              • Instruction Fuzzy Hash: BC312536910517AFEB15DB69C845E7FBBB4EF80720F114129FA01A7250E7309E10DBE0
                                                              Function 0128892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 0128895E
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
                                                              • API String ID: 0-702105204
                                                              • Opcode ID: 4171f4ad305b33602ecd9999047922fbc05dbdad8d1b14c7a4c7f080c9e52236
                                                              • Instruction ID: 09da6443f8c90eb34a0f416fb5f280dbc0486af33cec0933591fa7ef67eaeae9
                                                              • Opcode Fuzzy Hash: 4171f4ad305b33602ecd9999047922fbc05dbdad8d1b14c7a4c7f080c9e52236
                                                              • Instruction Fuzzy Hash: 0B0126362322029BEB357B59DC88B6A7F69EF85264F44013CF741166D3CB70AC90C796
                                                              Function 012A2000 Relevance: .8, Instructions: 757COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 344d86810c99294aecf17df02fa61700cceba95ed5898846fa35629f9a4134aa
                                                              • Instruction ID: 94456b61361f941571f25dec72e3230783ba5a7346a6393982760a6de3f6462c
                                                              • Opcode Fuzzy Hash: 344d86810c99294aecf17df02fa61700cceba95ed5898846fa35629f9a4134aa
                                                              • Instruction Fuzzy Hash: 2D42BF31628342DFE725CF68C890A6BBBE5BF98700F88092DFB8697250D771D945CB52
                                                              Function 01298158 Relevance: .6, Instructions: 617COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: dbd62061cac4327f4d4a790a0a36f51a2d9e0dd10ede35ca6ce8238c24b31702
                                                              • Instruction ID: 112cc23f809fac9be5c332d90b632ed5685bd8a6a9d12663833598ef76e4c939
                                                              • Opcode Fuzzy Hash: dbd62061cac4327f4d4a790a0a36f51a2d9e0dd10ede35ca6ce8238c24b31702
                                                              • Instruction Fuzzy Hash: 0A425E75E202199FEF24CF69C841BADBBF5BF49300F188099EA49EB241D7349985CF50
                                                              Function 01212840 Relevance: .6, Instructions: 605COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 51a7e1d09f78648c0c6635bb2a6ea28c321d56f9633f1249a65b15cd4c3336d0
                                                              • Instruction ID: 9984a5c3d45cc5a5d86e886076e965db395ba40e7d8d2ff95183a0bf0c1b28fd
                                                              • Opcode Fuzzy Hash: 51a7e1d09f78648c0c6635bb2a6ea28c321d56f9633f1249a65b15cd4c3336d0
                                                              • Instruction Fuzzy Hash: A632FE70A207568FDB25CF69C8447BEBBFAFF84300F24411DE6869B684D775A885CB90
                                                              Function 012AA118 Relevance: .6, Instructions: 591COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 93e4fdcc1ffdaac92f330808a8598d4f2e1ca9ba855a582f504f483313c1b41c
                                                              • Instruction ID: 0c28ebd6cd8ede53982096da43b9fc0d14bf818aba8c7c582951de5084e7a997
                                                              • Opcode Fuzzy Hash: 93e4fdcc1ffdaac92f330808a8598d4f2e1ca9ba855a582f504f483313c1b41c
                                                              • Instruction Fuzzy Hash: DC22D2706346628FEB25CF2DC455376BBF1EF44700F88849AEA868F286D775E452CB60
                                                              Function 01206A50 Relevance: .5, Instructions: 548COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 926928ed9646f105838a52c680ebc5f9cd7ac3509b8f1dad52c3340d431771b7
                                                              • Instruction ID: 446e059ba1adafaeab9ac1660b2cbc9a0e778c244afe8618b47852110ea3baff
                                                              • Opcode Fuzzy Hash: 926928ed9646f105838a52c680ebc5f9cd7ac3509b8f1dad52c3340d431771b7
                                                              • Instruction Fuzzy Hash: A232C370A20616CFDB16CF68C480BAEB7F5FF88310F144669EA55AB392D774E861CB50
                                                              Function 01224A35 Relevance: .4, Instructions: 423COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                                              • Instruction ID: 9341d55f9889690f8acbf243c801aa0b6ad15ec4ca3e98073deb1c45e62b0938
                                                              • Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
                                                              • Instruction Fuzzy Hash: 6DF18271E2026AABDB15DF99D580BBEBBF9BF48714F048129EA05EB340E774D841CB50
                                                              Function 0129892B Relevance: .4, Instructions: 386COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4b788a7aeb6eec89639740ed87e5b5310f036f499a79e4d9dc0cb33775bf71e3
                                                              • Instruction ID: b22aa6af664f2cbb256b355e2470791aa526690dab700251ccd3075df05fe8de
                                                              • Opcode Fuzzy Hash: 4b788a7aeb6eec89639740ed87e5b5310f036f499a79e4d9dc0cb33775bf71e3
                                                              • Instruction Fuzzy Hash: 52D1E272A2060E9BDF09CF6DC841ABEB7F1AF89304F1C8169D955E7241E739E905CB60
                                                              Function 012065D0 Relevance: .4, Instructions: 383COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 75ce556e6ca8c4eca92cab8391fda6954c61801c7b7d82c09a56a7878efd6854
                                                              • Instruction ID: e50e9200a527c7eda7d04c925c50f6e29e10f60bd4ba4de29e8743e1108fb710
                                                              • Opcode Fuzzy Hash: 75ce556e6ca8c4eca92cab8391fda6954c61801c7b7d82c09a56a7878efd6854
                                                              • Instruction Fuzzy Hash: 1AE1A071618342CFC716CF28C490A6ABBE1FF89314F048A6DF99587392DB31E955CB92
                                                              Function 011F8397 Relevance: .4, Instructions: 380COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d8cc22688dfbd7478c8f80d430649485c4300075b34601580c82b1649898f457
                                                              • Instruction ID: 814bc0c38e3a8161cc46ed6ea5512e2ac70f27c635eadc65e2990b2895aaa92a
                                                              • Opcode Fuzzy Hash: d8cc22688dfbd7478c8f80d430649485c4300075b34601580c82b1649898f457
                                                              • Instruction Fuzzy Hash: B9D1E271A1060ADFDB1CDF68C890BBAB7A5BF54318F05462DEB16DB290EB30D951CB60
                                                              Function 01288243 Relevance: .3, Instructions: 322COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                              • Instruction ID: b756d451d9eb88fb47ce92cc9223656a57628fe100f50c11d562ef3a7b6e028a
                                                              • Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
                                                              • Instruction Fuzzy Hash: 54B19674A116099FDF24EF58C940EBBBBB5FF84304F50445EAA02977D5DA34E905CB10
                                                              Function 01210535 Relevance: .3, Instructions: 300COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                              • Instruction ID: c8232247b46b683802ec47a537d03d7d68e5c3a8cc4d04896c70c0842a7d60a4
                                                              • Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
                                                              • Instruction Fuzzy Hash: 06B14831620686EFDB15DB68C850BBEBBFABF58300F140555E652DB285D770ED81CB90
                                                              Function 012083C0 Relevance: .3, Instructions: 281COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 117feda8dd142fe5ad6a2afea04bca646e62c9bdb1147945b3d55f8360d22c3e
                                                              • Instruction ID: 5f26054bc8f5811e3ea599fd1b751b562d61d1df10109d52b4cf19d8042e4fdc
                                                              • Opcode Fuzzy Hash: 117feda8dd142fe5ad6a2afea04bca646e62c9bdb1147945b3d55f8360d22c3e
                                                              • Instruction Fuzzy Hash: EBC178745183818FD764CF18C484BABBBE8FF88304F45492DEA8987291D775E948CF92
                                                              Function 011FC427 Relevance: .3, Instructions: 280COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: da8e08d0761e80f701f1787f850b6032fd9ec470b2b18e4fe33ab0153c22bf5e
                                                              • Instruction ID: 2afb96e29ca637d8cb6c6b93c83def02367d36a140e274d4c9b0f7632353357b
                                                              • Opcode Fuzzy Hash: da8e08d0761e80f701f1787f850b6032fd9ec470b2b18e4fe33ab0153c22bf5e
                                                              • Instruction Fuzzy Hash: B7B18270B1026A8BDB68CF58C890BB9B7B1EF44704F0485EDD60AE7251EB309D86DF61
                                                              Function 0122E5E7 Relevance: .3, Instructions: 278COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f59c74845f376f9372ea778ca137e24bf098c4253d2062a93c9a0d77ab8e0502
                                                              • Instruction ID: 195c31424d0bfdab65f7d9ce3a4a833fff6f0c8b95fa03747e1d960e133fd204
                                                              • Opcode Fuzzy Hash: f59c74845f376f9372ea778ca137e24bf098c4253d2062a93c9a0d77ab8e0502
                                                              • Instruction Fuzzy Hash: 49A12831E20666AFEF31DB58D958BBDBBA9BB04714F060125EB10AB2D0D7749D80CB91
                                                              Function 01240185 Relevance: .3, Instructions: 276COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b3a9251aeda2e95274577c3c0e6ed4281ae3c9343ad5595a7a985193c82572f4
                                                              • Instruction ID: 6ee12ece75651d78ba1b509a3a77eed6fa3be241053c1fdd4aecd0989c17f688
                                                              • Opcode Fuzzy Hash: b3a9251aeda2e95274577c3c0e6ed4281ae3c9343ad5595a7a985193c82572f4
                                                              • Instruction Fuzzy Hash: 68A1D270B207169FDB29DF69C891BBAB7B1FF44324F004129EB059B281DB74E891CB94
                                                              Function 012D4500 Relevance: .3, Instructions: 275COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: ff7f6c45cb3bc629fbb8d7292930792d8ba6a79448e8710ffd75b5365c8e9c21
                                                              • Instruction ID: 533405faac937d82789a1ec0cb18b8dfdd846e8601882ce0b5e8c5da7585e6ab
                                                              • Opcode Fuzzy Hash: ff7f6c45cb3bc629fbb8d7292930792d8ba6a79448e8710ffd75b5365c8e9c21
                                                              • Instruction Fuzzy Hash: 3FA1DC72A20292EFD725EF18C981B2ABBE9FF58754F05052CF685DBA55D334E800CB91
                                                              Function 012D2B57 Relevance: .3, Instructions: 266COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                                              • Instruction ID: 59fdb54c75cc5ae338a1135143e2601665ea51066be108e1ebea36b864bdc8a3
                                                              • Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
                                                              • Instruction Fuzzy Hash: F0B13871E1061ADFDF29CFA9C880AADBBB5FF88310F148169EA15A7354D770A941CB90
                                                              Function 012860E0 Relevance: .3, Instructions: 264COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 79292e98c8eee5d713486bc0ae35cf80a27afedbe65e1373b9092126102ab0b5
                                                              • Instruction ID: 6fb3742d8a274a19734822bd01cb5751f22c26bb6544e969f983f502d064cd7f
                                                              • Opcode Fuzzy Hash: 79292e98c8eee5d713486bc0ae35cf80a27afedbe65e1373b9092126102ab0b5
                                                              • Instruction Fuzzy Hash: 7991E371D11216AFDF15DFA8D884BBEBFB5AF48710F154169EA00EB381D774E9008BA0
                                                              Function 0121E3F0 Relevance: .3, Instructions: 261COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c3e587ab453141b810314569682115a5ee88db5efab5651524c36ea214323b7e
                                                              • Instruction ID: 94acb321e7b75942564136e04ae1596ffb0dcf5c83cc63b2d751622fb90531e6
                                                              • Opcode Fuzzy Hash: c3e587ab453141b810314569682115a5ee88db5efab5651524c36ea214323b7e
                                                              • Instruction Fuzzy Hash: F5914771A30216DFEB25DB18D840B7EBBE5EFA4714F064069EE059B388EA34DD81CB51
                                                              Function 012CAB40 Relevance: .2, Instructions: 222COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                                              • Instruction ID: 19a4077560411b8ea6bbc827b9f46626cc778e707f90c4733efa435b8ad40f67
                                                              • Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
                                                              • Instruction Fuzzy Hash: 56818431A2020A9FDF19CF58C881ABEBBB6BF94710F14866DDA169B345E774DA01CB40
                                                              Function 0123E284 Relevance: .2, Instructions: 212COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 1404fce571a936dbd08a82a773eb8b272a1d2aaa14cdec2669492c83a62fbacd
                                                              • Instruction ID: 4b864d10ef323d03b0f917db3007c675fbf8d90e26dea098e8475bf1c7282d0b
                                                              • Opcode Fuzzy Hash: 1404fce571a936dbd08a82a773eb8b272a1d2aaa14cdec2669492c83a62fbacd
                                                              • Instruction Fuzzy Hash: 9B81527192060ADFDB15CFA9C880BEEBBF9FF88354F114429E655A7250D770AC49CB50
                                                              Function 0121C640 Relevance: .2, Instructions: 206COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c93bbb212dadd7e7a7f0144dddfccb8596b52c9ff7983544923492968c6c0830
                                                              • Instruction ID: 97f49de8c59d77c82ca96d545015a91a27d72668db7bd12e4ac521dc90e45ee6
                                                              • Opcode Fuzzy Hash: c93bbb212dadd7e7a7f0144dddfccb8596b52c9ff7983544923492968c6c0830
                                                              • Instruction Fuzzy Hash: F471B075C242669FCB29CF68D4507BEBBF8FF68710F14412AE941A7394D3B09851CBA0
                                                              Function 012B47A0 Relevance: .2, Instructions: 202COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: e08a6ea4c83414440174f0c4526d6036416d6319ddbf418e05fc459ee72add09
                                                              • Instruction ID: 9ba16840976a841b6528f81d13f10d739a69cc744701bf6c0cac23f9b973d352
                                                              • Opcode Fuzzy Hash: e08a6ea4c83414440174f0c4526d6036416d6319ddbf418e05fc459ee72add09
                                                              • Instruction Fuzzy Hash: 38718270920246EFDB20EF59E9D8E9ABBF9FF90350F10416EE701A729AC7719940CB54
                                                              Function 0121260B Relevance: .2, Instructions: 201COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d54352487d05d2c7ac4780c613bfc9cdfc3f8b01e1351a0d2c482232a0ae95d4
                                                              • Instruction ID: 39126de52732c455908b7e9e94e5b9e577b98646e90aa44565ede99cd9a3fa43
                                                              • Opcode Fuzzy Hash: d54352487d05d2c7ac4780c613bfc9cdfc3f8b01e1351a0d2c482232a0ae95d4
                                                              • Instruction Fuzzy Hash: 7B71C131624282CFD316DF28C480B6AB7E5FF94310F1485A9F9948B39ADB74D886CB91
                                                              Function 0128035C Relevance: .2, Instructions: 198COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                              • Instruction ID: bf9bfea679b0d36ca1a5ffae256b16a8af96f12cd9c0e0f5c245ede79284a520
                                                              • Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
                                                              • Instruction Fuzzy Hash: EB719071A1160AEFCB10EFA9C944EEEBBF9FF58300F104569E505A7290DB34EA05CB64
                                                              Function 012962A0 Relevance: .2, Instructions: 198COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 18be644a59b22d28b4a42f74ad3aebd580adeb400f5fca3a0e53091a55be2417
                                                              • Instruction ID: 0580fb26ed7167ae9e8559181ba2dd62e95fd84fc268d9d712334a3dd7b588bb
                                                              • Opcode Fuzzy Hash: 18be644a59b22d28b4a42f74ad3aebd580adeb400f5fca3a0e53091a55be2417
                                                              • Instruction Fuzzy Hash: 2D71F232260B02EFEB36CF5CC845F6ABBE6EF40B60F144428E255872A0D775E944CB50
                                                              Function 01208AA0 Relevance: .2, Instructions: 197COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 15b5abb478b4f45c0a6e5293d971ae8e483d0c3cadddd8068dfc3efe956843a0
                                                              • Instruction ID: 26046af0ab20548d9b9aa2579535f6c8ce1180da50917625c93c9f73833252ad
                                                              • Opcode Fuzzy Hash: 15b5abb478b4f45c0a6e5293d971ae8e483d0c3cadddd8068dfc3efe956843a0
                                                              • Instruction Fuzzy Hash: 6E81E372A24746CFDB25CF98D588B6E77B5BF48324F15422DDA04AB2C2D7B49D80CB90
                                                              Function 012D8324 Relevance: .2, Instructions: 192COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 339c1b5ce2734a32fd0a91b28503629b84114407fae02e35d7b500e8632c98cc
                                                              • Instruction ID: 5fd0a2a27667453592cd54ffd73e39c1d199e041e69b73daf2ae827cbc62c456
                                                              • Opcode Fuzzy Hash: 339c1b5ce2734a32fd0a91b28503629b84114407fae02e35d7b500e8632c98cc
                                                              • Instruction Fuzzy Hash: 85712A71E2020AAFDF16DF95C841FEEBBB9FB04350F104169F614A7290E774AA05CB90
                                                              Function 012BA250 Relevance: .2, Instructions: 184COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 903a57f102b5713f057f7ab15f60b681804c500d453867abe54796ba104502c6
                                                              • Instruction ID: 475f0c2f80cb39515c2815e7895c1aac83c2553f06a4041001a6af2c13313eee
                                                              • Opcode Fuzzy Hash: 903a57f102b5713f057f7ab15f60b681804c500d453867abe54796ba104502c6
                                                              • Instruction Fuzzy Hash: 4551CF72524752AFD711DE68C884FABBBF8EBC5790F010929BA80DB150D774ED04C7A2
                                                              Function 012A8350 Relevance: .2, Instructions: 161COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e84400b3ebc8de657275d0f164c0d6571cd4ce623c1c22c1c45d762de7197d7e
                                                              • Instruction ID: 3cb49220ca494781df9aca3a8cbf7e3062e3a99636c4c4824b69c9ca5a33d9a0
                                                              • Opcode Fuzzy Hash: e84400b3ebc8de657275d0f164c0d6571cd4ce623c1c22c1c45d762de7197d7e
                                                              • Instruction Fuzzy Hash: 7B51C070910706DFD721CF9AC880AABFBF8FF94710F50461EE292576A0D7B0A545CB50
                                                              Function 0123E443 Relevance: .2, Instructions: 158COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 2340e1565096f4e737e21e7bd7b7875c6406da3ed6ea87a67213e2fde81a6fe3
                                                              • Instruction ID: 37f5c79cd811f31c02a55cf4ca4ff117586f1a78ddebe65e62162052f9a754b2
                                                              • Opcode Fuzzy Hash: 2340e1565096f4e737e21e7bd7b7875c6406da3ed6ea87a67213e2fde81a6fe3
                                                              • Instruction Fuzzy Hash: DF517CB1220A06DFCB22EF69D980F6BB3F9FF58764F410429E64297260E730E955CB50
                                                              Function 012A4180 Relevance: .2, Instructions: 156COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9f5ec14fd6d381e0a950d720d8d116a80cc37ec30583553590fecfa9835f38ae
                                                              • Instruction ID: 5ff4c6b910e41e090074a49c19313d65a50c95110077f380d9376a3e49e21510
                                                              • Opcode Fuzzy Hash: 9f5ec14fd6d381e0a950d720d8d116a80cc37ec30583553590fecfa9835f38ae
                                                              • Instruction Fuzzy Hash: E0519C716283829FD754EF29C880A6BB7E5BFD8308F98492DF685C7250D770D905CB52
                                                              Function 012245B1 Relevance: .2, Instructions: 156COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                              • Instruction ID: 65fb7fb1cff6c187615a99c3bc9b3d7265f409b799dfec97b6aeff02a0d59125
                                                              • Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
                                                              • Instruction Fuzzy Hash: 8A518F71E1026AAFDF15EF94C440BFEBBB9AF45354F044069EA11AB280D774DD44CBA0
                                                              Function 0128E9E0 Relevance: .2, Instructions: 154COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                              • Instruction ID: 456f02cd3300c5519d2b1e30f32d59ad6cd0157e9b8ed2debb89b1b267a87587
                                                              • Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
                                                              • Instruction Fuzzy Hash: 3451C831D2121AEFEF21BF94C881BAEBB75BF00724F164665D612671D0E7709E40CBA0
                                                              Function 012C8B28 Relevance: .2, Instructions: 152COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4e5bbc83847d39476413c8800ae51c69af5ec7990d7817d3cb6502f0c5d6db1d
                                                              • Instruction ID: af6a58691ed2c8e184a47af737790898833460a7dbb945b39f35a9094be7207e
                                                              • Opcode Fuzzy Hash: 4e5bbc83847d39476413c8800ae51c69af5ec7990d7817d3cb6502f0c5d6db1d
                                                              • Instruction Fuzzy Hash: 6241E4707216129BD729DB2DC895B7BBB9AEF90A20F04C32DEB15C7281EB74D901C791
                                                              Function 0128CBF0 Relevance: .1, Instructions: 148COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6f13c582f8856aebcf5a27fdbdee7af09a7fd4596ad920df27f0f6d1b80ba822
                                                              • Instruction ID: 4529b4b18f3191c2aea93a77681099ec9dbb757cb53c7126e161eb5c88d200f4
                                                              • Opcode Fuzzy Hash: 6f13c582f8856aebcf5a27fdbdee7af09a7fd4596ad920df27f0f6d1b80ba822
                                                              • Instruction Fuzzy Hash: 4151C071921216DFCB20EFA8D9849AEBBF9FF48324F148529E605A3745D730AD11CFA0
                                                              Function 0123A430 Relevance: .1, Instructions: 139COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 11a88b1d6aaed514fd6fea54eb0e6f60ab3092a0726699b132a77a34b89f5718
                                                              • Instruction ID: 2c8d24af3644beddf99aae5df3b194c014553dfe8885a01eb91f02947f5a0b08
                                                              • Opcode Fuzzy Hash: 11a88b1d6aaed514fd6fea54eb0e6f60ab3092a0726699b132a77a34b89f5718
                                                              • Instruction Fuzzy Hash: D54106B57602029BDF29EF6CB885F7A3765EB95718F00003DFE02DB246D7B198408B50
                                                              Function 012CA9D3 Relevance: .1, Instructions: 139COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                              • Instruction ID: fa1c13e7372db57efc2e52c60b7f2927f33bf142e68eacab201d2d68f14a2b13
                                                              • Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
                                                              • Instruction Fuzzy Hash: 6D41C47162171BAFDB25CF28C980A6AB7A9FF94614B05472EEB1687244FB30ED04C790
                                                              Function 012301F8 Relevance: .1, Instructions: 138COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 33142f9c5ef5a07a89e6735d086cbeec53833a887db3e463adbd4235cc3c40ce
                                                              • Instruction ID: 6b10e96544b2c1703a2890ff55a9440723aaaa669d40aba5dce0ff7d3f123e37
                                                              • Opcode Fuzzy Hash: 33142f9c5ef5a07a89e6735d086cbeec53833a887db3e463adbd4235cc3c40ce
                                                              • Instruction Fuzzy Hash: 2F41DDB592021ADBDB14DF98C440AEEB7B5FF88B10F14816AF915E7240D7349C41CBB8
                                                              Function 0122EBFC Relevance: .1, Instructions: 138COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 508219fb0b2981517e8b2665349ccb32b7cde3fa4a09f2443d48209a6d25a619
                                                              • Instruction ID: 82122f6ff3226b40fa6aa037ed48818a17342b6487fffe1015a91c9555994cf8
                                                              • Opcode Fuzzy Hash: 508219fb0b2981517e8b2665349ccb32b7cde3fa4a09f2443d48209a6d25a619
                                                              • Instruction Fuzzy Hash: 1D41F3B1220302AFDB24DF68D884A6BB7F9FF98224F11483EE657C7655DB74E8448B50
                                                              Function 01242750 Relevance: .1, Instructions: 137COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                              • Instruction ID: 91392dd57117a3c615042047437b0c7d101621caacaa1667d92a507013fe231a
                                                              • Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
                                                              • Instruction Fuzzy Hash: 92517C75A10216DFCB15CF5CC480AAEF7B2FF84720F2881A9D915A7351D770AE41CB90
                                                              Function 01206154 Relevance: .1, Instructions: 133COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c3f1e1bfe5b1e173909084b3b7bc4259309f696f9e554766df27b9da47427e77
                                                              • Instruction ID: 3bbd6d0c85cd953e5295d07dc54ad30e3294efccd4bfadccebae80937fcc7585
                                                              • Opcode Fuzzy Hash: c3f1e1bfe5b1e173909084b3b7bc4259309f696f9e554766df27b9da47427e77
                                                              • Instruction Fuzzy Hash: BB51F470920217DFEB26CB68CC00BB8BBB5EF15314F1482A9E619A72C6D774A991CF44
                                                              Function 01200BCD Relevance: .1, Instructions: 130COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7ebf29e40b90085c01e50065a344ce23de3aa9312c8365fa8bc89e2f6663a9c6
                                                              • Instruction ID: 5a587c5f2af9fbf75156533f700b9dd9790fbb04fb25ec2d9cc399c0a7cb52e2
                                                              • Opcode Fuzzy Hash: 7ebf29e40b90085c01e50065a344ce23de3aa9312c8365fa8bc89e2f6663a9c6
                                                              • Instruction Fuzzy Hash: C7419931A21229DFDB61DF68C940BEEB7B8EF55750F0101A5EA08AB241D774DE80CF55
                                                              Function 012C866E Relevance: .1, Instructions: 129COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                              • Instruction ID: 26d41ff0dd53269fc7d9f60437cf9e8c0ebf457577d097b63a603e7fc4391830
                                                              • Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
                                                              • Instruction Fuzzy Hash: 17419475B20106AFDB15DB99CC84ABFBBBAAF84A10F24816DE70497341D770DD4487A0
                                                              Function 01200887 Relevance: .1, Instructions: 128COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a73ca4b40be80028035a1f1e45ddb8ae9e3af855c9bf08ac2f7783d1ff3558c8
                                                              • Instruction ID: d7c65973a633f57b476e87023cfaf7e31b5b63ce52711d265cc23b045ec087cc
                                                              • Opcode Fuzzy Hash: a73ca4b40be80028035a1f1e45ddb8ae9e3af855c9bf08ac2f7783d1ff3558c8
                                                              • Instruction Fuzzy Hash: 5241E5706207069FE326CF28C480B22B7F9FF45354B104A6DE64787A92E770F945CB94
                                                              Function 0122A470 Relevance: .1, Instructions: 127COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f6ef9ddf0a0e56432e367ccfe060b656422c8f8e8d11143d3cf2f4ea6e38e2f8
                                                              • Instruction ID: e237df5f18f416b80e90959266e9620ccfb46aa845ded41253f8b31c09c4aece
                                                              • Opcode Fuzzy Hash: f6ef9ddf0a0e56432e367ccfe060b656422c8f8e8d11143d3cf2f4ea6e38e2f8
                                                              • Instruction Fuzzy Hash: 97412331960225DFDB25DF2CE9847EE7BB0FB14320F4402A9D511ABAD4DBB4D940CBA0
                                                              Function 01208BF0 Relevance: .1, Instructions: 124COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: fac278d01c31d1f349e9fcd9bf44e1408b310bbf581ecb34c909ebd7c04a6b88
                                                              • Instruction ID: c9791ecb0705f6deec5c1e200b12e246487dcab80c124d7b0ba58f951575ee28
                                                              • Opcode Fuzzy Hash: fac278d01c31d1f349e9fcd9bf44e1408b310bbf581ecb34c909ebd7c04a6b88
                                                              • Instruction Fuzzy Hash: 7A412631D30242CBD72AEF58D884A6BBBB5FB94714F14832DDA055B286C7B5D882CF90
                                                              Function 011F8918 Relevance: .1, Instructions: 123COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9c5c758948b50c805c8b95cfe35b6c3ce3e340fa58970b9f3d9fc4440e43ca2c
                                                              • Instruction ID: c99a973bc65dec991b764c9717a4e4c518201cd95aba46fe299cf458e67132e6
                                                              • Opcode Fuzzy Hash: 9c5c758948b50c805c8b95cfe35b6c3ce3e340fa58970b9f3d9fc4440e43ca2c
                                                              • Instruction Fuzzy Hash: 93416A325183169ED316DF69C880A6BF6E9FF84B54F41092EFA80D7250E730DE048BA3
                                                              Function 011FA020 Relevance: .1, Instructions: 122COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                              • Instruction ID: 31070ecd33dd9f4a4bff0bb0e87f1c3961600c39543e9c473dd7012b98cb0714
                                                              • Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
                                                              • Instruction Fuzzy Hash: CE413B31A14212EBDB29DE18A4D07BEBB72EF54754F16806EFF498B240D73A8D40CB91
                                                              Function 012009AD Relevance: .1, Instructions: 122COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2a84ab9a5545ede0ee1d4768e4bb4f7d5c10e827f3bfb91e9a9f4df3534aa467
                                                              • Instruction ID: 5f33c840336da88f68fc5c93b945e0bc908dc100e4aacef8345c796a3b561730
                                                              • Opcode Fuzzy Hash: 2a84ab9a5545ede0ee1d4768e4bb4f7d5c10e827f3bfb91e9a9f4df3534aa467
                                                              • Instruction Fuzzy Hash: 2D417C71620602EFE726CF18D840B26BBF5FF54754F20866AF649CB292E770E941CB94
                                                              Function 01230710 Relevance: .1, Instructions: 121COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                              • Instruction ID: 939fc89ed5103e8d95da000b48aa9db9f9930adece03d53978a6188e17a6527f
                                                              • Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
                                                              • Instruction Fuzzy Hash: 27415EB1A10705EFDB25CF99C980AAABBF4FF58700B10496DE656D7250D330EA44CFA4
                                                              Function 0120262C Relevance: .1, Instructions: 119COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5a86891a9f93a8528f77aba9e3993bbb519cc2c9cd346357cdb75d56e8d5c02b
                                                              • Instruction ID: 3ae8a7748a6c71e22df2cd837be7eb1e42da688a59af7a662729487713d121c5
                                                              • Opcode Fuzzy Hash: 5a86891a9f93a8528f77aba9e3993bbb519cc2c9cd346357cdb75d56e8d5c02b
                                                              • Instruction Fuzzy Hash: 0B41A1B1521702DFCB26EF28D944A65B7F5FF54320F10826EC6069B6E2DB30A941CF51
                                                              Function 0123C8F9 Relevance: .1, Instructions: 116COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b5248f4a20fd079eea8053e596abe496693ab51b21e1535fffd08ecba13b07a3
                                                              • Instruction ID: 467ec5384b93e6c0089e74234f14dbdbc932e22068bea38ffe5d99e027b5baf6
                                                              • Opcode Fuzzy Hash: b5248f4a20fd079eea8053e596abe496693ab51b21e1535fffd08ecba13b07a3
                                                              • Instruction Fuzzy Hash: CD316BB2A20346DFDB51CF58C4407A9BBF0FB49724F2185AED519EB251D3769902CF90
                                                              Function 012807C3 Relevance: .1, Instructions: 114COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 60087589e70e427bddb8ff4ae88410ce5bb1d8cd5b62fd0c22ed55d1fe7a9d2e
                                                              • Instruction ID: e2006d1963d7db38f6705ce38c26424efad0a5d57db6c31644bac4652a88f72e
                                                              • Opcode Fuzzy Hash: 60087589e70e427bddb8ff4ae88410ce5bb1d8cd5b62fd0c22ed55d1fe7a9d2e
                                                              • Instruction Fuzzy Hash: E841B0715283419FD320EF29C845BABBBE8FF88724F004A2EF598D7290D7709844CB92
                                                              Function 011F80A0 Relevance: .1, Instructions: 111COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9a913a7f3cb3e01fea75f55928bb98239060192a18f5d5e25a8d55163cab2cfc
                                                              • Instruction ID: 4c4693dbf13847f9daf3cebac36040b871c86619b6142fd71c1566b43de45500
                                                              • Opcode Fuzzy Hash: 9a913a7f3cb3e01fea75f55928bb98239060192a18f5d5e25a8d55163cab2cfc
                                                              • Instruction Fuzzy Hash: 4B41EF71A09616AFDB09DF18C880AA8B7B1FF54764F25832DDA16A7280DB30ED418B90
                                                              Function 012805A7 Relevance: .1, Instructions: 111COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b9856224a3a58f564e94f75e835eb2dee4b28f51a99e6d09747edad9dfa2317a
                                                              • Instruction ID: dbd9db5a082b916e953123084ba3b60b622455e7006c39916d6a3da288a586a9
                                                              • Opcode Fuzzy Hash: b9856224a3a58f564e94f75e835eb2dee4b28f51a99e6d09747edad9dfa2317a
                                                              • Instruction Fuzzy Hash: 1F41C3726156529FD320EF68D840A7AB7E5FFC8700F14062DFA9497680E730E919C7AA
                                                              Function 01204859 Relevance: .1, Instructions: 111COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: dccbcc2c0046ac305a97a5e32965347afc279f2873db8887c64764e42002d0c3
                                                              • Instruction ID: 2b5a58485afe9bcf7f56d08a1c2f08a3376b52cb76e65e9bb6aa3c27cc28c9d7
                                                              • Opcode Fuzzy Hash: dccbcc2c0046ac305a97a5e32965347afc279f2873db8887c64764e42002d0c3
                                                              • Instruction Fuzzy Hash: 1741B1702203468BD726EF18D884B26BBEAEF90360F148A3DE745872E2D770D941CB51
                                                              Function 011F8B50 Relevance: .1, Instructions: 111COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b74b2d938a0267a9434a889b8b23ec2d4a12daa0acdb852b3532a3d7d06bfa24
                                                              • Instruction ID: bf112277e1898c2d0a05ed42ff745f749cb3accdb15bc602a700df34876c53ec
                                                              • Opcode Fuzzy Hash: b74b2d938a0267a9434a889b8b23ec2d4a12daa0acdb852b3532a3d7d06bfa24
                                                              • Instruction Fuzzy Hash: A341B271E11609CFCB19DF69C980AEDB7F2FF98324F15862ED666A7290D734A901CB40
                                                              Function 012102E1 Relevance: .1, Instructions: 106COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                              • Instruction ID: 8bdeb80960bff5e136b64b70e124a4f84ddfcd50a3bb903cc0fd67ea868650e7
                                                              • Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
                                                              • Instruction Fuzzy Hash: 5C312A31A20285AFDB12DB68CC40BABBFE8AF24350F044565F455D7396C6B499C4CBA4
                                                              Function 012AE3DB Relevance: .1, Instructions: 105COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 166a4f2f695c74e7b10b7f1e87366c0ff091acd8766d0fb4ed65c06b3956e29c
                                                              • Instruction ID: f84272600d22a8fb337b515a6b22aa9e70092567a5e0f0cde32c3ae4e83574e5
                                                              • Opcode Fuzzy Hash: 166a4f2f695c74e7b10b7f1e87366c0ff091acd8766d0fb4ed65c06b3956e29c
                                                              • Instruction Fuzzy Hash: 5A31A875760716ABD722EF558C41FBF7AE9EB59B50F410028F700AB291DAA4DC01C7E0
                                                              Function 012B4B4B Relevance: .1, Instructions: 104COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d6d603094ce9aef6fb9032267520a338b4fe66758d69bbdc9f7a1bb310e18f44
                                                              • Instruction ID: d61dd57fe32320918aba7cd02f539117e28ab35e6ec024bae8bffba621d46db7
                                                              • Opcode Fuzzy Hash: d6d603094ce9aef6fb9032267520a338b4fe66758d69bbdc9f7a1bb310e18f44
                                                              • Instruction Fuzzy Hash: F031D6326152418FC331EF1DD8C4EA677E6FB807A0F15447EEA968B256D730E840CB91
                                                              Function 01204260 Relevance: .1, Instructions: 102COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f00a3d0088dc01bf59274cbe57970358524f7dc4d1d2e816a4b16cade481dadb
                                                              • Instruction ID: 5590c8924aaf436f94a135f49be65f39ba4f78b0619280c3e4e6996519eef1ff
                                                              • Opcode Fuzzy Hash: f00a3d0088dc01bf59274cbe57970358524f7dc4d1d2e816a4b16cade481dadb
                                                              • Instruction Fuzzy Hash: CF41DF31220B46DFC726DF68C881FE67BE9BF44714F10892DE6998B291C774E844DB94
                                                              Function 012B4BB0 Relevance: .1, Instructions: 101COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 3b642a2e5fdd344bca4420accb9499722320a812601b8b15f6093b6c9f655320
                                                              • Instruction ID: fc10b96bdf5e9147ded448a1b0a48ba272cc56176e9e92035e7b72b5ce861352
                                                              • Opcode Fuzzy Hash: 3b642a2e5fdd344bca4420accb9499722320a812601b8b15f6093b6c9f655320
                                                              • Instruction Fuzzy Hash: 5F31C3716142429FD320EF28D8C0E6A77E5FB84B60F15456DFA968B292D730EC00CB51
                                                              Function 0127EB1D Relevance: .1, Instructions: 100COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2d4b7fc5fd98b365c4056baab248f89f44df27d21ab326f0d4c85f15883812bb
                                                              • Instruction ID: a267203fb80b448858e100716d29a670b5cf3449119f71bc4ee510d1a7abae33
                                                              • Opcode Fuzzy Hash: 2d4b7fc5fd98b365c4056baab248f89f44df27d21ab326f0d4c85f15883812bb
                                                              • Instruction Fuzzy Hash: 0031CF313216839BF322976D8948B36BFD9BB51B44F1E00E4AB458B6D2EB78D840C235
                                                              Function 012C61C3 Relevance: .1, Instructions: 97COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2ca530fa4b16aea97f321462faa01f89054d3a3327fd1b3abfc3d650df28791c
                                                              • Instruction ID: 9ca5476c226e2ae8e6b3599675fa579870360bca91e7a022cf1ab3e82cd8b0f2
                                                              • Opcode Fuzzy Hash: 2ca530fa4b16aea97f321462faa01f89054d3a3327fd1b3abfc3d650df28791c
                                                              • Instruction Fuzzy Hash: A131B276A1015AABDB15DF98C840FBEB7B6EB48B40F454269EA00AB344D770ED01CB95
                                                              Function 012A483A Relevance: .1, Instructions: 96COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 073165626d14f2b347117601f671ae26c3e5f6f9195d5a92405ff0d7cb355679
                                                              • Instruction ID: d64ef687b5be98a30de80519bf48fa3323dab6dda1f4884c3a70f824cc45e811
                                                              • Opcode Fuzzy Hash: 073165626d14f2b347117601f671ae26c3e5f6f9195d5a92405ff0d7cb355679
                                                              • Instruction Fuzzy Hash: CF318536A5016EABCF21EF54DC84BDEBBF5AB98310F1400A5E908A7250CB70DE91CF90
                                                              Function 0122EB20 Relevance: .1, Instructions: 96COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 31957bd1c6fb5912fc00ae53a595e9e58ab0616a61df72784f18bb9a0f29a4f6
                                                              • Instruction ID: 25b213a8fce4d5aa578cf024b995ec7c32f7bb4d80ba596a57a84e4a48c9a14a
                                                              • Opcode Fuzzy Hash: 31957bd1c6fb5912fc00ae53a595e9e58ab0616a61df72784f18bb9a0f29a4f6
                                                              • Instruction Fuzzy Hash: F831E932E20225BFDB21DFA9CD40AAEBBF9FF14350F114425E915D7250E2709E009BA0
                                                              Function 012C60B8 Relevance: .1, Instructions: 95COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f14d8cf43ee2f603745ece6874845886b1eb99b236bde67b0d9ffb5ccd50ece7
                                                              • Instruction ID: 44b3b3dc95024a71d5c5c22872bbaabb4645d206bacaef4e08816e60a40f3f8f
                                                              • Opcode Fuzzy Hash: f14d8cf43ee2f603745ece6874845886b1eb99b236bde67b0d9ffb5ccd50ece7
                                                              • Instruction Fuzzy Hash: C931C271A60616EFDB22DB99C850B7AB7F9EF94B54F10016DE705EB342DAB0DC018B90
                                                              Function 012007AF Relevance: .1, Instructions: 95COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 8d90ff867369407e0484b099cdf06f9a877494db5eaa0e3b6c8b939ae568b0e9
                                                              • Instruction ID: cdd3abd87f5736554258c713bf16488559bbf1d714b633d3bd1e7fadb0074d8d
                                                              • Opcode Fuzzy Hash: 8d90ff867369407e0484b099cdf06f9a877494db5eaa0e3b6c8b939ae568b0e9
                                                              • Instruction Fuzzy Hash: 1331F632A24612DBD713DE248880B6FBBA6BF94290F02462DFE5597292DB30DD1187D5
                                                              Function 01208550 Relevance: .1, Instructions: 94COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 227eaad9123e60720b340440c61e10a9eaa2ae732d4a7401c2a6dc2a7e6b18bc
                                                              • Instruction ID: 658c8163fcc52611356ae8536581595a7b3ca2d70787ccafe5cbfed9b09ae04e
                                                              • Opcode Fuzzy Hash: 227eaad9123e60720b340440c61e10a9eaa2ae732d4a7401c2a6dc2a7e6b18bc
                                                              • Instruction Fuzzy Hash: FD318171A29302CFE721CF19C840B2BBBE9FB98700F054A6DEA8497391D771E844CB91
                                                              Function 0123A6C7 Relevance: .1, Instructions: 92COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                              • Instruction ID: 0db55baabaed8f2d1a7fd357def0d5591154095c20ec56d08208939e77d5d85e
                                                              • Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
                                                              • Instruction Fuzzy Hash: 11312EB2B10B01AFE765CF69DD81B57BBF8AB48650F04053DA69AC3650E630E900CB50
                                                              Function 012AEBD0 Relevance: .1, Instructions: 91COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e90568b168b9bb4adbfecda46ba486621c26e1f3acfbc01ed8cdd681badddb02
                                                              • Instruction ID: b7a9280384553e7bd22edba10cf66334871e46d5602d5b5623df956631cf19f0
                                                              • Opcode Fuzzy Hash: e90568b168b9bb4adbfecda46ba486621c26e1f3acfbc01ed8cdd681badddb02
                                                              • Instruction Fuzzy Hash: A031CEB1525302CFCB15DF19C54091ABBF2FF99318F4549AEF5889B251E330E946CB92
                                                              Function 0122438F Relevance: .1, Instructions: 89COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 79a5e6c39038ee1c981718dcb54d27c5fb18e31954ca563568636e4a354108da
                                                              • Instruction ID: 088e83e10aa4a8645f5629d52c33f37db95ba451ef74e2c511521425a16a96be
                                                              • Opcode Fuzzy Hash: 79a5e6c39038ee1c981718dcb54d27c5fb18e31954ca563568636e4a354108da
                                                              • Instruction Fuzzy Hash: A331E232B20696AFD720EFB8C881A6EBBF9EB90304F008429D205D3294E770DD45CB90
                                                              Function 011FCB7E Relevance: .1, Instructions: 89COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                                              • Instruction ID: 4716cfa8c2cc622e337c12f94873a3eaefea7b403bd2ea5d4ab67647c8d83f1f
                                                              • Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
                                                              • Instruction Fuzzy Hash: 57213436E5025BBADB04DBB98852BAFBBB5AF50740F0681399F15E7340E370C90087E0
                                                              Function 011FC156 Relevance: .1, Instructions: 88COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a077bac28fa1413999c2274b66c3e6250d4fea9b6c107db5b864b4119bc7c294
                                                              • Instruction ID: aa2703e36233ad273c4db988f2f23931e337cbd78097a76d6adc7bb013a57b9d
                                                              • Opcode Fuzzy Hash: a077bac28fa1413999c2274b66c3e6250d4fea9b6c107db5b864b4119bc7c294
                                                              • Instruction Fuzzy Hash: DC315BB15102068BD739EF58DC80B7977B4EF50314F5481ADEE459B386DA34D982CBA0
                                                              Function 012BC3CD Relevance: .1, Instructions: 88COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                              • Instruction ID: 64248461a0814bc11bd12a03160f9373d388e1ee1800a49b6321af21892f7833
                                                              • Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
                                                              • Instruction Fuzzy Hash: E321603E62065777CB15AB958C40AFBBBB4EF40750F40841AFA5587651E638DA60C360
                                                              Function 011FE420 Relevance: .1, Instructions: 88COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: eede2a9423a3756f5016de9b537628ff93f187aaf21d95ac6db4aba0bc1637bc
                                                              • Instruction ID: 5493015b70d4b4c9439e738de3aea03810e28931ee4e430ec6b1d85322dd5c8a
                                                              • Opcode Fuzzy Hash: eede2a9423a3756f5016de9b537628ff93f187aaf21d95ac6db4aba0bc1637bc
                                                              • Instruction Fuzzy Hash: B931C431A0251C9BDB39DF18CC41BEE77B9AB15750F0201A9E745E72A0E7749E808F91
                                                              Function 01234588 Relevance: .1, Instructions: 87COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                              • Instruction ID: e1482de9f566533ff938984482423a15156b156c395eb2800c95deee8273def4
                                                              • Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
                                                              • Instruction Fuzzy Hash: 0E2191B1A10649EFCB15DF58C980A9EBBB5FF88314F1080E9EE159F241D670EE059F90
                                                              Function 012344B0 Relevance: .1, Instructions: 87COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a7035a328d044d1e95e26059b9e95e3029136a88df965b2fb6063745e49ebf51
                                                              • Instruction ID: dcd420114a4cc38fa63b644bedd541ab9f94e5689ca65f4ef72f684df008c429
                                                              • Opcode Fuzzy Hash: a7035a328d044d1e95e26059b9e95e3029136a88df965b2fb6063745e49ebf51
                                                              • Instruction Fuzzy Hash: 2921C572A247869BC722EF18D440F6B7BE4FBD8760F004559FE559B681D730D901CB91
                                                              Function 011FE388 Relevance: .1, Instructions: 86COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                              • Instruction ID: 2af49cff9f4b627eb31beee42be15c3d6b0abd92b2cb6dff9cf34546fa924027
                                                              • Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
                                                              • Instruction Fuzzy Hash: 03318B31600605EFD729CB68C984F6AB7F9FF45354F1545A9E612CB2A0E730EE01CB51
                                                              Function 0127E609 Relevance: .1, Instructions: 86COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5488ea74144775652eb7cdf2b1cc789851e529327b438873e16d3b99df57e086
                                                              • Instruction ID: b2935308edaf3b8affaed08810f03b806bd43261be069a02fefc7bbfd1152532
                                                              • Opcode Fuzzy Hash: 5488ea74144775652eb7cdf2b1cc789851e529327b438873e16d3b99df57e086
                                                              • Instruction Fuzzy Hash: CE319F75620206DFCB14DF1CC8849AEB7BAFF84704F1644A9E9099B391E771EA50CBA0
                                                              Function 012806F1 Relevance: .1, Instructions: 79COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 04ec565d26b1dfbad851506f2e1a5cd902076cece1187b5057142b1f90a3191b
                                                              • Instruction ID: d0021f65d39f57481e68f5766eef494c9afc8de4031ccdad190b7f18adcff165
                                                              • Opcode Fuzzy Hash: 04ec565d26b1dfbad851506f2e1a5cd902076cece1187b5057142b1f90a3191b
                                                              • Instruction Fuzzy Hash: 2721BF7191162AABCF24EF59C881ABEB7F4FF48740F550069F941EB280D778AD41CBA4
                                                              Function 0128019F Relevance: .1, Instructions: 78COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d02bbb788956f26c8f87397d19700a26f217eddf961334b8d3cbceec4b5d89e1
                                                              • Instruction ID: 2be011948c8fb99f4638fcdfb12a7a4241c58030d9752019d0579004e300bd63
                                                              • Opcode Fuzzy Hash: d02bbb788956f26c8f87397d19700a26f217eddf961334b8d3cbceec4b5d89e1
                                                              • Instruction Fuzzy Hash: 7021BC71620645AFD715EBACD840F6AB7E8FF58750F140069FA04D7690D634ED00CBA8
                                                              Function 01280283 Relevance: .1, Instructions: 74COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 1adb6802e096f25f12a9e36ed4cd76b0045e547cb86a947a55b35da5e233d044
                                                              • Instruction ID: 2286c45a05b28e7b61843e50389ce38e2bc8e327d549c73757ebd2478a7cea86
                                                              • Opcode Fuzzy Hash: 1adb6802e096f25f12a9e36ed4cd76b0045e547cb86a947a55b35da5e233d044
                                                              • Instruction Fuzzy Hash: 9921D0729263469BD711FF69C844B6BBBECAFA0250F084456BE80C7291D774C908C7A6
                                                              Function 01222835 Relevance: .1, Instructions: 73COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 15591866469efae2e9d8668fba252582bd76e9de3504f2b57dfc42de8734d088
                                                              • Instruction ID: cdf02bfd5820f8dd2a7ad66bcfe9cfb6497a2601611b83929e82ad41fb84520f
                                                              • Opcode Fuzzy Hash: 15591866469efae2e9d8668fba252582bd76e9de3504f2b57dfc42de8734d088
                                                              • Instruction Fuzzy Hash: 0F213E31735692EBE322972C8C04B287BD9BF51B74F190364FB20AF6D2D7A8C841C261
                                                              Function 0123A30B Relevance: .1, Instructions: 70COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0ce6c474d5cc6772fd2608b5181d66fdad52f06ad096cb35c04d7b2adaedf05e
                                                              • Instruction ID: 19629ac918d023c3672cdb1ec40bbbac82786acd445b8d584769bf4a724c8707
                                                              • Opcode Fuzzy Hash: 0ce6c474d5cc6772fd2608b5181d66fdad52f06ad096cb35c04d7b2adaedf05e
                                                              • Instruction Fuzzy Hash: F221A979221A029FC725DF29C801B56B7F6FF58B04F24846CA649CBB61E371E842CB94
                                                              Function 012BA49A Relevance: .1, Instructions: 70COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2aae7b9679a3e1fab71e1ff9d3abbccc2c9f3ea5906f8e1ae8307a7df8bfb9ab
                                                              • Instruction ID: 4c5810d5c872802681afa2d991a6ece4df1b521eb0ab96dfa8ef087c65004aa1
                                                              • Opcode Fuzzy Hash: 2aae7b9679a3e1fab71e1ff9d3abbccc2c9f3ea5906f8e1ae8307a7df8bfb9ab
                                                              • Instruction Fuzzy Hash: E6113A327A0B11BFE3225655AC81FBBB6D9DBD4BA0F514028B719CB180EB70DD008795
                                                              Function 01280946 Relevance: .1, Instructions: 70COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 46301c816984df67438dc7db9863db0325698612e0f849dd7e8bcc6456578f3b
                                                              • Instruction ID: 418d3f1cea4b92782f1d527fd409007a5ddee6bc5b38ed1aaef26172a054ffc4
                                                              • Opcode Fuzzy Hash: 46301c816984df67438dc7db9863db0325698612e0f849dd7e8bcc6456578f3b
                                                              • Instruction Fuzzy Hash: DC21E9B1E11209ABCB24DFAAE9849AEFBF9FF98710F10012EE505A7344D7709945CB54
                                                              Function 012980A8 Relevance: .1, Instructions: 69COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                              • Instruction ID: 3147d1e3525cafd386b32caadd1c05ef7af705293e559f2a022206c22dbabf6c
                                                              • Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
                                                              • Instruction Fuzzy Hash: D0218EB2A1020AEFDF12DF98CC40BAEBBBAEF99350F244459F944A7251D774D9508B50
                                                              Function 01230124 Relevance: .1, Instructions: 68COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                              • Instruction ID: 7f7ccf0106665bfd2507009aaa2b5756025fd0a447d0d7cf2fdeb1927a44012e
                                                              • Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
                                                              • Instruction Fuzzy Hash: 8711D0B2610606AFD722DA44C841FAABBB8EB91754F100029F7418F190D671ED44DB64
                                                              Function 01208770 Relevance: .1, Instructions: 68COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 22e537276265e23ef928e95ab35aa04b268c6e1d18feb9669f69909d856bfec8
                                                              • Instruction ID: 77b018c4828496132cca4e137cb615093bf22ff799f8e4dcbbcb8f277d50d280
                                                              • Opcode Fuzzy Hash: 22e537276265e23ef928e95ab35aa04b268c6e1d18feb9669f69909d856bfec8
                                                              • Instruction Fuzzy Hash: 3111E636B206129BDB16CF4DC480927BBE5EF4A710B14417DEF088F25AD6B1D9018B90
                                                              Function 012080E9 Relevance: .1, Instructions: 66COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b22a8a4359ab41069c24a048d76366f1e951d30293495525ea622f1ceae4c305
                                                              • Instruction ID: 3500ac37d6f0e4cb7a7c3cbe256559a8b68fe95e92f7a6aaa6ed1f37bc0b7053
                                                              • Opcode Fuzzy Hash: b22a8a4359ab41069c24a048d76366f1e951d30293495525ea622f1ceae4c305
                                                              • Instruction Fuzzy Hash: B7214975A10206DFCB15CF98C581AAAFBB5FF89318F24426DD205AB355CB71AD06CBD0
                                                              Function 0123674D Relevance: .1, Instructions: 65COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 3ac51a8754390b45a131aeaf440b539fbda328b37c0e9f9591b3518b1bb9a88d
                                                              • Instruction ID: 08925d1f0fca11ec41b232a003f93fdd394c669291c8a9b5e4373a7cde5dd589
                                                              • Opcode Fuzzy Hash: 3ac51a8754390b45a131aeaf440b539fbda328b37c0e9f9591b3518b1bb9a88d
                                                              • Instruction Fuzzy Hash: B62190B5520B01EFD725DF68C841F66B7F8FF84250F40882DE59AC7250DB71A940CB60
                                                              Function 01296870 Relevance: .1, Instructions: 63COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: ef3a4c57b54e337bb02c45afc9df110d8e8a5937324e0ac01bb8673de08746e5
                                                              • Instruction ID: 7383480465c58d311fc6a83e02a87ddae3d189f2715f88006fc76829ff9b1577
                                                              • Opcode Fuzzy Hash: ef3a4c57b54e337bb02c45afc9df110d8e8a5937324e0ac01bb8673de08746e5
                                                              • Instruction Fuzzy Hash: AB11A332260515EFDB22DB5DC940FAA7BE8FF95760F114029F205DB251DA70E905C790
                                                              Function 0122E8C0 Relevance: .1, Instructions: 63COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 429c96fe2cd76cb2ec755532b824b01ae23adad12d900dab3b297fd4181067b6
                                                              • Instruction ID: 360b33f97939a8f0f26d175666528634fa080016ddde784439b8911f04a609d7
                                                              • Opcode Fuzzy Hash: 429c96fe2cd76cb2ec755532b824b01ae23adad12d900dab3b297fd4181067b6
                                                              • Instruction Fuzzy Hash: 76110872320125AFCF19DB29DD91A7FB25AEFD5370B254539EA238B294E9309802C390
                                                              Function 012366B0 Relevance: .1, Instructions: 61COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 297d2a24ab38eb6b2daf410e7f0e8d6c17243de96af8700f04338452e66459fc
                                                              • Instruction ID: eb6b74db18cd7e43c98dbbf6c96f95b25d1bef70a8ebb14e875cad7540f9b581
                                                              • Opcode Fuzzy Hash: 297d2a24ab38eb6b2daf410e7f0e8d6c17243de96af8700f04338452e66459fc
                                                              • Instruction Fuzzy Hash: A41104B2A20202EFCB2ACF59D48091ABBF8EFD4210F55407DDA059B314E630DE00CB90
                                                              Function 012CA8E4 Relevance: .1, Instructions: 61COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                                              • Instruction ID: ecd506c3a7eb832e0ba941338e7523ce05e0aef65a89fe6bc60a9d91b99090fe
                                                              • Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
                                                              • Instruction Fuzzy Hash: E8110436A1090AAFDB19CB58C841BADBBF6FF84710F058369E94597340E671BE41CB80
                                                              Function 0128E7E1 Relevance: .1, Instructions: 59COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                              • Instruction ID: 233530bc5afdb3b26cf919a945b4d3d6cab3ca3acc8a481cd517e15a295b1d8e
                                                              • Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
                                                              • Instruction Fuzzy Hash: 2F110A32631501EFE721AF48C844B1E7BE6EF51754F068428EA099B1F1D770DC40CB90
                                                              Function 012227ED Relevance: .1, Instructions: 58COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 44a85a60964fa00fc71599c9c4ee68d40b8034cba5f767a9ba38b73c328223e7
                                                              • Instruction ID: 59f1d56bdabfa3ca68d0227f6efbe06c6a2cade6bed68255e435ffce2fbce483
                                                              • Opcode Fuzzy Hash: 44a85a60964fa00fc71599c9c4ee68d40b8034cba5f767a9ba38b73c328223e7
                                                              • Instruction Fuzzy Hash: EC012631335686ABE316A66EDC84F3B7B8DFF90390F050075FA009B291D995DC00C2B2
                                                              Function 01204690 Relevance: .1, Instructions: 57COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d63779f803114f6fec1bcdcff3330b1b9b1ada0a3560f199739920e822c95dfd
                                                              • Instruction ID: 0d56106574ea7f9c4226edc58ad979ab7cec0f491cadebde63f3b3fc43322e2c
                                                              • Opcode Fuzzy Hash: d63779f803114f6fec1bcdcff3330b1b9b1ada0a3560f199739920e822c95dfd
                                                              • Instruction Fuzzy Hash: C611A335260685AFDB2BEF5DD940B567BA4EB95764F008219FB04876A2C374E840CF60
                                                              Function 012D4B00 Relevance: .1, Instructions: 57COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6087b6d7d420542802d55aec33263000f0b8dcf8b474425562b2b8286cf4de23
                                                              • Instruction ID: 71ee9542f481df3803e4fc4c2110b5b261dc0a3cdd39767a11493e8d42065e49
                                                              • Opcode Fuzzy Hash: 6087b6d7d420542802d55aec33263000f0b8dcf8b474425562b2b8286cf4de23
                                                              • Instruction Fuzzy Hash: 26112C326106529FD721EB29D844F27B7A6FFD4710F144429EB46C7A50EA30E802CB90
                                                              Function 01236620 Relevance: .1, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d6fb05f766fb9088b4dea897921b7dbcd7813732e7a938f86ee0b6992f8b4841
                                                              • Instruction ID: ab104c237b0e716fe5bacd15ef054cccdffbf8da2abc2ccff62ed77f11512346
                                                              • Opcode Fuzzy Hash: d6fb05f766fb9088b4dea897921b7dbcd7813732e7a938f86ee0b6992f8b4841
                                                              • Instruction Fuzzy Hash: C311C2B2A10616BFDB22DF59C980B5EFBBCEF84790F510058EB01A7240D734AE019F60
                                                              Function 0122EA2E Relevance: .1, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 89a59ce1f5515e77982c9a9ec7e726621f0cf20f3f6815458122cfd05830daa6
                                                              • Instruction ID: c00221d123bc414bed49bba6a52adfdad9f6ddcaa741d56138d02b876d03ec1e
                                                              • Opcode Fuzzy Hash: 89a59ce1f5515e77982c9a9ec7e726621f0cf20f3f6815458122cfd05830daa6
                                                              • Instruction Fuzzy Hash: 65019671511106AFC725DB19E448F2ABBF9FF95724F21417DE2058B2A5D7709C41CB90
                                                              Function 0122E53E Relevance: .1, Instructions: 55COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                              • Instruction ID: c46e6eff12ed07b2df87390894362b36bf294264add2e5b7acebda36ec14b8f7
                                                              • Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
                                                              • Instruction Fuzzy Hash: 7911C6722326D3ABEB22D71CA664B2977D9BB00754F1A00A0DF4187682F328CC91D250
                                                              Function 0128E75D Relevance: .1, Instructions: 54COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                              • Instruction ID: 85c75501e72f9a39aebfe772463c4c7525bba47d0144b1c264083d03bfb1d9ed
                                                              • Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
                                                              • Instruction Fuzzy Hash: 9B01D632622106AFF729BF58CC01F6A7AA9EB51750F068424EB059B1E5D771DD40CB90
                                                              Function 011FA250 Relevance: .1, Instructions: 52COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                              • Instruction ID: c7743c7a62a67082069be9a71c7e9e8e4d64a1a2a2063f9dca3e605f158c326e
                                                              • Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
                                                              • Instruction Fuzzy Hash: D1012635614B219BCB398F59F840A327BE4EF55770700852DFE998B281C739D400CBA0
                                                              Function 012D4940 Relevance: .1, Instructions: 52COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5e5c6e8c15936b9e4ca179f116a6adc010c99f2f708d7cec66cbfb2d9cabd0cc
                                                              • Instruction ID: 3a8a72796da9901eaf64dfa9ffbcaa52499d77c97ccf05445a3489b96590c91a
                                                              • Opcode Fuzzy Hash: 5e5c6e8c15936b9e4ca179f116a6adc010c99f2f708d7cec66cbfb2d9cabd0cc
                                                              • Instruction Fuzzy Hash: 830149725612429FC332EF1DD840EA2B7E8EB91370B254225EA689B59AD730DC01C7C0
                                                              Function 0127E1D0 Relevance: .1, Instructions: 51COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4d83a18506be492cc87d81fb68eb2174c4021b501d90469fe0fd7411feae2dcd
                                                              • Instruction ID: d30a828b49122cc47274d3a941462fce687f97d9c9b2f4e040cd79c12a14b9f2
                                                              • Opcode Fuzzy Hash: 4d83a18506be492cc87d81fb68eb2174c4021b501d90469fe0fd7411feae2dcd
                                                              • Instruction Fuzzy Hash: B111C431261241EFDB16EF19CD80F26BBB8FF54B54F1000A9FA059B6A1C635ED01CBA0
                                                              Function 01206259 Relevance: .1, Instructions: 51COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 528428f952f01ffa7d50bf233a2b1c3f69c432f607c5f0522109142df17f56b9
                                                              • Instruction ID: 31e13577956785e5a5494978c988678f5685a8d970aaf151441cc24ad46e315c
                                                              • Opcode Fuzzy Hash: 528428f952f01ffa7d50bf233a2b1c3f69c432f607c5f0522109142df17f56b9
                                                              • Instruction Fuzzy Hash: 3C119E70511229ABEB29EB24CC42FE87274AF14710F504194B314A60E1D6709E91CF84
                                                              Function 01286050 Relevance: .0, Instructions: 50COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 8ec00c283abdee1d56ca4f43db8f75c5c6f772eee80b844d9c4c38d5053a3308
                                                              • Instruction ID: 95c00e2c44763f0ebb846cc4f13b03cf36157620941697218778d62881f81766
                                                              • Opcode Fuzzy Hash: 8ec00c283abdee1d56ca4f43db8f75c5c6f772eee80b844d9c4c38d5053a3308
                                                              • Instruction Fuzzy Hash: E6111776910019ABCB16EB94CC84DEFBBBDEF58254F044166A906E7211EA34AA15CBE0
                                                              Function 0120208A Relevance: .0, Instructions: 50COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                              • Instruction ID: 52a9ba0139ac770dc162441d6fca18249b418d795be84a62c842794d4bd771ed
                                                              • Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
                                                              • Instruction Fuzzy Hash: 3101F532220212CBDF12DA19D884B66776BBFE4610F5546A6EE058F287DAB2C881C390
                                                              Function 01296500 Relevance: .0, Instructions: 50COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 85d3ee1ad245c62464350e09191ccfba11a39ca2dba7b4c5549781d2fc7fc49f
                                                              • Instruction ID: 06559aa80fbfd4ff67d4271b5fb442dc4156db72edde0c06297f46cf42883170
                                                              • Opcode Fuzzy Hash: 85d3ee1ad245c62464350e09191ccfba11a39ca2dba7b4c5549781d2fc7fc49f
                                                              • Instruction Fuzzy Hash: 6311C4766541469FDB11CF5CE800BA6BBF9FB9A314F098159E948CB315D732EC81CBA0
                                                              Function 0128C810 Relevance: .0, Instructions: 50COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 29d69565f3a37bfb6000dd27a92289233b088a65ea8a1a897b67b6906050f4f3
                                                              • Instruction ID: 8478df70733b617605266d001e42d8030319bdd560f9d2925aadfaf352af5236
                                                              • Opcode Fuzzy Hash: 29d69565f3a37bfb6000dd27a92289233b088a65ea8a1a897b67b6906050f4f3
                                                              • Instruction Fuzzy Hash: 561118B1A102099FCB04DFA9D541AAEBBF8FF58250F10406AA905E7351D674EA018BA4
                                                              Function 012AEA60 Relevance: .0, Instructions: 50COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 32c7eddb9780a55d47ed9655ab23f8ad95e1001ad4f7ab59241f0961c02f6fc3
                                                              • Instruction ID: 44a647b5a4ef1da5bd5bcf985b11cbeca3d94efe60f87cfdd902ec75a20b15ce
                                                              • Opcode Fuzzy Hash: 32c7eddb9780a55d47ed9655ab23f8ad95e1001ad4f7ab59241f0961c02f6fc3
                                                              • Instruction Fuzzy Hash: A001B531160212ABCB36EA15845093ABBFAFF61760B96442EF2555B212CB20AC42CB91
                                                              Function 011FC020 Relevance: .0, Instructions: 49COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                              • Instruction ID: afcd4b51369ac3ed73423ea79d56de5cdec8009a06f47810ad9ada14d6f1ae9a
                                                              • Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
                                                              • Instruction Fuzzy Hash: CE01283211074A9FEB26E6A9D840FB777E9FFD5214F05481DEB468B540DB70E402C790
                                                              Function 012420F0 Relevance: .0, Instructions: 49COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 1a6d308fc2eb73df24ca2bc99353ba5f18ea6dfe4369d0a274acfa7c1838e3ed
                                                              • Instruction ID: d4e23e37cb7fc948ee7cbe311df27711d57c9e369aedde5403066bed8988bdf8
                                                              • Opcode Fuzzy Hash: 1a6d308fc2eb73df24ca2bc99353ba5f18ea6dfe4369d0a274acfa7c1838e3ed
                                                              • Instruction Fuzzy Hash: C2118035A1124DEFDF09EFA4D851FAE7BB5FB44350F004059FA0597290D675AE11CB90
                                                              Function 0123E5CF Relevance: .0, Instructions: 49COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 140da20a922b27e932967249e7d1b54b470e5b148fec441c7ef07e1d70a3461a
                                                              • Instruction ID: 942330f3d5dc79cea8f488e6b7bbf2e502e1423ff56512e5dcdebcfc84cfcf9e
                                                              • Opcode Fuzzy Hash: 140da20a922b27e932967249e7d1b54b470e5b148fec441c7ef07e1d70a3461a
                                                              • Instruction Fuzzy Hash: C40184B1261612BBD711FB69CD80E67B7ECFBA5664B000529B20593551DB64EC41C6A0
                                                              Function 012969C0 Relevance: .0, Instructions: 49COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6ae61821e77cea78d8b246d77ed94e940594557a95ec96d40ef3a5bd19de0691
                                                              • Instruction ID: 0d0ed56a1a5495a160dd3f28d889a616ee272bf225421bea8c988e9e0c96bdbc
                                                              • Opcode Fuzzy Hash: 6ae61821e77cea78d8b246d77ed94e940594557a95ec96d40ef3a5bd19de0691
                                                              • Instruction Fuzzy Hash: 4701FC322342169BC724DF6ED849977BBE8FF54660F614129E95987180E7349901C7D1
                                                              Function 0128C460 Relevance: .0, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b2736232971a2d0b181c740bd51de2eff26dd2812d34545138f19264ad619f92
                                                              • Instruction ID: 0fa56397baddd7f597456740bc55dfc300ca469702b903bdf5935b4508efd7fd
                                                              • Opcode Fuzzy Hash: b2736232971a2d0b181c740bd51de2eff26dd2812d34545138f19264ad619f92
                                                              • Instruction Fuzzy Hash: 7C115B75A1224DABDB15EFA8C844EEE7BB6FB58250F004059B90197380DB34E961CBA0
                                                              Function 0128C97C Relevance: .0, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f350a798c6c07192e3818346459bd3c237a661fdd7a4c84e97ee8ea4c855858a
                                                              • Instruction ID: 7345c83607ce231224f31fede781673cf7bda4ca27c096eb53f8d37f31c41964
                                                              • Opcode Fuzzy Hash: f350a798c6c07192e3818346459bd3c237a661fdd7a4c84e97ee8ea4c855858a
                                                              • Instruction Fuzzy Hash: 13117CB16193099FC700DF69D44199BBBE4FF98310F00455EB998D7390D670E900CBA6
                                                              Function 0128CA11 Relevance: .0, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 90afa241b561810510de7bc7db4a9e2502be3744d3286659bf95021216cc9bfd
                                                              • Instruction ID: 983adbe778d7218755ccef7b6e4c0900c5aafaa903881990abcb0d17ac09579c
                                                              • Opcode Fuzzy Hash: 90afa241b561810510de7bc7db4a9e2502be3744d3286659bf95021216cc9bfd
                                                              • Instruction Fuzzy Hash: B0117C716193099FC300DF69D44195BBBE4FF99350F00452EB998D7390E670E900CBA6
                                                              Function 0121E016 Relevance: .0, Instructions: 46COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                              • Instruction ID: 8daf23ed78ddff9666f3013af0f77daaa9a179412912de5ce72e5a465ded03e5
                                                              • Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
                                                              • Instruction Fuzzy Hash: EE017C32224581EFE723D71DC988F267BD8EF54B54F0A04A1FE05DB692D678DC80C621
                                                              Function 011F826B Relevance: .0, Instructions: 46COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 41ca72a17356fd8a249321a38c4c54f2604c038690db793cd5c4d616e8fea46c
                                                              • Instruction ID: 23c8cdf946e1e9179e1ede9aa48cf5fdb3ee07327f43871dac93a39ae5d56472
                                                              • Opcode Fuzzy Hash: 41ca72a17356fd8a249321a38c4c54f2604c038690db793cd5c4d616e8fea46c
                                                              • Instruction Fuzzy Hash: 880184356115059FDB1CEB69D9049BEB7A9EF41220F19402DDA01A7684DF30E902C791
                                                              Function 012AEB50 Relevance: .0, Instructions: 46COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: a515abd6e295e53f5b14848681eaccf44721891926b28555e3fded9e50007c54
                                                              • Instruction ID: 700ee270bcc617f070778677ba0848b01f10ed166d5772065277493463487c0c
                                                              • Opcode Fuzzy Hash: a515abd6e295e53f5b14848681eaccf44721891926b28555e3fded9e50007c54
                                                              • Instruction Fuzzy Hash: 3301A7712A0701EFD3359B16D845F12BAA8EF55B60F11483DF3069F390D6B0A842CB94
                                                              Function 01202582 Relevance: .0, Instructions: 45COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b237742c249e3b3066876f6caf50474b995ca3abeb119a982155ae10e7618c1e
                                                              • Instruction ID: 31cdd9eb8f235e50af09eb9ba3c5a41589a471ea84775aa0b6094a129c074fdf
                                                              • Opcode Fuzzy Hash: b237742c249e3b3066876f6caf50474b995ca3abeb119a982155ae10e7618c1e
                                                              • Instruction Fuzzy Hash: 42F04932651611BBC732CB468C80F177EE9EB84B90F004029E70597240D630EC00C7A0
                                                              Function 0122C073 Relevance: .0, Instructions: 43COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                              • Instruction ID: 21c35c188e5b6284aa2a1248cb3108ce5a3e4bdc1eff8dbe4e4b3ec9a5b7e3dc
                                                              • Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
                                                              • Instruction Fuzzy Hash: A5F068B2600615ABD324CF4DDC40E6BFBEADBD5A90F058169E655D7220E631DE05CB90
                                                              Function 011FC310 Relevance: .0, Instructions: 43COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                              • Instruction ID: 0290662a627a91754f1f20d2345b692bf91ffb8fbf1cc8421e242e581f0ca8c1
                                                              • Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
                                                              • Instruction Fuzzy Hash: 38F0FC332486379BD73A56594840F3BE995CFE1AE4F1A003DE3059B204CB708D0177D2
                                                              Function 012D634F Relevance: .0, Instructions: 43COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: bb6e048c27eb2655c282660c717f7c8169f8907855e7d2754b4d50c0f383d45c
                                                              • Instruction ID: 2b12860fbfcb42cb20397b537d15812ba8df9de19530b1695e3a6e115ec09606
                                                              • Opcode Fuzzy Hash: bb6e048c27eb2655c282660c717f7c8169f8907855e7d2754b4d50c0f383d45c
                                                              • Instruction Fuzzy Hash: 57012C71A2024AABDB04DFA9E551AAEB7F8FF58714F10406AE904E7350DA74DA018BA4
                                                              Function 012D625D Relevance: .0, Instructions: 43COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 04a6f502b69b3d888bbe14d7ae5f75478610ce759c070556b61d2d675b879e9e
                                                              • Instruction ID: 58644eb444af9f38de48014b2796f256628b97309311e3dadd4625bd3717a879
                                                              • Opcode Fuzzy Hash: 04a6f502b69b3d888bbe14d7ae5f75478610ce759c070556b61d2d675b879e9e
                                                              • Instruction Fuzzy Hash: 5D018F71A2020EEFCB04DFA9D445AAEB7F8FF58304F10402AF900E7350D674AA00CBA4
                                                              Function 012D62D6 Relevance: .0, Instructions: 43COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e50dd46494298c42826ef560d43dfdd409fb072b4e8434dbd938071bef129eab
                                                              • Instruction ID: e7e22177efa5a3edac46f5126877f7d4b825db5a4c89ce94e199f05c2ec41747
                                                              • Opcode Fuzzy Hash: e50dd46494298c42826ef560d43dfdd409fb072b4e8434dbd938071bef129eab
                                                              • Instruction Fuzzy Hash: 53018471A1024DEFCB04DFA9D441AAEB7F8FF58704F50802AF900E7350D6749D008BA4
                                                              Function 0123CA6F Relevance: .0, Instructions: 42COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                              • Instruction ID: 491d836a124b68550076f56295b05028d73294695360bf2fecb818881fd16d55
                                                              • Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
                                                              • Instruction Fuzzy Hash: 8901F9312206869BD326DB1DC809F5ABFE9FF91750F094066FB049B691D6B8C811C250
                                                              Function 012D61E5 Relevance: .0, Instructions: 41COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b19318934065f80c69e3ef7453d1528fce88b4a2eb9b0294d18df85af07b746c
                                                              • Instruction ID: 45564e1291258a5ad01f81678a79eaa60f1fbfcd83c26f85e4f743d52c9f409b
                                                              • Opcode Fuzzy Hash: b19318934065f80c69e3ef7453d1528fce88b4a2eb9b0294d18df85af07b746c
                                                              • Instruction Fuzzy Hash: 3E014F71A102599BDB04DFA9D445AEEBBF8FF58314F14405AE501E7280D774EA01CB98
                                                              Function 012863C0 Relevance: .0, Instructions: 41COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                              • Instruction ID: df91ca6293554313de80844ed61ef7e02081e8003bf44d26a3878d4f1efec127
                                                              • Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
                                                              • Instruction Fuzzy Hash: 36F0127221001DBFEF019F94DD80DBF7B7EFB55298B104125FA1192160D631DD21A7A0
                                                              Function 0128A4B0 Relevance: .0, Instructions: 40COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4506ecb84bad031e2eeadafbb6702c17ff8134f95f7756fd7f5a2794622fb70e
                                                              • Instruction ID: e6689c6349f810026e905b691f9656f52be6a008672a65305f1b03922a8788ff
                                                              • Opcode Fuzzy Hash: 4506ecb84bad031e2eeadafbb6702c17ff8134f95f7756fd7f5a2794622fb70e
                                                              • Instruction Fuzzy Hash: E0018936511149ABCF12AE84E844EDA3F66FB4C764F058116FE1866260C736D9B0EB91
                                                              Function 011FC0F0 Relevance: .0, Instructions: 39COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7e9dceeb4b4134f80d6d14809327f89f92284d0cfb9ab3cb4be929d2cd7b365c
                                                              • Instruction ID: 20821cdaf555822f29f33550dae2baa14f099b6ce2007e317945ed3128753675
                                                              • Opcode Fuzzy Hash: 7e9dceeb4b4134f80d6d14809327f89f92284d0cfb9ab3cb4be929d2cd7b365c
                                                              • Instruction Fuzzy Hash: 5FF02471208249DBF31C96198D01F32329AE7D0694FA5806EEB058B2C1EB71DC1183E5
                                                              Function 0123656A Relevance: .0, Instructions: 39COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7f012bccc80f68319e5968544834718af8a6b336d9ae84b10f078166613ede1f
                                                              • Instruction ID: f523658b27b4a97e6e897a3da516d0ffe7417b031b20e4111cc181d53a567417
                                                              • Opcode Fuzzy Hash: 7f012bccc80f68319e5968544834718af8a6b336d9ae84b10f078166613ede1f
                                                              • Instruction Fuzzy Hash: 4D01A9B03216C2ABE332EB2CDD48B3637E9BB90B14F540164BB018B6D6D778D5018210
                                                              Function 012A437C Relevance: .0, Instructions: 37COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                              • Instruction ID: 8e6cff98243354fa27c0cac0ad1d7ef55c6ea36aaf2aab22bad42756bfc2429d
                                                              • Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
                                                              • Instruction Fuzzy Hash: BEF0E935371A9347E735BB2E8420B3EAA959FD0B41B6D452D9701CB640DFA0D8448790
                                                              Function 0128E872 Relevance: .0, Instructions: 36COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                                              • Instruction ID: c83c647c8b859869d8ab1466980c76475dbbfa0767bcb13d7e7502e5eb07c728
                                                              • Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
                                                              • Instruction Fuzzy Hash: ACF054327365129BE321EA4DCC80F1AB7A9AFD5A60F1A0065A7049B2B4C760EC0187D0
                                                              Function 0128C89D Relevance: .0, Instructions: 36COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 44be7e773f521fc2dbf30ab18ff698630bee5b956d7ff9e1db35ef851a6b73dd
                                                              • Instruction ID: b6faa6ebe58708682166f74c4450ad23db47903c2394db7acbc2cdf736fdaf21
                                                              • Opcode Fuzzy Hash: 44be7e773f521fc2dbf30ab18ff698630bee5b956d7ff9e1db35ef851a6b73dd
                                                              • Instruction Fuzzy Hash: 01F0AF706297449FC314FF68C446A2AB7E4FF98710F80465AB898DB394E634E900CB96
                                                              Function 01230854 Relevance: .0, Instructions: 35COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                              • Instruction ID: 79cc1ecb2b1ba4a75e53a625f407afe0269459353e0b998da448332f4cfbb471
                                                              • Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
                                                              • Instruction Fuzzy Hash: 91F0E9B2620205AFE714DF26CD05F56B7E9EFE8344F148078A645D7164FBB0DD01C6A8
                                                              Function 0128C912 Relevance: .0, Instructions: 34COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: caffa62f37ffa9b92486a39bb9cc9a7fff093c4a9052f9f2a5819ba7e09347d4
                                                              • Instruction ID: 22b0f52ab9096e82242783fe4227856437ad0fb01f0be0cb475510d8e1290231
                                                              • Opcode Fuzzy Hash: caffa62f37ffa9b92486a39bb9cc9a7fff093c4a9052f9f2a5819ba7e09347d4
                                                              • Instruction Fuzzy Hash: 2DF06270A1124DDFCB04EFA9D515AAEB7F4FF18300F108069B955EB385DA74EA01CB64
                                                              Function 012047FB Relevance: .0, Instructions: 33COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c7db7ec37a6b91bc05e1c4aafb84ed570db9f0f2afc9244871fd8db0f2f720c1
                                                              • Instruction ID: dcb3af364fe53a7a9bf2285ab6c1a2cb0a04528a32b67d7197f517d28905731d
                                                              • Opcode Fuzzy Hash: c7db7ec37a6b91bc05e1c4aafb84ed570db9f0f2afc9244871fd8db0f2f720c1
                                                              • Instruction Fuzzy Hash: 8AF090719366D29FE723FB6CC884B21BBD49B00629F08CE6AD74987583C7A4DA80C651
                                                              Function 012C0115 Relevance: .0, Instructions: 32COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a1cdf25b4b4538838b490db75449f860ce1be92a39ec9b47b39b84d2bd43151d
                                                              • Instruction ID: 97c5ad2bb60483e0c369b316ed490e2e39b5cd6e67296de51092ef7dc96b8186
                                                              • Opcode Fuzzy Hash: a1cdf25b4b4538838b490db75449f860ce1be92a39ec9b47b39b84d2bd43151d
                                                              • Instruction Fuzzy Hash: F7F05C2F4367C28ACF325F3C78943E5AF54E7C1920F09115DD7A157209C5B89483C728
                                                              Function 0123C5ED Relevance: .0, Instructions: 31COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7c7b2f396d05a6bc68db9463f97e036dd8ffde425e27dffdd2dbd0c6bc4b1a48
                                                              • Instruction ID: 788cc969eebf97d23c8c8be9592014a49c065aeb67a3dbfca730df1263d82daa
                                                              • Opcode Fuzzy Hash: 7c7b2f396d05a6bc68db9463f97e036dd8ffde425e27dffdd2dbd0c6bc4b1a48
                                                              • Instruction Fuzzy Hash: 35F027F19316929FE332D72CC548B21BBD89BC07A0F089427D616E7662C770F8A1DE51
                                                              Function 01242619 Relevance: .0, Instructions: 31COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                              • Instruction ID: b25cfe2fd081df1c2bae5929989a8100880eaad19973b36d4a8bcea79964c687
                                                              • Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
                                                              • Instruction Fuzzy Hash: 35E0D8323106016BE7159E5A9CC0F677BAEDFD6B10F040079B6045F251C9E2DC0986A4
                                                              Function 01296030 Relevance: .0, Instructions: 29COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                              • Instruction ID: 65f33c167f46f47af96dc2bc72ed16eb8c09538675a393edcbd61fdde61b81a5
                                                              • Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
                                                              • Instruction Fuzzy Hash: F8F01C721242049FE7218F09D985B52BBF8FB55364F45C066E6099B561D379EC40CBA4
                                                              Function 01200710 Relevance: .0, Instructions: 28COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                              • Instruction ID: a71dacd19203fde2b7c703e10806f6fcc91ae58a4d5d8412b6716e02d0bdefc3
                                                              • Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
                                                              • Instruction Fuzzy Hash: 65F0E5392247429BEB1BCF19C080AA57BE5FB513A0B010054FD428B352E775E981CB55
                                                              Function 012349D0 Relevance: .0, Instructions: 28COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                              • Instruction ID: 6d282b7a117c8233e6a2a273191317dde480e222b8741a307585becce819da72
                                                              • Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
                                                              • Instruction Fuzzy Hash: FAE0D8722741C6ABD3217A598821F667BA5EBD97A0F150469E3008B150DBB0EC42C7D8
                                                              Function 012D4164 Relevance: .0, Instructions: 27COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2cdeeb46bc657809817deed1eaa00e0680cd9021ff4ec3fc0674dbbf2f5fcb2d
                                                              • Instruction ID: 6e4b5a232b7a7f90a2de9a67f7d3e40857c064dd7b2b4dcbaeec00dc034ae9f0
                                                              • Opcode Fuzzy Hash: 2cdeeb46bc657809817deed1eaa00e0680cd9021ff4ec3fc0674dbbf2f5fcb2d
                                                              • Instruction Fuzzy Hash: 54F0ED31A3AAD28FE772E73CE280B6677E0AB20630F0E05A4D51087D12D330EC80C660
                                                              Function 012A678E Relevance: .0, Instructions: 27COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                              • Instruction ID: d1e1779c62af644d0088737caf161512652d1576491f0a9e852569972c31ce19
                                                              • Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
                                                              • Instruction Fuzzy Hash: 48E0D872A50124BBEB2197598D05F9A7EADDB90F90F050055B700D70D0D530DE00C6D0
                                                              Function 012D08C0 Relevance: .0, Instructions: 25COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                                              • Instruction ID: d716b34c33d8d40109a69390bbfbdb2c5c7b5ee3b2d4a2c04afb31f663841165
                                                              • Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
                                                              • Instruction Fuzzy Hash: EBE02B316503418BCB208A1DC102A63BFE8DF91620F14806DEE0587662C230F842C6D4
                                                              Function 012025E0 Relevance: .0, Instructions: 23COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: d81f5bcd9939f5a32a32a74e2db85c6ae69c3132c4659be9fcab8047d77ae391
                                                              • Instruction ID: 7da452dc5488e66554d2fb9346246f2d8b2392a88f962fe986ad14b7acf1e463
                                                              • Opcode Fuzzy Hash: d81f5bcd9939f5a32a32a74e2db85c6ae69c3132c4659be9fcab8047d77ae391
                                                              • Instruction Fuzzy Hash: 2EE092321109949BC322FB2ADD05FAA779AEB60770F014629F11557195CA34A810C784
                                                              Function 012BA456 Relevance: .0, Instructions: 23COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                              • Instruction ID: ce1abe084c00a44bf11be54bc568e969ecd20dae9a147dc811c17189f92c08c7
                                                              • Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
                                                              • Instruction Fuzzy Hash: B8E09231030A52DFE7366F2AD848BA67AF1FF50751F148C2DE196124B0C7B898C0CA40
                                                              Function 01284000 Relevance: .0, Instructions: 22COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                              • Instruction ID: acfb8928404d35619093a9c0d94d9dce32d7d262e29c6b806ce9211b8e3dea00
                                                              • Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
                                                              • Instruction Fuzzy Hash: 94E0AE343103468BE719EF19C040B627BA6BFD5A10F28C068AA488F245EB32A8438A40
                                                              Function 0123CA38 Relevance: .0, Instructions: 22COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b91e76c3b4ad0ac094891047f32c89faa83c00a8b9067838c1c3b555655f3379
                                                              • Instruction ID: b56cbe0be245f2749bc3c2db980acef0b2eff97336413a4bf0e9528ec9e62771
                                                              • Opcode Fuzzy Hash: b91e76c3b4ad0ac094891047f32c89faa83c00a8b9067838c1c3b555655f3379
                                                              • Instruction Fuzzy Hash: 96D02B724B10317ACB35F9187C04FA33A9D9BD1220F014872F208B2021D564CCE286C4
                                                              Function 011F823B Relevance: .0, Instructions: 21COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                              • Instruction ID: 1733273bf876243f9b6c324fd53a7f307ec861bc06c6dd4b85cd3b294547f2e9
                                                              • Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
                                                              • Instruction Fuzzy Hash: 8AE0C235020A11EFDB3E6F1AEC00F6176B6FF64B60F21482DF282064A59770BC81CB45
                                                              Function 01202050 Relevance: .0, Instructions: 20COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: fe7b1099b9487bf7a0e8f39185401508a09d09aa049d5dc3d9df3b3dafe7ec0e
                                                              • Instruction ID: 583c99e4528b4153af3577ce68f58c49497191fef5b702af4c25b58fe21d5689
                                                              • Opcode Fuzzy Hash: fe7b1099b9487bf7a0e8f39185401508a09d09aa049d5dc3d9df3b3dafe7ec0e
                                                              • Instruction Fuzzy Hash: 70E0C232110494AFC312FB5DED00F6A739EEFB4370F004226F150876D8CA24AC00C794
                                                              Function 01256AA4 Relevance: .0, Instructions: 17COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
                                                              • Instruction ID: 6f37041628eb7e1c8c72ca2939abd78186c179e1104c10add529e11c33bddc79
                                                              • Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
                                                              • Instruction Fuzzy Hash: 92D05E36521A50AFD3329F1BEA00C13BBFAFBD4A20705062EE54583924C670A806CBA0
                                                              Function 0123E59C Relevance: .0, Instructions: 16COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                              • Instruction ID: ae125975d556d0112756b0d2dabc5d19b65c81b483db5b2fe84004f4d07c73ad
                                                              • Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
                                                              • Instruction Fuzzy Hash: 7FD0A932224620ABDB32EA1CFC00FD333E9BB98730F060459F008C7060C360AC81CA84
                                                              Function 0127E908 Relevance: .0, Instructions: 16COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                              • Instruction ID: 504edb1dfc7ebfa3128e49e351def8118da3b12b915f38cecb64cebc8da7725d
                                                              • Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
                                                              • Instruction Fuzzy Hash: E1E0EC36960685DBDF12DF59C640F5ABBF9BB94B40F160458A1085B661C634AD00CB50
                                                              Function 011FA0E3 Relevance: .0, Instructions: 15COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                              • Instruction ID: 0e04df892ed121a30fde54b6581c2c1c9b345fdd892b122b9a8864c9851c52eb
                                                              • Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
                                                              • Instruction Fuzzy Hash: 4AD0223232603093DB2C96557800F63790AEF80AA0F0B002C760E93800C2088C43C2E0
                                                              Function 0123A830 Relevance: .0, Instructions: 14COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                                              • Instruction ID: c96b19ee6c24e12354f2c7cd05a2ebeb75fb82c2d2246dfa2aca4a565ad5c054
                                                              • Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
                                                              • Instruction Fuzzy Hash: D1D012371E054DBBCB11DF66DC01FA57BA9E764BA0F444020F504875A0D63AE950D684
                                                              Function 0123CA24 Relevance: .0, Instructions: 14COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 98b6351791c457778210ffddf6aeb022d0157dbbefc070ac0ad7b16ae7e8a52c
                                                              • Instruction ID: 6873f9a2b425fa74f4877e146fcedeadd4c9b986290fc6971ba7c5d73e1fd4cc
                                                              • Opcode Fuzzy Hash: 98b6351791c457778210ffddf6aeb022d0157dbbefc070ac0ad7b16ae7e8a52c
                                                              • Instruction Fuzzy Hash: 31D05230A710028BDF2BEF08CA28A3A3AB0EB60640B40006CE700A2424E368D8128B00
                                                              Function 012102A0 Relevance: .0, Instructions: 13COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                              • Instruction ID: d74b4db1467d7de69c94a83ca0c7cdf245a2956411a64d224498ec1a1f05611f
                                                              • Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
                                                              • Instruction Fuzzy Hash: A7D0C935222E81CFD62BDB1DC5A4B5533E8BB44B44F814490F541CBB66D66CD980CA04
                                                              Function 0123C700 Relevance: .0, Instructions: 12COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                              • Instruction ID: b579aa79eed0e13b9266111ecfebaf1d376fef19163706333e9b834231300496
                                                              • Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
                                                              • Instruction Fuzzy Hash: A4C012322A0648AFC712EA99CD01F127BAAEBA8B50F000021F2048B670D631E820EA84
                                                              Function 00416CEB Relevance: .0, Instructions: 11COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2190313721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_400000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 07bcd9975a20d5b5212067cf8e08d1c6910c773f40d55ca02a99d03a03bbedd3
                                                              • Instruction ID: e6a1fcf6a868967ace345d9f12a80fe9a541f047b4fc28353f99e9188280b30d
                                                              • Opcode Fuzzy Hash: 07bcd9975a20d5b5212067cf8e08d1c6910c773f40d55ca02a99d03a03bbedd3
                                                              • Instruction Fuzzy Hash: BEA01213E470084050300C683840078F334D1C3035D0877A7DD0C735500443C41000CD
                                                              Function 01220310 Relevance: .0, Instructions: 11COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                              • Instruction ID: a2b82407cba3d09d295d1c8cfc9b4942814081dcfbc8b9da6879efc26c7903a6
                                                              • Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
                                                              • Instruction Fuzzy Hash: 88D01236110248EFCB01DF41C890DAE772AFBD8710F108019FD190B6108A31ED62DA90
                                                              Function 01200750 Relevance: .0, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                              • Instruction ID: 4c18c36c9d6d7397b60febf6b01614a3dc194e9a0657ed31baa7cdbf7da1dfb5
                                                              • Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
                                                              • Instruction Fuzzy Hash: 07C08838B20A028FCF02CB2AC2C0F08B3E0FB00B00F020880E800CBB22E220E800CA00
                                                              Function 01244340 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: ec53e1d45b65e60f894385763219ca949db8768e7380eccb22551be9cb1da800
                                                              • Instruction ID: 23b221f6bcc305ce1a66fabfa565514484174407aa541893ecc12b2d4e8468b3
                                                              • Opcode Fuzzy Hash: ec53e1d45b65e60f894385763219ca949db8768e7380eccb22551be9cb1da800
                                                              • Instruction Fuzzy Hash: A9900231615800129280715948C45464005A7E0301B55C011F5424554CCA648A565761
                                                              Function 01244650 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 3850263ce2eb2c26f42cec871ead9e65a15c51beb0f0dbcd2e6fec671548d925
                                                              • Instruction ID: fde01e0ab532aaddc040113dc806fb03e20f4ee8172046f3f450fe561bf36005
                                                              • Opcode Fuzzy Hash: 3850263ce2eb2c26f42cec871ead9e65a15c51beb0f0dbcd2e6fec671548d925
                                                              • Instruction Fuzzy Hash: 0D900271611500424280715948444066005A7E1301395C115B5554560CC66889559769
                                                              Function 01242BA0 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f5cdf99e41808805c5567e7b6bd76936af15f1d60506001efadba32142444f74
                                                              • Instruction ID: b5b40a93faa38e1a98a11fdfd0837122d35bd1b7df082c3a0225591d2fd1b6b9
                                                              • Opcode Fuzzy Hash: f5cdf99e41808805c5567e7b6bd76936af15f1d60506001efadba32142444f74
                                                              • Instruction Fuzzy Hash: A490023161540802D29071594454746000597D0301F55C011B5024654DC7A58B557BA1
                                                              Function 01242B80 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 77349c2243436e5689be590476c7a2702499a131af3e7512df559c2dd0c699ab
                                                              • Instruction ID: 10bfe84d25d7feb33f67c402d1ba3a45aa083910bc734853742773988302135b
                                                              • Opcode Fuzzy Hash: 77349c2243436e5689be590476c7a2702499a131af3e7512df559c2dd0c699ab
                                                              • Instruction Fuzzy Hash: 3C90023121140802D24471594844686000597D0301F55C011BB024655ED6B589917631
                                                              Function 01242BE0 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e0c7dc01a3eaad2d15040ba4f24736f4fdb7a8d3ccfaf2e24878ccac88c936ba
                                                              • Instruction ID: 239dc99f72a8787190a2ce4308ff8787a4784d229bd9636f690cf5d0df287495
                                                              • Opcode Fuzzy Hash: e0c7dc01a3eaad2d15040ba4f24736f4fdb7a8d3ccfaf2e24878ccac88c936ba
                                                              • Instruction Fuzzy Hash: F990023121544842D28071594444A46001597D0305F55C011B5064694DD6758E55BB61
                                                              Function 01242AB0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d948bb5602b922f23e3a738faee8f120ca4a4289b15db0b98fd6b4d56c264e35
                                                              • Instruction ID: 6fbf1cdf198399cdc77d3ade2d7cfacaff32e1d8a26f63ad02419ea4c9fb6ab4
                                                              • Opcode Fuzzy Hash: d948bb5602b922f23e3a738faee8f120ca4a4289b15db0b98fd6b4d56c264e35
                                                              • Instruction Fuzzy Hash: E39002B1211540924640B2598444B0A450597E0201B55C016F6054560CC57589519635
                                                              Function 01242AF0 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 89817238dec58faa9c4ca085e28ca3e08241761377360d614dc7397ec738a32b
                                                              • Instruction ID: cb15952460588d4a12f587b8b09089b20c7f726ef7499d2e5c8a72f4f1a2bce4
                                                              • Opcode Fuzzy Hash: 89817238dec58faa9c4ca085e28ca3e08241761377360d614dc7397ec738a32b
                                                              • Instruction Fuzzy Hash: 85900235231400020285B559064450B0445A7D6351395C015F6416590CC67189655721
                                                              Function 01242D00 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 55409d6ee668675ec6741578297d84b82ebf1f3d87917d15dcabd7833b21ee5f
                                                              • Instruction ID: 16cc92469698fc2df33e355ce304113978106b2d44ba0f75fc95e270f24bfea4
                                                              • Opcode Fuzzy Hash: 55409d6ee668675ec6741578297d84b82ebf1f3d87917d15dcabd7833b21ee5f
                                                              • Instruction Fuzzy Hash: 7090023121544442D24075595448A06000597D0205F55D011B6064595DC6758951A631
                                                              Function 01242DB0 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 112e5b32c7c43699f2b397f7f506b262f34362d1913cdf9dfa682d6d13ceb9db
                                                              • Instruction ID: 2b08a0940dd0872bf42c4ed80c10a45bbeb533d8b8d591f89ddfd0e819ea8c88
                                                              • Opcode Fuzzy Hash: 112e5b32c7c43699f2b397f7f506b262f34362d1913cdf9dfa682d6d13ceb9db
                                                              • Instruction Fuzzy Hash: 3290023125140402D281715944446060009A7D0241F95C012B5424554EC6A58B56AF61
                                                              Function 01242C60 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 4dd6919bd2da09914b6e28c6d0e5863a1ebcdf8668e49baec578235209e088bb
                                                              • Instruction ID: 817c79e3a5ba0020e64e902f7c90fb2e5bd38d5634efafb50b020cbdc65f20fb
                                                              • Opcode Fuzzy Hash: 4dd6919bd2da09914b6e28c6d0e5863a1ebcdf8668e49baec578235209e088bb
                                                              • Instruction Fuzzy Hash: 0690023121140842D24071594444B46000597E0301F55C016B5124654DC665C9517A21
                                                              Function 01242CF0 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e66d029732010546b1e9241dce81dc46903e96218a20f4674400229baa8b1bf9
                                                              • Instruction ID: e6efbbe89dd30e08ee742c9b8073be2fbebdda8a31ce99a72408d2ac942dca54
                                                              • Opcode Fuzzy Hash: e66d029732010546b1e9241dce81dc46903e96218a20f4674400229baa8b1bf9
                                                              • Instruction Fuzzy Hash: B690043131140403D340715D554C7070005D7D0301F55D411F543455CDD7F7CD517731
                                                              Function 01242CC0 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0b0b545617b93e76eb1266c4f8bd6307ea5af14283b593cca1628f4250e39dab
                                                              • Instruction ID: 9cc0dcc9c51ae6f5bc7830ff3be45c36470762c73aa50320b80b1038b67e344c
                                                              • Opcode Fuzzy Hash: 0b0b545617b93e76eb1266c4f8bd6307ea5af14283b593cca1628f4250e39dab
                                                              • Instruction Fuzzy Hash: 3890023161540402D28071595458706001597D0201F55D011B5024554DC6A98B556BA1
                                                              Function 01242F60 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a967a94acb7dea2a15653501a93385c0c9e665fbe9b12eec3900cce5faab2bc5
                                                              • Instruction ID: 98b34316e910c2486417a636913d9e66ce6f7ae498457934658baf75a51dbb5e
                                                              • Opcode Fuzzy Hash: a967a94acb7dea2a15653501a93385c0c9e665fbe9b12eec3900cce5faab2bc5
                                                              • Instruction Fuzzy Hash: D690047133140043D344715D44447070045D7F1301F55C013F7154554CC57DCD715735
                                                              Function 01242FA0 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5ee9c2540de140e1f3cb75f385cbf515403c70125a483431b4e3eb5732d49fc6
                                                              • Instruction ID: fc7e7c5102d029317133c3399624c95345f6cd906deb6c16bc0e526032d6d16c
                                                              • Opcode Fuzzy Hash: 5ee9c2540de140e1f3cb75f385cbf515403c70125a483431b4e3eb5732d49fc6
                                                              • Instruction Fuzzy Hash: 8F90023121180402D24071594848747000597D0302F55C011BA164555EC6B5C9916A31
                                                              Function 01242E30 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 3180331f54bde0158b520595c820bd350f790ce0ccfa4e9906402e62eef3d059
                                                              • Instruction ID: 9e5aa0d3b594319aec04269427d4676298e44b844e10143df69189b931a69050
                                                              • Opcode Fuzzy Hash: 3180331f54bde0158b520595c820bd350f790ce0ccfa4e9906402e62eef3d059
                                                              • Instruction Fuzzy Hash: B190023131140402D242715944546060009D7D1345F95C012F6424555DC6758A53A632
                                                              Function 01242EE0 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 02944047822a7b999809b9e74117e135b04b1bc28245b546299c3a010ab3602b
                                                              • Instruction ID: 055cbc8854ab56e9cbfa51128c6ee3e273edd51215e4f5626f4977b646df3359
                                                              • Opcode Fuzzy Hash: 02944047822a7b999809b9e74117e135b04b1bc28245b546299c3a010ab3602b
                                                              • Instruction Fuzzy Hash: 1290027121180403D28075594844607000597D0302F55C011B7064555ECA798D516635
                                                              Function 01243010 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 97500ece2509e30b41db0dc13552f67b00e5a2483802f94a107cf5d8f23bfb47
                                                              • Instruction ID: 01036786ad49c594082299854a456f0b8fbbe6d1288aecab349f71edf44fcb8e
                                                              • Opcode Fuzzy Hash: 97500ece2509e30b41db0dc13552f67b00e5a2483802f94a107cf5d8f23bfb47
                                                              • Instruction Fuzzy Hash: 6C90023121184442D28072594844B0F410597E1202F95C019B9156554CC96589555B21
                                                              Function 01243090 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 3847f2a2145dc1f9cf2bc86d32efd687ffd01838193514b338412f1c2b9ca3b2
                                                              • Instruction ID: 7524d257667330daab7bc36a4f34bce6121ab9f46eecc372920973ced1df9502
                                                              • Opcode Fuzzy Hash: 3847f2a2145dc1f9cf2bc86d32efd687ffd01838193514b338412f1c2b9ca3b2
                                                              • Instruction Fuzzy Hash: 0090023125140802D280715984547070006D7D0601F55C011B5024554DC6668A656BB1
                                                              Function 012435C0 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 56f20a8128483c874ff43f1bc6278bc0637c41e1b70e164b19ff407240e7d0e4
                                                              • Instruction ID: 3a97b411b8547feaf5a026f95e5885e7727989469eae7830fda3edcb5fbd8f39
                                                              • Opcode Fuzzy Hash: 56f20a8128483c874ff43f1bc6278bc0637c41e1b70e164b19ff407240e7d0e4
                                                              • Instruction Fuzzy Hash: 5190023161550402D24071594554706100597D0201F65C411B5424568DC7E58A516AA2
                                                              Function 012439B0 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 21d1384e2ad7ebb8fa9a09e23fbdb94d991415d4618c2f08488b6f5ad9a82085
                                                              • Instruction ID: 553a5d1e5d9d95481b0196a24d041f40f4a3a618224d5822509d5c6d28d00ee5
                                                              • Opcode Fuzzy Hash: 21d1384e2ad7ebb8fa9a09e23fbdb94d991415d4618c2f08488b6f5ad9a82085
                                                              • Instruction Fuzzy Hash: 1090023125545102D290715D44446164005B7E0201F55C021B5814594DC5A589556721
                                                              Function 01243D10 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e6ea21f144a88653afa8bae63ec95741c98ed398e1b5cd7fab26d7b65034b329
                                                              • Instruction ID: 4a49eda6d740a3cb2a1085927f4d425174f1e76cd4f425591116040d4245eee0
                                                              • Opcode Fuzzy Hash: e6ea21f144a88653afa8bae63ec95741c98ed398e1b5cd7fab26d7b65034b329
                                                              • Instruction Fuzzy Hash: 0C90023121240142968072595844A4E410597E1302B95D415B5015554CC96489615721
                                                              Function 01243D70 Relevance: .0, Instructions: 4COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0c32ddf374b18d1fed8caf03722efbf85d361de7e630b0fc614626a47a3024dd
                                                              • Instruction ID: b9a47a11dca5049536935dca192061ff94b37fb0c412393981c160d41c43c9b3
                                                              • Opcode Fuzzy Hash: 0c32ddf374b18d1fed8caf03722efbf85d361de7e630b0fc614626a47a3024dd
                                                              • Instruction Fuzzy Hash: B090023521140402D65071595844646004697D0301F55D411B5424558DC6A489A1A621
                                                              Function 01242C00 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                              • Instruction ID: 305337878934c6c49de4bed2adf44da5f00cbf03fb4636cff9eef5a7475ad99d
                                                              • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                              • Instruction Fuzzy Hash:
                                                              Function 01242890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: ___swprintf_l
                                                              • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                              • API String ID: 48624451-2108815105
                                                              • Opcode ID: bfdc01a7675f33f58f84d24e08c6b1e4479ac75294ad033d90ef978a58b06089
                                                              • Instruction ID: 710503c5c036db4934d5854aff5db78026a5ee1db65885ea59668a85f7db2a3d
                                                              • Opcode Fuzzy Hash: bfdc01a7675f33f58f84d24e08c6b1e4479ac75294ad033d90ef978a58b06089
                                                              • Instruction Fuzzy Hash: C451E6B6A20117FFDB15DF9D989097FFBB8BB082407148229F565D7642D374DE408BA0
                                                              Function 012B2410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: ___swprintf_l
                                                              • String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
                                                              • API String ID: 48624451-2108815105
                                                              • Opcode ID: b18c65ff0ab8fad6d4e9f750e3e56881857a3ed8c2588c0ab41d93a2ea209939
                                                              • Instruction ID: 1ad32ebf0ef8c2e37ac214ee60b167c0868640e6f8ca88a71e8e5413f4e5b856
                                                              • Opcode Fuzzy Hash: b18c65ff0ab8fad6d4e9f750e3e56881857a3ed8c2588c0ab41d93a2ea209939
                                                              • Instruction Fuzzy Hash: 9251F571A20746EECB28DE5CD8D09BFB7F8EB44340B048459E6A6D7641D6B4FA40C760
                                                              Function 01237630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • Execute=1, xrefs: 01274713
                                                              • ExecuteOptions, xrefs: 012746A0
                                                              • CLIENT(ntdll): Processing section info %ws..., xrefs: 01274787
                                                              • CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01274655
                                                              • CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 012746FC
                                                              • CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01274725
                                                              • CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01274742
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
                                                              • API String ID: 0-484625025
                                                              • Opcode ID: 31c53501f4f5d2c3ebb57483efdbd3e48bfeaad4663ea300659a77feafd5f656
                                                              • Instruction ID: 5d97ab80237ddc9a883e4f8bc421eea25f3ce85aee99a50b86df39e740d24cda
                                                              • Opcode Fuzzy Hash: 31c53501f4f5d2c3ebb57483efdbd3e48bfeaad4663ea300659a77feafd5f656
                                                              • Instruction Fuzzy Hash: 65513AF162021A7FEF29ABA8DC99FBE77A8EF54314F0400ADE605A7181D7709A41CF50
                                                              Function 012D6940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                              • Instruction ID: 5d02768f265d1efe4841f972599cf21897e2acaea4f0f160eb671427bb20673d
                                                              • Opcode Fuzzy Hash: 2a48bdd4d8ea14c469ad441b94cf96c101b09c67394ceba66eb56f2a3b9e53c1
                                                              • Instruction Fuzzy Hash: E0021571528342AFD309CF18C494E6BBBE5EFC8704F44892DFA899B264DB35E905CB52
                                                              Function 0124B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: __aulldvrm
                                                              • String ID: +$-$0$0
                                                              • API String ID: 1302938615-699404926
                                                              • Opcode ID: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                              • Instruction ID: d0b973182ba2f16792e495dc0af8d3aa6607ddea34572076412dd10f72cb6a8f
                                                              • Opcode Fuzzy Hash: 53abcd45f1248799eb7edd6da4205106d70e70754ef1e870ff48280e40c18d32
                                                              • Instruction Fuzzy Hash: 0181BE71E2524A9FEF2DCF6CC8917FEBBA2AF45320F184219DA61A7291C674C840CB51
                                                              Function 012B20E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: ___swprintf_l
                                                              • String ID: %%%u$[$]:%u
                                                              • API String ID: 48624451-2819853543
                                                              • Opcode ID: a5e864b4a26171e5c471d5beea27c423ebd4f0764c555118bbe8c7c4dbe9c123
                                                              • Instruction ID: 475419bda5946ceaeb673612e4acc06bf1ed8f14af7c1dec5d8769d2221d1ddc
                                                              • Opcode Fuzzy Hash: a5e864b4a26171e5c471d5beea27c423ebd4f0764c555118bbe8c7c4dbe9c123
                                                              • Instruction Fuzzy Hash: 2F213A7692021AEBDB15DF79DC84AFE7BF8EF54794F440115EA15E3201E730E90287A1
                                                              Function 0122F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 012702BD
                                                              • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 012702E7
                                                              • RTL: Re-Waiting, xrefs: 0127031E
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
                                                              • API String ID: 0-2474120054
                                                              • Opcode ID: 32a4a3138d4e9148336e46aaeded37c3076fde941b3978a49bc2700fc813a5b4
                                                              • Instruction ID: 90866000ca01fe48ffbd3bb2c444ba1d9685de1de64b0cf8c17d301408fb686a
                                                              • Opcode Fuzzy Hash: 32a4a3138d4e9148336e46aaeded37c3076fde941b3978a49bc2700fc813a5b4
                                                              • Instruction Fuzzy Hash: 84E1AF31624752AFD725CF28C985B2ABBF0FB45714F140A2DF6A58B2D1D7B4D848CB42
                                                              Function 0123BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • RTL: Resource at %p, xrefs: 01277B8E
                                                              • RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01277B7F
                                                              • RTL: Re-Waiting, xrefs: 01277BAC
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                              • API String ID: 0-871070163
                                                              • Opcode ID: d29fd15e670cc0fca7a7ae8e6ec691cfa68a668d43f3b98353c83d40a14e4734
                                                              • Instruction ID: 41311a10b2dcb1909f8c70c9d8886eea497671436248534c9db8d281fdf35e12
                                                              • Opcode Fuzzy Hash: d29fd15e670cc0fca7a7ae8e6ec691cfa68a668d43f3b98353c83d40a14e4734
                                                              • Instruction Fuzzy Hash: 0141CF713217039FD724DE29C841B6BB7E5EF98721F100A2DFA5A9B680DB71E8058B91
                                                              Function 0123B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0127728C
                                                              Strings
                                                              • RTL: Resource at %p, xrefs: 012772A3
                                                              • RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01277294
                                                              • RTL: Re-Waiting, xrefs: 012772C1
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                              • String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
                                                              • API String ID: 885266447-605551621
                                                              • Opcode ID: 980842b344d2d33ff544144c0db43325dd38009e30a11a46f9e5046778d4468f
                                                              • Instruction ID: df97ccbc41a7c688148ced6f4b7c98c4882100b89d57bb2febf04ce86aaf9310
                                                              • Opcode Fuzzy Hash: 980842b344d2d33ff544144c0db43325dd38009e30a11a46f9e5046778d4468f
                                                              • Instruction Fuzzy Hash: 2D41FF71720603ABCB20DE29CC45F6BBBA5FB94710F100619FE65AB280DB71E8428BD1
                                                              Function 012B2300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: ___swprintf_l
                                                              • String ID: %%%u$]:%u
                                                              • API String ID: 48624451-3050659472
                                                              • Opcode ID: a1f6f819969edcfef866ecaaddfd986fe37482f83ae99db75775430930bda1f1
                                                              • Instruction ID: b3729819896c2510a178d9daea0eefa598f4b3fcd79ac1cb24dffb192ddf5f02
                                                              • Opcode Fuzzy Hash: a1f6f819969edcfef866ecaaddfd986fe37482f83ae99db75775430930bda1f1
                                                              • Instruction Fuzzy Hash: FD318472A21219DFDB20DF29DC80BFE77B8EB54750F440559E949E3240EB30AA458BA0
                                                              Function 01247D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID: __aulldvrm
                                                              • String ID: +$-
                                                              • API String ID: 1302938615-2137968064
                                                              • Opcode ID: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                              • Instruction ID: 32b7410c43a12628fc45b128d2ffaa573a9b9246c2613bf7c1f67204caef9cd3
                                                              • Opcode Fuzzy Hash: 0e72ee8b5e9315034f2b46ff5b251d52fedc42f24a18d50ff17db184198f4ea1
                                                              • Instruction Fuzzy Hash: 2291B171E302079BEB2CDF6DC881ABEBBA5BF44320F55461AEA75A72C0D77099408B11
                                                              Function 01209126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.2191061034.00000000011D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 011D0000, based on PE: true
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_11d0000_Ticari Siparis Belgesi 26 07 2024 17545000600.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: $$@
                                                              • API String ID: 0-1194432280
                                                              • Opcode ID: c556870b6561a8e4facfd7027ca8230576bc891071b13ac722a444e1e453f75d
                                                              • Instruction ID: fadd7a397b568e959afdccc5c32dcdf0873727c568ce2d456b7cfaab311bf34c
                                                              • Opcode Fuzzy Hash: c556870b6561a8e4facfd7027ca8230576bc891071b13ac722a444e1e453f75d
                                                              • Instruction Fuzzy Hash: 9C811A71D1126ADBDB35CB54DC45BEEB6B8AB08714F0041EAAA1EB7281D7705EC4CFA0

                                                              Execution Graph

                                                              Execution Coverage:2.3%
                                                              Dynamic/Decrypted Code Coverage:0%
                                                              Signature Coverage:4.7%
                                                              Total number of Nodes:444
                                                              Total number of Limit Nodes:16
                                                              execution_graph 13503 10464f82 13504 10464fb8 13503->13504 13507 10465081 13504->13507 13514 10465022 13504->13514 13515 104615b2 13504->13515 13506 10465134 13510 104651b2 13506->13510 13506->13514 13518 10461732 13506->13518 13507->13506 13509 10465117 getaddrinfo 13507->13509 13507->13514 13509->13506 13510->13514 13521 104616b2 13510->13521 13512 104657f4 setsockopt recv 13512->13514 13513 10465729 13513->13512 13513->13514 13516 104615ec 13515->13516 13517 1046160a socket 13515->13517 13516->13517 13517->13507 13519 1046176a 13518->13519 13520 10461788 connect 13518->13520 13519->13520 13520->13510 13522 104616e7 13521->13522 13523 10461705 send 13521->13523 13522->13523 13523->13513 13756 10466a4d 13757 10466a53 13756->13757 13760 1045a782 13757->13760 13759 10466a6b 13761 1045a78f 13760->13761 13762 1045a7ad 13761->13762 13764 1045f662 13761->13764 13762->13759 13765 1045f7ba 13764->13765 13766 1045f66b 13764->13766 13765->13762 13766->13765 13767 104590f2 6 API calls 13766->13767 13769 1045f6ee 13767->13769 13768 1045f750 13768->13765 13770 1045f791 13768->13770 13772 1045f83f 13768->13772 13769->13768 13771 10464f82 6 API calls 13769->13771 13770->13765 13774 10464f82 6 API calls 13770->13774 13771->13768 13772->13765 13773 10464f82 6 API calls 13772->13773 13773->13765 13774->13765 13775 10465e0a 13776 10464942 13775->13776 13777 10465e45 NtProtectVirtualMemory 13776->13777 13778 10465e70 13777->13778 13903 1045e14a 13904 1045e153 13903->13904 13909 1045e174 13903->13909 13905 10460382 ObtainUserAgentString 13904->13905 13907 1045e16c 13905->13907 13906 1045e1e7 13908 104590f2 6 API calls 13907->13908 13908->13909 13909->13906 13911 104591f2 13909->13911 13912 1045920f 13911->13912 13913 104592c9 13911->13913 13915 10463f12 7 API calls 13912->13915 13916 10459242 13912->13916 13913->13909 13914 10459289 13914->13913 13918 104590f2 6 API calls 13914->13918 13915->13916 13916->13914 13917 1045a432 NtCreateFile 13916->13917 13917->13914 13918->13913 13811 1045ecd4 13813 1045ecd8 13811->13813 13812 1045f022 13813->13812 13817 1045e352 13813->13817 13815 1045ef0d 13815->13812 13826 1045e792 13815->13826 13818 1045e39e 13817->13818 13819 1045e4ec 13818->13819 13821 1045e595 13818->13821 13825 1045e58e 13818->13825 13820 10464232 NtCreateFile 13819->13820 13823 1045e4ff 13820->13823 13822 10464232 NtCreateFile 13821->13822 13821->13825 13822->13825 13824 10464232 NtCreateFile 13823->13824 13823->13825 13824->13825 13825->13815 13827 1045e7e0 13826->13827 13828 10464232 NtCreateFile 13827->13828 13830 1045e90c 13828->13830 13829 1045eaf3 13829->13815 13830->13829 13831 1045e352 NtCreateFile 13830->13831 13832 1045e602 NtCreateFile 13830->13832 13831->13830 13832->13830 13493 10465e12 13494 10465e45 NtProtectVirtualMemory 13493->13494 13497 10464942 13493->13497 13496 10465e70 13494->13496 13498 10464967 13497->13498 13498->13494 13779 1045a613 13781 1045a620 13779->13781 13780 1045a684 13781->13780 13782 10465e12 NtProtectVirtualMemory 13781->13782 13782->13781 13528 104592dd 13532 1045931a 13528->13532 13529 104593fa 13530 10459328 SleepEx 13530->13530 13530->13532 13532->13529 13532->13530 13535 10463f12 13532->13535 13544 1045a432 13532->13544 13554 104590f2 13532->13554 13536 10463f48 13535->13536 13537 104640e9 13536->13537 13541 10464232 NtCreateFile 13536->13541 13543 10464134 13536->13543 13560 10464f82 13536->13560 13538 10464125 13537->13538 13572 10463842 13537->13572 13580 10463922 13538->13580 13541->13536 13543->13532 13545 1045a45b 13544->13545 13553 1045a4c9 13544->13553 13546 10464232 NtCreateFile 13545->13546 13545->13553 13547 1045a496 13546->13547 13548 1045a4c5 13547->13548 13592 1045a082 13547->13592 13549 10464232 NtCreateFile 13548->13549 13548->13553 13549->13553 13551 1045a4b6 13551->13548 13601 10459f52 13551->13601 13553->13532 13555 10459109 13554->13555 13559 104591d3 13554->13559 13606 10459012 13555->13606 13557 10459113 13558 10464f82 6 API calls 13557->13558 13557->13559 13558->13559 13559->13532 13561 10464fb8 13560->13561 13562 104615b2 socket 13561->13562 13564 10465081 13561->13564 13571 10465022 13561->13571 13562->13564 13563 10465134 13565 10461732 connect 13563->13565 13567 104651b2 13563->13567 13563->13571 13564->13563 13566 10465117 getaddrinfo 13564->13566 13564->13571 13565->13567 13566->13563 13568 104616b2 send 13567->13568 13567->13571 13570 10465729 13568->13570 13569 104657f4 setsockopt recv 13569->13571 13570->13569 13570->13571 13571->13536 13573 1046386d 13572->13573 13588 10464232 13573->13588 13575 10463888 13576 10463906 13575->13576 13577 10464f82 6 API calls 13575->13577 13578 104638c5 13575->13578 13576->13537 13577->13578 13578->13576 13579 10464232 NtCreateFile 13578->13579 13579->13576 13581 104639c2 13580->13581 13582 10464232 NtCreateFile 13581->13582 13584 104639d6 13582->13584 13583 10463a9f 13583->13543 13584->13583 13585 10463a5d 13584->13585 13587 10464f82 6 API calls 13584->13587 13585->13583 13586 10464232 NtCreateFile 13585->13586 13586->13583 13587->13585 13589 1046425c 13588->13589 13591 10464334 13588->13591 13590 10464410 NtCreateFile 13589->13590 13589->13591 13590->13591 13591->13575 13593 1045a420 13592->13593 13594 1045a0aa 13592->13594 13593->13551 13594->13593 13595 10464232 NtCreateFile 13594->13595 13596 1045a1f9 13595->13596 13597 10464232 NtCreateFile 13596->13597 13600 1045a3df 13596->13600 13598 1045a3c9 13597->13598 13599 10464232 NtCreateFile 13598->13599 13599->13600 13600->13551 13602 10459f70 13601->13602 13603 10459f84 13601->13603 13602->13548 13604 10464232 NtCreateFile 13603->13604 13605 1045a046 13604->13605 13605->13548 13608 10459031 13606->13608 13607 104590cd 13607->13557 13608->13607 13609 10464f82 6 API calls 13608->13609 13609->13607 13833 1045cedd 13835 1045cf06 13833->13835 13834 1045cfa4 13835->13834 13836 104598f2 NtProtectVirtualMemory 13835->13836 13837 1045cf9c 13836->13837 13838 10460382 ObtainUserAgentString 13837->13838 13838->13834 13783 10466a1f 13784 10466a25 13783->13784 13787 1045a5f2 13784->13787 13786 10466a3d 13788 1045a60e 13787->13788 13789 1045a5fb 13787->13789 13788->13786 13789->13788 13790 1045f662 6 API calls 13789->13790 13790->13788 13942 1045cdd9 13944 1045cdf0 13942->13944 13943 1045cecd 13944->13943 13945 10460382 ObtainUserAgentString 13944->13945 13945->13943 13839 104612e4 13840 1046136f 13839->13840 13841 10461305 13839->13841 13841->13840 13843 104610c2 13841->13843 13844 104611f0 13843->13844 13845 104610cb 13843->13845 13844->13840 13845->13844 13846 10464f82 6 API calls 13845->13846 13846->13844 13919 1045bb66 13920 1045bb6a 13919->13920 13921 1045bcb5 CreateMutexW 13920->13921 13922 1045bcce 13920->13922 13921->13922 13847 1045ece2 13849 1045edd9 13847->13849 13848 1045f022 13849->13848 13850 1045e352 NtCreateFile 13849->13850 13851 1045ef0d 13850->13851 13851->13848 13852 1045e792 NtCreateFile 13851->13852 13852->13851 13939 1046172e 13940 1046176a 13939->13940 13941 10461788 connect 13939->13941 13940->13941 13610 10465bac 13611 10465bb1 13610->13611 13644 10465bb6 13611->13644 13645 1045bb72 13611->13645 13613 10465c2c 13614 10465c85 13613->13614 13616 10465c54 13613->13616 13617 10465c69 13613->13617 13613->13644 13615 10463ab2 NtProtectVirtualMemory 13614->13615 13620 10465c8d 13615->13620 13621 10463ab2 NtProtectVirtualMemory 13616->13621 13618 10465c80 13617->13618 13619 10465c6e 13617->13619 13618->13614 13623 10465c97 13618->13623 13622 10463ab2 NtProtectVirtualMemory 13619->13622 13681 1045d102 13620->13681 13625 10465c5c 13621->13625 13626 10465c76 13622->13626 13627 10465c9c 13623->13627 13630 10465cbe 13623->13630 13667 1045cee2 13625->13667 13673 1045cfc2 13626->13673 13649 10463ab2 13627->13649 13631 10465cc7 13630->13631 13632 10465cd9 13630->13632 13630->13644 13633 10463ab2 NtProtectVirtualMemory 13631->13633 13637 10463ab2 NtProtectVirtualMemory 13632->13637 13632->13644 13636 10465ccf 13633->13636 13691 1045d2f2 13636->13691 13640 10465ce5 13637->13640 13709 1045d712 13640->13709 13646 1045bb93 13645->13646 13647 1045bcb5 CreateMutexW 13646->13647 13648 1045bcce 13646->13648 13647->13648 13648->13613 13650 10463adf 13649->13650 13658 10463ebc 13650->13658 13721 104598f2 13650->13721 13652 10463e5c 13653 104598f2 NtProtectVirtualMemory 13652->13653 13654 10463e7c 13653->13654 13655 104598f2 NtProtectVirtualMemory 13654->13655 13656 10463e9c 13655->13656 13657 104598f2 NtProtectVirtualMemory 13656->13657 13657->13658 13659 1045cde2 13658->13659 13660 1045cdf0 13659->13660 13662 1045cecd 13660->13662 13744 10460382 13660->13744 13663 10459412 13662->13663 13665 10459440 13663->13665 13664 10459473 13664->13644 13665->13664 13666 1045944d CreateThread 13665->13666 13666->13644 13669 1045cf06 13667->13669 13668 1045cfa4 13668->13644 13669->13668 13670 104598f2 NtProtectVirtualMemory 13669->13670 13671 1045cf9c 13670->13671 13672 10460382 ObtainUserAgentString 13671->13672 13672->13668 13676 1045d016 13673->13676 13674 1045d0f0 13674->13644 13675 1045d0e8 13677 10460382 ObtainUserAgentString 13675->13677 13676->13674 13678 104598f2 NtProtectVirtualMemory 13676->13678 13679 1045d0bb 13676->13679 13677->13674 13678->13679 13679->13675 13680 104598f2 NtProtectVirtualMemory 13679->13680 13680->13675 13683 1045d137 13681->13683 13682 1045d2d5 13682->13644 13683->13682 13684 104598f2 NtProtectVirtualMemory 13683->13684 13685 1045d28a 13684->13685 13686 104598f2 NtProtectVirtualMemory 13685->13686 13689 1045d2a9 13686->13689 13687 1045d2cd 13688 10460382 ObtainUserAgentString 13687->13688 13688->13682 13689->13687 13690 104598f2 NtProtectVirtualMemory 13689->13690 13690->13687 13693 1045d349 13691->13693 13692 1045d49f 13694 104598f2 NtProtectVirtualMemory 13692->13694 13698 1045d4c3 13692->13698 13693->13692 13695 104598f2 NtProtectVirtualMemory 13693->13695 13694->13698 13696 1045d480 13695->13696 13697 104598f2 NtProtectVirtualMemory 13696->13697 13697->13692 13699 104598f2 NtProtectVirtualMemory 13698->13699 13700 1045d597 13698->13700 13699->13700 13701 104598f2 NtProtectVirtualMemory 13700->13701 13702 1045d5bf 13700->13702 13701->13702 13706 104598f2 NtProtectVirtualMemory 13702->13706 13707 1045d6b9 13702->13707 13703 1045d6e1 13704 10460382 ObtainUserAgentString 13703->13704 13705 1045d6e9 13704->13705 13705->13644 13706->13707 13707->13703 13708 104598f2 NtProtectVirtualMemory 13707->13708 13708->13703 13710 1045d767 13709->13710 13711 104598f2 NtProtectVirtualMemory 13710->13711 13716 1045d903 13710->13716 13712 1045d8e3 13711->13712 13713 104598f2 NtProtectVirtualMemory 13712->13713 13713->13716 13714 1045d9b7 13715 10460382 ObtainUserAgentString 13714->13715 13717 1045d9bf 13715->13717 13718 104598f2 NtProtectVirtualMemory 13716->13718 13719 1045d992 13716->13719 13717->13644 13718->13719 13719->13714 13720 104598f2 NtProtectVirtualMemory 13719->13720 13720->13714 13722 10459987 13721->13722 13725 104599b2 13722->13725 13736 1045a622 13722->13736 13724 10459c0c 13724->13652 13725->13724 13726 10459ba2 13725->13726 13729 10459ac5 13725->13729 13727 10465e12 NtProtectVirtualMemory 13726->13727 13728 10459b5b 13727->13728 13728->13724 13731 10465e12 NtProtectVirtualMemory 13728->13731 13740 10465e12 13729->13740 13731->13724 13732 10459ae3 13732->13724 13733 10459b3d 13732->13733 13734 10465e12 NtProtectVirtualMemory 13732->13734 13735 10465e12 NtProtectVirtualMemory 13733->13735 13734->13733 13735->13728 13737 1045a67a 13736->13737 13738 1045a684 13737->13738 13739 10465e12 NtProtectVirtualMemory 13737->13739 13738->13725 13739->13737 13741 10465e45 NtProtectVirtualMemory 13740->13741 13742 10464942 13740->13742 13743 10465e70 13741->13743 13742->13741 13743->13732 13745 104603c7 13744->13745 13748 10460232 13745->13748 13747 10460438 13747->13662 13749 1046025e 13748->13749 13752 1045f8c2 13749->13752 13751 1046026b 13751->13747 13753 1045f934 13752->13753 13754 1045f9a6 13753->13754 13755 1045f995 ObtainUserAgentString 13753->13755 13754->13751 13755->13754 13791 1045a42e 13792 1045a45b 13791->13792 13800 1045a4c9 13791->13800 13793 10464232 NtCreateFile 13792->13793 13792->13800 13794 1045a496 13793->13794 13796 1045a082 NtCreateFile 13794->13796 13799 1045a4c5 13794->13799 13795 10464232 NtCreateFile 13795->13800 13797 1045a4b6 13796->13797 13798 10459f52 NtCreateFile 13797->13798 13797->13799 13798->13799 13799->13795 13799->13800 13801 1046022a 13802 1046025e 13801->13802 13803 1045f8c2 ObtainUserAgentString 13802->13803 13804 1046026b 13803->13804 13887 10466aa9 13888 10466aaf 13887->13888 13891 10461212 13888->13891 13890 10466ac7 13892 10461237 13891->13892 13893 1046121b 13891->13893 13892->13890 13893->13892 13894 104610c2 6 API calls 13893->13894 13894->13892 13853 1045d2f4 13854 1045d349 13853->13854 13855 1045d49f 13854->13855 13857 104598f2 NtProtectVirtualMemory 13854->13857 13856 104598f2 NtProtectVirtualMemory 13855->13856 13860 1045d4c3 13855->13860 13856->13860 13858 1045d480 13857->13858 13859 104598f2 NtProtectVirtualMemory 13858->13859 13859->13855 13861 104598f2 NtProtectVirtualMemory 13860->13861 13862 1045d597 13860->13862 13861->13862 13863 104598f2 NtProtectVirtualMemory 13862->13863 13864 1045d5bf 13862->13864 13863->13864 13865 1045d6b9 13864->13865 13869 104598f2 NtProtectVirtualMemory 13864->13869 13866 1045d6e1 13865->13866 13870 104598f2 NtProtectVirtualMemory 13865->13870 13867 10460382 ObtainUserAgentString 13866->13867 13868 1045d6e9 13867->13868 13869->13865 13870->13866 13499 10464232 13500 1046425c 13499->13500 13502 10464334 13499->13502 13501 10464410 NtCreateFile 13500->13501 13500->13502 13501->13502 13871 104590f1 13872 104591d3 13871->13872 13873 10459109 13871->13873 13874 10459012 6 API calls 13873->13874 13875 10459113 13874->13875 13875->13872 13876 10464f82 6 API calls 13875->13876 13876->13872 13946 1045a5f1 13947 1045a606 13946->13947 13948 1045a60e 13946->13948 13949 1045f662 6 API calls 13947->13949 13949->13948 13962 104669b3 13963 104669bd 13962->13963 13966 1045b6d2 13963->13966 13965 104669e0 13967 1045b704 13966->13967 13968 1045b6f7 13966->13968 13970 1045b6ff 13967->13970 13971 1045b72d 13967->13971 13973 1045b737 13967->13973 13969 104590f2 6 API calls 13968->13969 13969->13970 13970->13965 13975 104612c2 13971->13975 13973->13970 13974 10464f82 6 API calls 13973->13974 13974->13970 13976 104612df 13975->13976 13977 104612cb 13975->13977 13976->13970 13977->13976 13978 104610c2 6 API calls 13977->13978 13978->13976 13950 104669f1 13951 104669f7 13950->13951 13954 1045b852 13951->13954 13953 10466a0f 13955 1045b865 13954->13955 13956 1045b8e4 13954->13956 13955->13956 13958 1045b887 13955->13958 13960 1045b87e 13955->13960 13956->13953 13957 1046136f 13957->13953 13958->13956 13959 1045f662 6 API calls 13958->13959 13959->13956 13960->13957 13961 104610c2 6 API calls 13960->13961 13961->13957 13979 1045cfbf 13982 1045d016 13979->13982 13980 1045d0f0 13981 1045d0e8 13983 10460382 ObtainUserAgentString 13981->13983 13982->13980 13984 104598f2 NtProtectVirtualMemory 13982->13984 13985 1045d0bb 13982->13985 13983->13980 13984->13985 13985->13981 13986 104598f2 NtProtectVirtualMemory 13985->13986 13986->13981 13895 1045f8be 13896 1045f8c3 13895->13896 13897 1045f9a6 13896->13897 13898 1045f995 ObtainUserAgentString 13896->13898 13898->13897 13805 1046383a 13806 10463841 13805->13806 13807 10464f82 6 API calls 13806->13807 13809 104638c5 13807->13809 13808 10463906 13809->13808 13810 10464232 NtCreateFile 13809->13810 13810->13808 13927 10464f7a 13929 10464fb8 13927->13929 13928 10465022 13929->13928 13930 104615b2 socket 13929->13930 13932 10465081 13929->13932 13930->13932 13931 10465134 13931->13928 13933 10461732 connect 13931->13933 13936 104651b2 13931->13936 13932->13928 13932->13931 13934 10465117 getaddrinfo 13932->13934 13933->13936 13934->13931 13935 104616b2 send 13937 10465729 13935->13937 13936->13928 13936->13935 13937->13928 13938 104657f4 setsockopt recv 13937->13938 13938->13928 13877 1045d0fb 13879 1045d137 13877->13879 13878 1045d2d5 13879->13878 13880 104598f2 NtProtectVirtualMemory 13879->13880 13881 1045d28a 13880->13881 13882 104598f2 NtProtectVirtualMemory 13881->13882 13885 1045d2a9 13882->13885 13883 1045d2cd 13884 10460382 ObtainUserAgentString 13883->13884 13884->13878 13885->13883 13886 104598f2 NtProtectVirtualMemory 13885->13886 13886->13883 13899 104610b9 13900 104610ed 13899->13900 13902 104611f0 13899->13902 13901 10464f82 6 API calls 13900->13901 13900->13902 13901->13902

                                                              Executed Functions

                                                              Function 10464F82 Relevance: 23.6, APIs: 3, Strings: 10, Instructions: 815networkCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 0 10464f82-10464fb6 1 10464fd6-10464fd9 0->1 2 10464fb8-10464fbc 0->2 3 104658fe-1046590c 1->3 4 10464fdf-10464fed 1->4 2->1 5 10464fbe-10464fc2 2->5 6 104658f6-104658f7 4->6 7 10464ff3-10464ff7 4->7 5->1 8 10464fc4-10464fc8 5->8 6->3 9 10464fff-10465000 7->9 10 10464ff9-10464ffd 7->10 8->1 11 10464fca-10464fce 8->11 12 1046500a-10465010 9->12 10->9 10->12 11->1 13 10464fd0-10464fd4 11->13 14 10465012-10465020 12->14 15 1046503a-10465060 12->15 13->1 13->4 14->15 18 10465022-10465026 14->18 16 10465062-10465066 15->16 17 10465068-1046507c call 104615b2 15->17 16->17 19 104650a8-104650ab 16->19 22 10465081-104650a2 17->22 18->6 21 1046502c-10465035 18->21 23 10465144-10465150 19->23 24 104650b1-104650b8 19->24 21->6 22->19 26 104658ee-104658ef 22->26 25 10465156-10465165 23->25 23->26 27 104650e2-104650f5 24->27 28 104650ba-104650dc call 10464942 24->28 29 10465167-10465178 call 10461552 25->29 30 1046517f-1046518f 25->30 26->6 27->26 32 104650fb-10465101 27->32 28->27 29->30 34 104651e5-1046521b 30->34 35 10465191-104651ad call 10461732 30->35 32->26 37 10465107-10465109 32->37 40 1046522d-10465231 34->40 41 1046521d-1046522b 34->41 43 104651b2-104651da 35->43 37->26 42 1046510f-10465111 37->42 45 10465247-1046524b 40->45 46 10465233-10465245 40->46 44 1046527f-10465280 41->44 42->26 47 10465117-10465132 getaddrinfo 42->47 43->34 49 104651dc-104651e1 43->49 48 10465283-104652e0 call 10465d62 call 10462482 call 10461e72 call 10466002 44->48 50 10465261-10465265 45->50 51 1046524d-1046525f 45->51 46->44 47->23 52 10465134-1046513c 47->52 63 104652f4-10465354 call 10465d92 48->63 64 104652e2-104652e6 48->64 49->34 53 10465267-1046526b 50->53 54 1046526d-10465279 50->54 51->44 52->23 53->48 53->54 54->44 69 1046548c-104654b8 call 10465d62 call 10466262 63->69 70 1046535a-10465396 call 10465d62 call 10466262 call 10466002 63->70 64->63 66 104652e8-104652ef call 10462042 64->66 66->63 79 104654ba-104654d5 69->79 80 104654d9-10465590 call 10466262 * 3 call 10466002 * 2 call 10462482 69->80 85 104653bb-104653e9 call 10466262 * 2 70->85 86 10465398-104653b7 call 10466262 call 10466002 70->86 79->80 111 10465595-104655b9 call 10466262 80->111 101 10465415-1046541d 85->101 102 104653eb-10465410 call 10466002 call 10466262 85->102 86->85 105 10465442-10465448 101->105 106 1046541f-10465425 101->106 102->101 105->111 112 1046544e-10465456 105->112 109 10465467-10465487 call 10466262 106->109 110 10465427-1046543d 106->110 109->111 110->111 121 104655d1-104656ad call 10466262 * 7 call 10466002 call 10465d62 call 10466002 call 10461e72 call 10462042 111->121 122 104655bb-104655cc call 10466262 call 10466002 111->122 112->111 116 1046545c-1046545d 112->116 116->109 133 104656af-104656b3 121->133 122->133 135 104656b5-104656fa call 10461382 call 104617b2 133->135 136 104656ff-1046572d call 104616b2 133->136 158 104658e6-104658e7 135->158 143 1046572f-10465735 136->143 144 1046575d-10465761 136->144 143->144 147 10465737-1046574c 143->147 148 10465767-1046576b 144->148 149 1046590d-10465913 144->149 147->144 152 1046574e-10465754 147->152 155 10465771-10465773 148->155 156 104658aa-104658df call 104617b2 148->156 153 10465779-10465784 149->153 154 10465919-10465920 149->154 152->144 159 10465756 152->159 160 10465786-10465793 153->160 161 10465795-10465796 153->161 154->160 155->153 155->156 156->158 158->26 159->144 160->161 164 1046579c-104657a0 160->164 161->164 167 104657a2-104657af 164->167 168 104657b1-104657b2 164->168 167->168 170 104657b8-104657c4 167->170 168->170 172 104657c6-104657ef call 10465d92 call 10465d62 170->172 173 104657f4-10465861 setsockopt recv 170->173 172->173 177 104658a3-104658a4 173->177 178 10465863 173->178 177->156 178->177 181 10465865-1046586a 178->181 181->177 184 1046586c-10465872 181->184 184->177 186 10465874-104658a1 184->186 186->177 186->178
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: getaddrinforecvsetsockopt
                                                              • String ID: Co$&br=$&sql$&un=$: cl$GET $dat=$nnec$ose$tion
                                                              • API String ID: 1564272048-1117930895
                                                              • Opcode ID: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
                                                              • Instruction ID: 2beafa1bf273eefa2786932148728772248accfb698538f5edef6de5354249c1
                                                              • Opcode Fuzzy Hash: 5de8858bceb6b52e8c11e308410fa1d1098ae4878da76a5e8b5a3db0c78a0a43
                                                              • Instruction Fuzzy Hash: 2E529E30618A488FCB59EF68C4D47D9B7E1FB58304F50466ED49FC7246EE38A94ACB81
                                                              Function 10464232 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 642filenativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 303 10464232-10464256 304 1046425c-10464260 303->304 305 104648bd-104648cd 303->305 304->305 306 10464266-104642a0 304->306 307 104642a2-104642a6 306->307 308 104642bf 306->308 307->308 310 104642a8-104642ac 307->310 309 104642c6 308->309 311 104642cb-104642cf 309->311 312 104642b4-104642b8 310->312 313 104642ae-104642b2 310->313 315 104642d1-104642f7 call 10464942 311->315 316 104642f9-1046430b 311->316 312->311 314 104642ba-104642bd 312->314 313->309 314->311 315->316 320 10464378 315->320 316->320 321 1046430d-10464332 316->321 322 1046437a-104643a0 320->322 323 10464334-1046433b 321->323 324 104643a1-104643a8 321->324 327 10464366-10464370 323->327 328 1046433d-10464360 call 10464942 323->328 325 104643d5-104643dc 324->325 326 104643aa-104643d3 call 10464942 324->326 331 10464410-10464458 NtCreateFile call 10464172 325->331 332 104643de-1046440a call 10464942 325->332 326->320 326->325 327->320 329 10464372-10464373 327->329 328->327 329->320 339 1046445d-1046445f 331->339 332->320 332->331 339->320 340 10464465-1046446d 339->340 340->320 341 10464473-10464476 340->341 342 10464486-1046448d 341->342 343 10464478-10464481 341->343 344 104644c2-104644ec 342->344 345 1046448f-104644b8 call 10464942 342->345 343->322 351 104644f2-104644f5 344->351 352 104648ae-104648b8 344->352 345->320 350 104644be-104644bf 345->350 350->344 353 10464604-10464611 351->353 354 104644fb-104644fe 351->354 352->320 353->322 356 10464500-10464507 354->356 357 1046455e-10464561 354->357 361 10464538-10464559 356->361 362 10464509-10464532 call 10464942 356->362 358 10464616-10464619 357->358 359 10464567-10464572 357->359 364 1046461f-10464626 358->364 365 104646b8-104646bb 358->365 367 10464574-1046459d call 10464942 359->367 368 104645a3-104645a6 359->368 366 104645e9-104645fa 361->366 362->320 362->361 370 10464657-1046466b call 10465e92 364->370 371 10464628-10464651 call 10464942 364->371 374 104646bd-104646c4 365->374 375 10464739-1046473c 365->375 366->353 367->320 367->368 368->320 373 104645ac-104645b6 368->373 370->320 392 10464671-104646b3 370->392 371->320 371->370 373->320 381 104645bc-104645e6 373->381 382 104646c6-104646ef call 10464942 374->382 383 104646f5-10464734 374->383 378 104647c4-104647c7 375->378 379 10464742-10464749 375->379 378->320 389 104647cd-104647d4 378->389 387 1046477a-104647bf 379->387 388 1046474b-10464774 call 10464942 379->388 381->366 382->352 382->383 399 10464894-104648a9 383->399 387->399 388->352 388->387 394 104647d6-104647f6 call 10464942 389->394 395 104647fc-10464803 389->395 392->322 394->395 397 10464805-10464825 call 10464942 395->397 398 1046482b-10464835 395->398 397->398 398->352 404 10464837-1046483e 398->404 399->322 404->352 407 10464840-10464886 404->407 407->399
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: CreateFile
                                                              • String ID: `
                                                              • API String ID: 823142352-2679148245
                                                              • Opcode ID: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
                                                              • Instruction ID: af61ece6f03135b5c7eae35035883f28e5589d088c66d537352ef267f52dc426
                                                              • Opcode Fuzzy Hash: de128a41b66c8ec8222e6cdebfc92e8119e2b93de7d93fbb6a18759800a4d987
                                                              • Instruction Fuzzy Hash: 07225E70B18A499FCB49DF28C4956AAF7E2FB98305F41022EE45ED3250EF34E851CB85
                                                              Function 10465E12 Relevance: 1.6, APIs: 1, Instructions: 59nativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 447 10465e12-10465e38 448 10465e45-10465e6e NtProtectVirtualMemory 447->448 449 10465e40 call 10464942 447->449 450 10465e70-10465e7c 448->450 451 10465e7d-10465e8f 448->451 449->448
                                                              APIs
                                                              • NtProtectVirtualMemory.NTDLL ref: 10465E67
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: MemoryProtectVirtual
                                                              • String ID:
                                                              • API String ID: 2706961497-0
                                                              • Opcode ID: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
                                                              • Instruction ID: a465b0bf49d5ead59542292f2a7bcc41c059a714f347e31f3842414297543bb2
                                                              • Opcode Fuzzy Hash: 8fde5b3aa229c20c01e10f6c0a0911328a1d50ad6ca7dd15efa95d0be41baddf
                                                              • Instruction Fuzzy Hash: 8A019E34668B884F8B88EF6CD48112AB7E4FBD9314F000B3EE99AC3250EB74C5418782
                                                              Function 10465E0A Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 452 10465e0a-10465e6e call 10464942 NtProtectVirtualMemory 455 10465e70-10465e7c 452->455 456 10465e7d-10465e8f 452->456
                                                              APIs
                                                              • NtProtectVirtualMemory.NTDLL ref: 10465E67
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: MemoryProtectVirtual
                                                              • String ID:
                                                              • API String ID: 2706961497-0
                                                              • Opcode ID: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
                                                              • Instruction ID: cfdf653917c012866b7e43459d6eaba7c83107bb56a50e4f9a5776b4b250ab8b
                                                              • Opcode Fuzzy Hash: d782dca5996f3574fd0c4455d89641a9bf745bba617b6185d934ac73d2235392
                                                              • Instruction Fuzzy Hash: 9F01A774628B884B8B44DB3C94411A6B3E5FBCE314F000B3EE59AC3240EB35D5014782
                                                              Function 1045F8C2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • ObtainUserAgentString.URLMON ref: 1045F9A0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: AgentObtainStringUser
                                                              • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                              • API String ID: 2681117516-319646191
                                                              • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                              • Instruction ID: 4e1a3087dace1e8b660d331277dfbac6e574ebe59b549104d836f530a1a4c26f
                                                              • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                              • Instruction Fuzzy Hash: E031B171614A4C8BCB44EFA8C8857EEB7E1FB58218F40422EE45ED7240EE789649C789
                                                              Function 1045F8BE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • ObtainUserAgentString.URLMON ref: 1045F9A0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: AgentObtainStringUser
                                                              • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                              • API String ID: 2681117516-319646191
                                                              • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                              • Instruction ID: 337220b85dcbe08004f8ef42d7f61adb7452393c139c3ca3e64b0becd568473e
                                                              • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                              • Instruction Fuzzy Hash: D221B471614A4C9FCB45EFA8C8857EDBBE1FF58208F40422EE45AD7240EF789649C789
                                                              Function 1045BB66 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148synchronizationCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 232 1045bb66-1045bb68 233 1045bb93-1045bbb8 232->233 234 1045bb6a-1045bb6b 232->234 237 1045bbbb-1045bbbc 233->237 235 1045bb6d-1045bb71 234->235 236 1045bbbe-1045bc22 call 10462612 call 10464942 * 2 234->236 235->237 238 1045bb73-1045bb92 235->238 246 1045bcdc 236->246 247 1045bc28-1045bc2b 236->247 237->236 238->233 249 1045bcde-1045bcf6 246->249 247->246 248 1045bc31-1045bcd3 call 10466da4 call 10466022 call 104663e2 call 10466022 call 104663e2 CreateMutexW 247->248 248->246 263 1045bcd5-1045bcda 248->263 263->249
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: CreateMutex
                                                              • String ID: .dll$el32$kern
                                                              • API String ID: 1964310414-1222553051
                                                              • Opcode ID: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
                                                              • Instruction ID: f21d89e28d161b26d8b6a601a1c56b3aeb9498665f726ad549aae1d6a76d0734
                                                              • Opcode Fuzzy Hash: 440592a6460f4a8a809c4e0f2019460d4d12f006c7151b444d4376acf3ab05fa
                                                              • Instruction Fuzzy Hash: 90416B74918A088FDB84EFA8C8D97ED77E0FF58304F00417AD84ADB259EE34A945CB85
                                                              Function 1045BB72 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138synchronizationCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: CreateMutex
                                                              • String ID: .dll$el32$kern
                                                              • API String ID: 1964310414-1222553051
                                                              • Opcode ID: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
                                                              • Instruction ID: 4e0b612079b428180e8fc0f2a1c88a38a5f2b5bc300031689915e74bb6299a55
                                                              • Opcode Fuzzy Hash: d29081eafe973aeb990ac80f5dcafeb95ade16b14a0ff6f6c0f9231c9beedf12
                                                              • Instruction Fuzzy Hash: A5413974918A088FDB84EFA8C4D9BED77E1FFA8304F00417AD84ADB255EE349945CB85
                                                              Function 1046172E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52networkCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 293 1046172e-10461768 294 1046176a-10461782 call 10464942 293->294 295 10461788-104617ab connect 293->295 294->295
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: connect
                                                              • String ID: conn$ect
                                                              • API String ID: 1959786783-716201944
                                                              • Opcode ID: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
                                                              • Instruction ID: da9337d14bbfa0c401fdb0066d366b4a43329e75d5b222d26ff33538e6913aea
                                                              • Opcode Fuzzy Hash: d2c20d592f91275318b70c66aa45ff63ae11574d98dcf1710f59c05c574d9bfb
                                                              • Instruction Fuzzy Hash: CB015E70618B188FCB84EF1CE088B55B7E0FB58314F1545AEE90DCB226CA74D8818BC2
                                                              Function 10461732 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51networkCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 298 10461732-10461768 299 1046176a-10461782 call 10464942 298->299 300 10461788-104617ab connect 298->300 299->300
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: connect
                                                              • String ID: conn$ect
                                                              • API String ID: 1959786783-716201944
                                                              • Opcode ID: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
                                                              • Instruction ID: b8311961fac778e54e083db540f584fd0bc99fd4e66b1af0a8c570836b8f6f0a
                                                              • Opcode Fuzzy Hash: 640b8c0ab7b1bb3acdb51d34daf9cec4a3878eee67c7b90e610521ed962b484b
                                                              • Instruction Fuzzy Hash: 4F012C70618A1C8FCB84EF5CE088B55B7E0FB59315F1541AEA90DCB226DA74C9818BC2
                                                              Function 104616B2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53networkCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 411 104616b2-104616e5 412 104616e7-104616ff call 10464942 411->412 413 10461705-1046172d send 411->413 412->413
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: send
                                                              • String ID: send
                                                              • API String ID: 2809346765-2809346765
                                                              • Opcode ID: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
                                                              • Instruction ID: 62c2dca3f53bf42bc4d0683ee50cd4aa3932b634957ad046aa6392fa38f13eeb
                                                              • Opcode Fuzzy Hash: bba6785c5ab04fc1c912927f20b2eaf94db183ef6292e2548e0bd7e75e2cf9a2
                                                              • Instruction Fuzzy Hash: 96015270518A088FCB84DF1CE088B1577E0EB58315F1641AED85DCB266DA70D8818B81
                                                              Function 104615B2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49networkCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 416 104615b2-104615ea 417 104615ec-10461604 call 10464942 416->417 418 1046160a-1046162b socket 416->418 417->418
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: socket
                                                              • String ID: sock
                                                              • API String ID: 98920635-2415254727
                                                              • Opcode ID: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
                                                              • Instruction ID: feaf79a000ecf3009d441cd71ae1966c300daceae00ef9a19f185355b43d5c23
                                                              • Opcode Fuzzy Hash: 205056058728d72a76f2a9c444eb1655fc63b7523a02cb36171bec795444162f
                                                              • Instruction Fuzzy Hash: 2A0171706186188FCB84DF1CD048B50BBE0FB59354F1545ADE40ECB236D7B4C9818B82
                                                              Function 104592DD Relevance: 1.6, APIs: 1, Instructions: 91COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 421 104592dd-10459320 call 10464942 424 10459326 421->424 425 104593fa-1045940e 421->425 426 10459328-10459339 SleepEx 424->426 426->426 427 1045933b-10459341 426->427 428 10459343-10459349 427->428 429 1045934b-10459352 427->429 428->429 430 1045935c-1045936a call 10463f12 428->430 431 10459354-1045935a 429->431 432 10459370-10459376 429->432 430->432 431->430 431->432 434 104593b7-104593bd 432->434 435 10459378-1045937e 432->435 438 104593d4-104593db 434->438 439 104593bf-104593cf call 10459e72 434->439 435->434 437 10459380-1045938a 435->437 437->434 440 1045938c-104593b1 call 1045a432 437->440 438->426 442 104593e1-104593f5 call 104590f2 438->442 439->438 440->434 442->426
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: Sleep
                                                              • String ID:
                                                              • API String ID: 3472027048-0
                                                              • Opcode ID: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
                                                              • Instruction ID: 7c9a590e1d6dda9dcf2c79a40786f6a0e3ea1eee9e0a778f1bae9db13f40f5a4
                                                              • Opcode Fuzzy Hash: 2c485226c71f8ce073f7c86c27236fb263c26e76649b5794a31fce9b42c1bba6
                                                              • Instruction Fuzzy Hash: BE318B78604B49DFCB98DF2980882D9B7A1FB5A304F44427ECD1DCA246CB38A958CF91
                                                              Function 10459412 Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 457 10459412-10459446 call 10464942 460 10459473-1045947d 457->460 461 10459448-10459472 call 10466c9e CreateThread 457->461
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4556728675.0000000010450000.00000040.80000000.00040000.00000000.sdmp, Offset: 10450000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_10450000_explorer.jbxd
                                                              Similarity
                                                              • API ID: CreateThread
                                                              • String ID:
                                                              • API String ID: 2422867632-0
                                                              • Opcode ID: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
                                                              • Instruction ID: f2d0aa3e12496e4c42cce948a45429228b99cc4cf6a0f8473dda3a0ea5485e49
                                                              • Opcode Fuzzy Hash: 86dfbf082f461ee8d50c48ad175151c38d579804c722c71aa6313b9ca1572f48
                                                              • Instruction Fuzzy Hash: 4FF0C234268A484FDB88EF2CD48562AB3D0FBED214F41063EA58DC3264DA39D9824716

                                                              Non-executed Functions

                                                              Function 0971ED02 Relevance: 14.2, Strings: 11, Instructions: 404COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: .dll$32.d$M$S$dll$el32$kern$ll$net.$user$wini
                                                              • API String ID: 0-393284711
                                                              • Opcode ID: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                              • Instruction ID: b04dbfe89de8823ebe08a6590d0624496bcf4a4a2af1b75bc3f2ee145d3bf276
                                                              • Opcode Fuzzy Hash: 666e7131670ab6034242d7bb31114c5afc39a2cef586e73e73495a4832ac64d3
                                                              • Instruction Fuzzy Hash: C1E15A71628F588FC768EF68C4987ABB7E0FB58300F509A2E959FC7251DF30A5418B85
                                                              Function 09721792 Relevance: 21.6, Strings: 17, Instructions: 321COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Fiel$Subm$d$dPas$dUse$e$encr$encr$form$guid$itUR$name$rnam$swor$user$ypte$ypte
                                                              • API String ID: 0-2916316912
                                                              • Opcode ID: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                              • Instruction ID: 3d41de031364a50c784f8ebad7f75df7372b50516695b9ca0006aa38721f10d8
                                                              • Opcode Fuzzy Hash: 1a4675aa69093f914decc08927043d33ef050167d1a45f8fb32d144d534e0ced
                                                              • Instruction Fuzzy Hash: D8B18B31528B488FDB69EF68C489AEEB7F1FF98300F50951ED49AC7251EF7094058B86
                                                              Function 0971F622 Relevance: 21.4, Strings: 17, Instructions: 151COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: 2$c$d$d$d$e$i$l$l$l$n$n$p$s$t$u$w
                                                              • API String ID: 0-1539916866
                                                              • Opcode ID: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                              • Instruction ID: 44f1057e83bf923399c7d26ee17b6b33e84d523665d36e90fcd82625bfe854a8
                                                              • Opcode Fuzzy Hash: e72b72cb0cc01a4fb435a8ab5948bc97e669459bbd1002971cdc116c820d8f81
                                                              • Instruction Fuzzy Hash: 3841BD71A18B08CFDB14DF8CA4497AE7BE2FB88700F40425EE809D3245DBB59D458BD6
                                                              Function 09726AB2 Relevance: 17.8, Strings: 14, Instructions: 339COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: D$[$[$[$[$[$]$]$b$c$e$l$l$n
                                                              • API String ID: 0-355182820
                                                              • Opcode ID: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                              • Instruction ID: 67ea0d0187e3cf3c82ff234576c0a5723628b361ad4af4247c32ff7605708ac4
                                                              • Opcode Fuzzy Hash: 5b00ea5ff0ac38f91c5f3451741050e74e6bfffb06a4f81f7af14d2d93e98743
                                                              • Instruction Fuzzy Hash: FAC15A71628B188FC758EF28C499BDAF3E5FB98304F40962E959EC7210DF30A515CB86
                                                              Function 09726F12 Relevance: 15.2, Strings: 12, Instructions: 201COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: .$0$c$n$r$r$r$r$r$r$r$r
                                                              • API String ID: 0-97273177
                                                              • Opcode ID: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                              • Instruction ID: 6f74e5ece1bb41c841b8daa59e8982ad8eb7ee5b63c7a74c9178780088ab271c
                                                              • Opcode Fuzzy Hash: c99d8b63ad26ee68af9772b0c2f17264c0bbc41cf5067afa0da8e01a5053a168
                                                              • Instruction Fuzzy Hash: A451B2315287488FD71DDF18D4857AAB7E5FBC5700F505A2EE8CBC7241DBB4A50A8B82
                                                              Function 097202F2 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                              • API String ID: 0-639201278
                                                              • Opcode ID: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                              • Instruction ID: fdc8cc552b0b5057a9a2dcfe077da77f385768815afe1532931a870240a379b7
                                                              • Opcode Fuzzy Hash: f43930ec246ad51b32166c0bc4bf79f326171222225a5f9c9c86c27c8781e096
                                                              • Instruction Fuzzy Hash: 6CC19272628A298FC758EF68D499BAAB3E1FF94300F559329944ED7250DF30E601CBC5
                                                              Function 097202F4 Relevance: 10.4, Strings: 8, Instructions: 380COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: 4.dl$cli.$dll$dragon_s.dll$l$nspr$opera_browser.dll$sspi
                                                              • API String ID: 0-639201278
                                                              • Opcode ID: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                              • Instruction ID: 96562fb2ca5d6ffebc97ec0e5c54923939beff8a95d4c5b3cb4208bb0f1e9226
                                                              • Opcode Fuzzy Hash: 3bb0ec29e48dc84c2f9ecdcc79ab9852c4e3249089256f700559b0558053754d
                                                              • Instruction Fuzzy Hash: 78C19372628A298FC758EF68D499BAAB3E1FF94300F559329944ED7250DF30E601C7C5
                                                              Function 09721CD4 Relevance: 9.0, Strings: 7, Instructions: 299COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: UR$2$L: $Pass$User$name$word
                                                              • API String ID: 0-2058692283
                                                              • Opcode ID: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                              • Instruction ID: d64e85a86cde4db9b258b748e7b92f8d8c5cc9a96526d37e9d1c42149d8df786
                                                              • Opcode Fuzzy Hash: 192ee3367620c7562f2382bb65b9fc05a299a96abcb0fffb8f15ec5ae1331477
                                                              • Instruction Fuzzy Hash: 79A1DF316287588FDB28EFA894447EEB7E1FF88300F40962DE48AD7291EF709545C789
                                                              Function 09721CE2 Relevance: 9.0, Strings: 7, Instructions: 288COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: UR$2$L: $Pass$User$name$word
                                                              • API String ID: 0-2058692283
                                                              • Opcode ID: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                              • Instruction ID: d1c25b875ce2c7105ad9414546d5dbf5b4d82f35512997cf419ec009a5630968
                                                              • Opcode Fuzzy Hash: 811dc63e753d913bd80861ecf29671c0ec5da9e3b6d1a04c89c314a6a3ecac4a
                                                              • Instruction Fuzzy Hash: 8C91BF31A287588FDB28EFA8D4447EEB7E1FF88300F40962EE48AD7241EB709545C785
                                                              Function 09721352 Relevance: 6.5, Strings: 5, Instructions: 242COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: $.$e$n$v
                                                              • API String ID: 0-1849617553
                                                              • Opcode ID: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                                              • Instruction ID: b7aa45fbb56793a010d7aaa653390cd4245f9b8540775c80a39faa5d015ce746
                                                              • Opcode Fuzzy Hash: 88e172b8451cd2a9b002e6988e8bcb77ce4cb4dc6623ca34b6f08ddcd3f94e84
                                                              • Instruction Fuzzy Hash: EA719331628B598FD758EF68C4887AAB7F1FF58304F00562EE44AC7261EB71D9458B81
                                                              Function 0971CC32 Relevance: 6.4, Strings: 5, Instructions: 175COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: 2.dl$dll$l32.$ole3$shel
                                                              • API String ID: 0-1970020201
                                                              • Opcode ID: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                              • Instruction ID: 752a486e5516468bc1488a596004f78be9f0a4643f8f46a7f6cfadad06053ec5
                                                              • Opcode Fuzzy Hash: b134dbd9f6717a83955f5285ab3b339b989e1d50f8699707141bdd3daa24f32e
                                                              • Instruction Fuzzy Hash: 00514BB1918B4C8FDB64EFA4C045BEAB7F1FF58300F40562EA59AE7214EF3095458B89
                                                              Function 0971D86F Relevance: 6.4, Strings: 5, Instructions: 157COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: 4$\$dll$ion.$vers
                                                              • API String ID: 0-1610437797
                                                              • Opcode ID: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                              • Instruction ID: 31824ce6c62f0bb63badf4b734b16fb0895232101db6993012d0b3a9a21372d4
                                                              • Opcode Fuzzy Hash: 946c6b85a27e95b541945c97fc8955ce25e9cbbf861c78f5b4a7a89501b4aa4c
                                                              • Instruction Fuzzy Hash: EA416231628B488BCB75EF2898457EB73E4FB98301F50562E988EC7240EF30D5458B82
                                                              Function 0971F4B2 Relevance: 6.4, Strings: 5, Instructions: 149COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: 32.d$cli.$dll$sspi$user
                                                              • API String ID: 0-327345718
                                                              • Opcode ID: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                              • Instruction ID: 3bf7c0516fcb9c8d6059eae94e2744bdb8df4fa7c9555d174a9df42c606b716a
                                                              • Opcode Fuzzy Hash: 4331b437e8e8c33b9d3042ca7a101e9875946b76dc224aa53cf86a4375d9541a
                                                              • Instruction Fuzzy Hash: 94417E32A18E0D8FCB98EF68C4987AD77E1FB58300F54456AE80ED7210DB71D5818BC6
                                                              Function 0971D432 Relevance: 5.1, Strings: 4, Instructions: 143COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: .dll$el32$h$kern
                                                              • API String ID: 0-4264704552
                                                              • Opcode ID: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                              • Instruction ID: 86f49eabf621a0e5cf4379885484216c444fdc8dd5547abbfa0de663e4e318f6
                                                              • Opcode Fuzzy Hash: 9359c1e703a927bbfeba22f12881d3372b40fdd04c475320464a891c53438f4c
                                                              • Instruction Fuzzy Hash: 92418271608B488FD7A9DF2C80883AABBE1FB98304F144A2FA49EC3255DB70D545CB81
                                                              Function 097240B9 Relevance: 5.1, Strings: 4, Instructions: 110COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: $Snif$f fr$om:
                                                              • API String ID: 0-3434893486
                                                              • Opcode ID: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                              • Instruction ID: bf06f47f0d2d3520900a378610ba6fcef2b579fd0d69ad3be199d48641310ec5
                                                              • Opcode Fuzzy Hash: 09bcdfac33ec1e4ec0111ee2ca4a837fb2c377919df94419edd54a6c0362b305
                                                              • Instruction Fuzzy Hash: C731B47252CB485FD71AEB28D4887DAB7D4FB94300F50891EE49BC7251EE31A54ACB43
                                                              Function 097240C2 Relevance: 5.1, Strings: 4, Instructions: 109COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: $Snif$f fr$om:
                                                              • API String ID: 0-3434893486
                                                              • Opcode ID: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                              • Instruction ID: 6bb3967c718a10db2895e5f342175e288fcbed684497585e26be5391b95512c4
                                                              • Opcode Fuzzy Hash: 3ff11923ba7cb27a5852b7160a0339692380a5748f6322a3f9139bc862c068a3
                                                              • Instruction Fuzzy Hash: 5031A47252CB586FD719DF28D4887EAB7D4FB94300F50891EE49BC7251EE30A54ACA43
                                                              Function 0971FFC2 Relevance: 5.1, Strings: 4, Instructions: 106COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: .dll$chro$hild$me_c
                                                              • API String ID: 0-3136806129
                                                              • Opcode ID: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                              • Instruction ID: e63d803eb5cf022840aa05da2d408c317d38c05fbbf62b76a6ef9a7c6cf9c1fb
                                                              • Opcode Fuzzy Hash: b79a347c44b7e53efbef1ad5a08501038d02bf17702d136fbf8a30590be9006b
                                                              • Instruction Fuzzy Hash: 62318132228B584FC794EF688498BAAB7E1FF98300F84963DA84ECB214DF30C545C752
                                                              Function 0971FFBF Relevance: 5.1, Strings: 4, Instructions: 105COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: .dll$chro$hild$me_c
                                                              • API String ID: 0-3136806129
                                                              • Opcode ID: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                              • Instruction ID: 53d8f5972a1a61cd624544142c641b3d23f8c5da764e06360168ec7a99aa31d2
                                                              • Opcode Fuzzy Hash: 451ecfdc7a6dd194cc49c0618832622829ee31958d951160e0d103bd60c3dca9
                                                              • Instruction Fuzzy Hash: B931A232228B184FC794EF688498BAAB7E1FF98300F84963DA44ECB254DF30C545C752
                                                              Function 097228C2 Relevance: 5.1, Strings: 4, Instructions: 100COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                              • API String ID: 0-319646191
                                                              • Opcode ID: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                              • Instruction ID: 6f19bf6614ab50005717a7d457d10e52b02d87cd635de2d9eaf900aa0407d2b8
                                                              • Opcode Fuzzy Hash: fab8d4f3d63e7cb3a61fc22749300fb1f1c56e9464b264e147718cbb7a7b3fb5
                                                              • Instruction Fuzzy Hash: 5E31E332624A1D8FCB54EFA8C8887EEB7E0FF58204F40522AE45ED7240DF748645C789
                                                              Function 097228BE Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: User-Agent: $nt: $on.d$urlmon.dll
                                                              • API String ID: 0-319646191
                                                              • Opcode ID: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                              • Instruction ID: 4b323e2662dcfe4ac564cc73814fc758c90fbc5aea091a06858c13fd6e4f3dff
                                                              • Opcode Fuzzy Hash: 89ed80dc1d123a3fdb33b1283e784163d7980008e053a39b7e2b7c015d122c3c
                                                              • Instruction Fuzzy Hash: FE21E631624A2D8FCF54EFA8C8587ED7BE0FF58204F40522AE45AD7240DF748605C785
                                                              Function 09723E92 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: .$l$l$t
                                                              • API String ID: 0-168566397
                                                              • Opcode ID: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                              • Instruction ID: 7f7dbcda77e755890c065fd9baa6cb9035710bc854c198588cdeb74b85a04676
                                                              • Opcode Fuzzy Hash: bb135833945c650cdd1fe89d13a3bf36b2a9c2ee8a1cabd4608026fce5a35201
                                                              • Instruction Fuzzy Hash: B2217A71A24B1E9BDB48EFA8C0487AEBAF0FB18300F50962ED149D3600DB789591CB84
                                                              Function 09723E94 Relevance: 5.1, Strings: 4, Instructions: 87COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: .$l$l$t
                                                              • API String ID: 0-168566397
                                                              • Opcode ID: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                              • Instruction ID: 8e8bf8f82fcb1aae5a43d8103ce11d49f46b5e8a578afba06a71f221843b225e
                                                              • Opcode Fuzzy Hash: 4d2417001e92a941b72e22f5172d980f9cfaeeee068a4ce0a3e94531502ff258
                                                              • Instruction Fuzzy Hash: 6F218B71A24B1D9BDB08EFA8C0487EEBBF0FB18300F50962ED149D3600DB789591CB84
                                                              Function 09723FF2 Relevance: 5.1, Strings: 4, Instructions: 77COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.4545430320.0000000009700000.00000040.00000001.00040000.00000000.sdmp, Offset: 09700000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_9700000_explorer.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: auth$logi$pass$user
                                                              • API String ID: 0-2393853802
                                                              • Opcode ID: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                              • Instruction ID: 7d0940a11c70dd4347dda4c2a71827628f004d7709760a7205f102795ff60e06
                                                              • Opcode Fuzzy Hash: b1bb37e765f9f4b099c2fa6e409a2bcd00c7a79030895f352d0fc3307f2d087a
                                                              • Instruction Fuzzy Hash: 7721CD32724B0D8BCB05DF9998817EEB7F1EF88344F049619E40AEB254D7B0D9548BD2

                                                              Execution Graph

                                                              Execution Coverage:1.4%
                                                              Dynamic/Decrypted Code Coverage:0%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:619
                                                              Total number of Limit Nodes:74
                                                              execution_graph 124292 2e49080 124303 2e4bd40 124292->124303 124294 2e4919c 124295 2e490bb 124295->124294 124306 2e3acf0 124295->124306 124299 2e49120 Sleep 124300 2e4910d 124299->124300 124300->124294 124300->124299 124315 2e48ca0 LdrLoadDll 124300->124315 124316 2e48eb0 LdrLoadDll 124300->124316 124317 2e4a540 124303->124317 124307 2e3ad14 124306->124307 124308 2e3ad50 LdrLoadDll 124307->124308 124309 2e3ad1b 124307->124309 124308->124309 124310 2e44e50 124309->124310 124311 2e44e6a 124310->124311 124312 2e44e5e 124310->124312 124311->124300 124312->124311 124324 2e452d0 LdrLoadDll 124312->124324 124314 2e44fbc 124314->124300 124315->124300 124316->124300 124320 2e4af60 124317->124320 124319 2e4a55c 124319->124295 124321 2e4af70 124320->124321 124322 2e4af92 124320->124322 124323 2e44e50 LdrLoadDll 124321->124323 124322->124319 124323->124322 124324->124314 124325 362cb84 124328 362a042 124325->124328 124327 362cba5 124329 362a06b 124328->124329 124330 362a182 NtQueryInformationProcess 124329->124330 124345 362a56c 124329->124345 124332 362a1ba 124330->124332 124331 362a1ef 124331->124327 124332->124331 124333 362a290 124332->124333 124334 362a2db 124332->124334 124357 3629de2 NtCreateSection NtMapViewOfSection NtClose 124333->124357 124335 362a2fc NtSuspendThread 124334->124335 124336 362a331 124335->124336 124337 362a30d 124335->124337 124341 362a412 124336->124341 124348 3629bb2 124336->124348 124337->124327 124339 362a2cf 124339->124327 124342 362a531 124341->124342 124344 362a4a6 NtSetContextThread 124341->124344 124343 362a552 NtResumeThread 124342->124343 124343->124345 124347 362a4bd 124344->124347 124345->124327 124346 362a51c RtlQueueApcWow64Thread 124346->124342 124347->124342 124347->124346 124349 3629bf7 124348->124349 124350 3629c66 NtCreateSection 124349->124350 124351 3629ca0 124350->124351 124354 3629d4e 124350->124354 124352 3629cc1 NtMapViewOfSection 124351->124352 124353 3629d0c 124352->124353 124352->124354 124353->124354 124355 3629d88 124353->124355 124354->124341 124356 3629dc5 NtClose 124355->124356 124356->124341 124357->124339 124358 2e4f13d 124361 2e4b9d0 124358->124361 124362 2e4b9f6 124361->124362 124369 2e39d40 124362->124369 124364 2e4ba02 124367 2e4ba26 124364->124367 124377 2e38f30 124364->124377 124415 2e4a6b0 124367->124415 124418 2e39c90 124369->124418 124371 2e39d4d 124372 2e39d54 124371->124372 124430 2e39c30 124371->124430 124372->124364 124378 2e38f57 124377->124378 124828 2e3b1c0 124378->124828 124380 2e38f69 124832 2e3af10 124380->124832 124382 2e38f86 124388 2e38f8d 124382->124388 124903 2e3ae40 LdrLoadDll 124382->124903 124385 2e38ffc 124848 2e3f410 124385->124848 124387 2e39006 124389 2e4bf90 2 API calls 124387->124389 124411 2e390f2 124387->124411 124388->124411 124836 2e3f380 124388->124836 124390 2e3902a 124389->124390 124391 2e4bf90 2 API calls 124390->124391 124392 2e3903b 124391->124392 124393 2e4bf90 2 API calls 124392->124393 124394 2e3904c 124393->124394 124860 2e3ca90 124394->124860 124396 2e39059 124397 2e44a50 8 API calls 124396->124397 124398 2e39066 124397->124398 124399 2e44a50 8 API calls 124398->124399 124400 2e39077 124399->124400 124401 2e390a5 124400->124401 124402 2e39084 124400->124402 124403 2e44a50 8 API calls 124401->124403 124870 2e3d620 124402->124870 124407 2e390c1 124403->124407 124414 2e390e9 124407->124414 124904 2e3d6c0 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 124407->124904 124408 2e39092 124886 2e38d00 124408->124886 124409 2e38d00 21 API calls 124409->124411 124411->124367 124414->124409 124416 2e4af60 LdrLoadDll 124415->124416 124417 2e4a6cf 124416->124417 124419 2e39ca3 124418->124419 124469 2e48bc0 LdrLoadDll 124418->124469 124449 2e48a70 124419->124449 124422 2e39cb6 124422->124371 124423 2e39cac 124423->124422 124452 2e4b2b0 124423->124452 124425 2e39cf3 124425->124422 124463 2e39ab0 124425->124463 124427 2e39d13 124470 2e39620 LdrLoadDll 124427->124470 124429 2e39d25 124429->124371 124431 2e39c4a 124430->124431 124432 2e4b5a0 LdrLoadDll 124430->124432 124807 2e4b5a0 124431->124807 124432->124431 124435 2e4b5a0 LdrLoadDll 124436 2e39c71 124435->124436 124437 2e3f180 124436->124437 124438 2e3f199 124437->124438 124811 2e3b040 124438->124811 124440 2e3f1ac 124815 2e4a1e0 124440->124815 124444 2e3f1d2 124445 2e3f1fd 124444->124445 124821 2e4a260 124444->124821 124446 2e4a490 2 API calls 124445->124446 124448 2e39d65 124446->124448 124448->124364 124471 2e4a600 124449->124471 124453 2e4b2c9 124452->124453 124475 2e44a50 124453->124475 124455 2e4b2e1 124456 2e4b2ea 124455->124456 124514 2e4b0f0 124455->124514 124456->124425 124458 2e4b2fe 124458->124456 124532 2e49f00 124458->124532 124785 2e37ea0 124463->124785 124465 2e39ad1 124465->124427 124466 2e39aca 124466->124465 124798 2e38160 124466->124798 124469->124419 124470->124429 124472 2e4a616 124471->124472 124473 2e4af60 LdrLoadDll 124472->124473 124474 2e48a85 124473->124474 124474->124423 124476 2e44d85 124475->124476 124487 2e44a64 124475->124487 124476->124455 124479 2e44b90 124544 2e4a360 124479->124544 124480 2e44b73 124601 2e4a460 LdrLoadDll 124480->124601 124483 2e44bb7 124485 2e4bdc0 2 API calls 124483->124485 124484 2e44b7d 124484->124455 124486 2e44bc3 124485->124486 124486->124484 124488 2e44d49 124486->124488 124489 2e44d5f 124486->124489 124494 2e44c52 124486->124494 124487->124476 124541 2e49c50 124487->124541 124490 2e4a490 2 API calls 124488->124490 124610 2e44790 LdrLoadDll NtReadFile NtClose 124489->124610 124493 2e44d50 124490->124493 124492 2e44d72 124492->124455 124493->124455 124495 2e44cb9 124494->124495 124497 2e44c61 124494->124497 124495->124488 124496 2e44ccc 124495->124496 124603 2e4a2e0 124496->124603 124499 2e44c66 124497->124499 124500 2e44c7a 124497->124500 124602 2e44650 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 124499->124602 124503 2e44c97 124500->124503 124504 2e44c7f 124500->124504 124503->124493 124559 2e44410 124503->124559 124547 2e446f0 124504->124547 124506 2e44c70 124506->124455 124509 2e44d2c 124607 2e4a490 124509->124607 124510 2e44c8d 124510->124455 124511 2e44caf 124511->124455 124513 2e44d38 124513->124455 124515 2e4b101 124514->124515 124516 2e4b113 124515->124516 124517 2e4bd40 LdrLoadDll 124515->124517 124516->124458 124518 2e4b134 124517->124518 124519 2e44070 3 API calls 124518->124519 124521 2e4b157 124518->124521 124519->124521 124520 2e4b180 124520->124458 124521->124520 124628 2e44070 124521->124628 124523 2e4b179 124523->124520 124660 2e45390 124523->124660 124525 2e4b20a 124526 2e4b21a 124525->124526 124754 2e4af00 LdrLoadDll 124525->124754 124670 2e4ad70 124526->124670 124529 2e4b248 124749 2e49ec0 124529->124749 124533 2e49f0c 124532->124533 124534 2e4af60 LdrLoadDll 124533->124534 124535 2e49f1c 124534->124535 124779 37c2c0a 124535->124779 124536 2e49f37 124538 2e4bdc0 124536->124538 124782 2e4a670 124538->124782 124540 2e4b359 124540->124425 124542 2e44b44 124541->124542 124543 2e4af60 LdrLoadDll 124541->124543 124542->124479 124542->124480 124542->124484 124543->124542 124545 2e4af60 LdrLoadDll 124544->124545 124546 2e4a37c NtCreateFile 124545->124546 124546->124483 124548 2e4470c 124547->124548 124549 2e4a2e0 LdrLoadDll 124548->124549 124550 2e4472d 124549->124550 124551 2e44734 124550->124551 124552 2e44748 124550->124552 124553 2e4a490 2 API calls 124551->124553 124554 2e4a490 2 API calls 124552->124554 124555 2e4473d 124553->124555 124556 2e44751 124554->124556 124555->124510 124611 2e4bfd0 LdrLoadDll RtlAllocateHeap 124556->124611 124558 2e4475c 124558->124510 124560 2e4448e 124559->124560 124561 2e4445b 124559->124561 124563 2e445d9 124560->124563 124567 2e444aa 124560->124567 124562 2e4a2e0 LdrLoadDll 124561->124562 124565 2e44476 124562->124565 124564 2e4a2e0 LdrLoadDll 124563->124564 124571 2e445f4 124564->124571 124566 2e4a490 2 API calls 124565->124566 124568 2e4447f 124566->124568 124569 2e4a2e0 LdrLoadDll 124567->124569 124568->124511 124570 2e444c5 124569->124570 124573 2e444e1 124570->124573 124574 2e444cc 124570->124574 124624 2e4a320 LdrLoadDll 124571->124624 124575 2e444e6 124573->124575 124580 2e444fc 124573->124580 124577 2e4a490 2 API calls 124574->124577 124579 2e4a490 2 API calls 124575->124579 124576 2e4462e 124581 2e4a490 2 API calls 124576->124581 124578 2e444d5 124577->124578 124578->124511 124583 2e444ef 124579->124583 124587 2e44501 124580->124587 124612 2e4bf90 124580->124612 124582 2e44639 124581->124582 124582->124511 124583->124511 124586 2e44567 124588 2e4457e 124586->124588 124623 2e4a2a0 LdrLoadDll 124586->124623 124594 2e44513 124587->124594 124615 2e4a410 124587->124615 124590 2e44585 124588->124590 124591 2e4459a 124588->124591 124592 2e4a490 2 API calls 124590->124592 124593 2e4a490 2 API calls 124591->124593 124592->124594 124595 2e445a3 124593->124595 124594->124511 124596 2e445cf 124595->124596 124618 2e4bb90 124595->124618 124596->124511 124598 2e445ba 124599 2e4bdc0 2 API calls 124598->124599 124600 2e445c3 124599->124600 124600->124511 124601->124484 124602->124506 124604 2e4af60 LdrLoadDll 124603->124604 124605 2e44d14 124604->124605 124606 2e4a320 LdrLoadDll 124605->124606 124606->124509 124608 2e4af60 LdrLoadDll 124607->124608 124609 2e4a4ac NtClose 124608->124609 124609->124513 124610->124492 124611->124558 124614 2e4bfa8 124612->124614 124625 2e4a630 124612->124625 124614->124587 124616 2e4a42c NtReadFile 124615->124616 124617 2e4af60 LdrLoadDll 124615->124617 124616->124586 124617->124616 124619 2e4bbb4 124618->124619 124620 2e4bb9d 124618->124620 124619->124598 124620->124619 124621 2e4bf90 2 API calls 124620->124621 124622 2e4bbcb 124621->124622 124622->124598 124623->124588 124624->124576 124626 2e4af60 LdrLoadDll 124625->124626 124627 2e4a64c RtlAllocateHeap 124626->124627 124627->124614 124629 2e44081 124628->124629 124631 2e44089 124628->124631 124629->124523 124630 2e4435c 124630->124523 124631->124630 124755 2e4cf30 124631->124755 124633 2e440dd 124634 2e4cf30 2 API calls 124633->124634 124637 2e440e8 124634->124637 124635 2e44136 124638 2e4cf30 2 API calls 124635->124638 124637->124635 124760 2e4cfd0 LdrLoadDll RtlAllocateHeap RtlFreeHeap 124637->124760 124761 2e4d060 124637->124761 124641 2e4414a 124638->124641 124640 2e441a7 124642 2e4cf30 2 API calls 124640->124642 124641->124640 124644 2e4d060 3 API calls 124641->124644 124643 2e441bd 124642->124643 124645 2e441fa 124643->124645 124647 2e4d060 3 API calls 124643->124647 124644->124641 124646 2e4cf30 2 API calls 124645->124646 124648 2e44205 124646->124648 124647->124643 124649 2e4d060 3 API calls 124648->124649 124656 2e4423f 124648->124656 124649->124648 124651 2e44334 124768 2e4cf90 LdrLoadDll RtlFreeHeap 124651->124768 124653 2e4433e 124769 2e4cf90 LdrLoadDll RtlFreeHeap 124653->124769 124655 2e44348 124770 2e4cf90 LdrLoadDll RtlFreeHeap 124655->124770 124767 2e4cf90 LdrLoadDll RtlFreeHeap 124656->124767 124658 2e44352 124771 2e4cf90 LdrLoadDll RtlFreeHeap 124658->124771 124661 2e453a1 124660->124661 124662 2e44a50 8 API calls 124661->124662 124664 2e453b7 124662->124664 124663 2e4540a 124663->124525 124664->124663 124665 2e45405 124664->124665 124666 2e453f2 124664->124666 124667 2e4bdc0 2 API calls 124665->124667 124668 2e4bdc0 2 API calls 124666->124668 124667->124663 124669 2e453f7 124668->124669 124669->124525 124671 2e4ad84 124670->124671 124672 2e4ac30 LdrLoadDll 124670->124672 124772 2e4ac30 124671->124772 124672->124671 124675 2e4ac30 LdrLoadDll 124676 2e4ad96 124675->124676 124677 2e4ac30 LdrLoadDll 124676->124677 124678 2e4ad9f 124677->124678 124679 2e4ac30 LdrLoadDll 124678->124679 124680 2e4ada8 124679->124680 124681 2e4ac30 LdrLoadDll 124680->124681 124682 2e4adb1 124681->124682 124683 2e4ac30 LdrLoadDll 124682->124683 124684 2e4adbd 124683->124684 124685 2e4ac30 LdrLoadDll 124684->124685 124686 2e4adc6 124685->124686 124687 2e4ac30 LdrLoadDll 124686->124687 124688 2e4adcf 124687->124688 124689 2e4ac30 LdrLoadDll 124688->124689 124690 2e4add8 124689->124690 124691 2e4ac30 LdrLoadDll 124690->124691 124692 2e4ade1 124691->124692 124693 2e4ac30 LdrLoadDll 124692->124693 124694 2e4adea 124693->124694 124695 2e4ac30 LdrLoadDll 124694->124695 124696 2e4adf6 124695->124696 124697 2e4ac30 LdrLoadDll 124696->124697 124698 2e4adff 124697->124698 124699 2e4ac30 LdrLoadDll 124698->124699 124700 2e4ae08 124699->124700 124701 2e4ac30 LdrLoadDll 124700->124701 124702 2e4ae11 124701->124702 124703 2e4ac30 LdrLoadDll 124702->124703 124704 2e4ae1a 124703->124704 124705 2e4ac30 LdrLoadDll 124704->124705 124706 2e4ae23 124705->124706 124707 2e4ac30 LdrLoadDll 124706->124707 124708 2e4ae2f 124707->124708 124709 2e4ac30 LdrLoadDll 124708->124709 124710 2e4ae38 124709->124710 124711 2e4ac30 LdrLoadDll 124710->124711 124712 2e4ae41 124711->124712 124713 2e4ac30 LdrLoadDll 124712->124713 124714 2e4ae4a 124713->124714 124715 2e4ac30 LdrLoadDll 124714->124715 124716 2e4ae53 124715->124716 124717 2e4ac30 LdrLoadDll 124716->124717 124718 2e4ae5c 124717->124718 124719 2e4ac30 LdrLoadDll 124718->124719 124720 2e4ae68 124719->124720 124721 2e4ac30 LdrLoadDll 124720->124721 124722 2e4ae71 124721->124722 124723 2e4ac30 LdrLoadDll 124722->124723 124724 2e4ae7a 124723->124724 124725 2e4ac30 LdrLoadDll 124724->124725 124726 2e4ae83 124725->124726 124727 2e4ac30 LdrLoadDll 124726->124727 124728 2e4ae8c 124727->124728 124729 2e4ac30 LdrLoadDll 124728->124729 124730 2e4ae95 124729->124730 124731 2e4ac30 LdrLoadDll 124730->124731 124732 2e4aea1 124731->124732 124733 2e4ac30 LdrLoadDll 124732->124733 124734 2e4aeaa 124733->124734 124735 2e4ac30 LdrLoadDll 124734->124735 124736 2e4aeb3 124735->124736 124737 2e4ac30 LdrLoadDll 124736->124737 124738 2e4aebc 124737->124738 124739 2e4ac30 LdrLoadDll 124738->124739 124740 2e4aec5 124739->124740 124741 2e4ac30 LdrLoadDll 124740->124741 124742 2e4aece 124741->124742 124743 2e4ac30 LdrLoadDll 124742->124743 124744 2e4aeda 124743->124744 124745 2e4ac30 LdrLoadDll 124744->124745 124746 2e4aee3 124745->124746 124747 2e4ac30 LdrLoadDll 124746->124747 124748 2e4aeec 124747->124748 124748->124529 124750 2e4af60 LdrLoadDll 124749->124750 124751 2e49edc 124750->124751 124778 37c2df0 LdrInitializeThunk 124751->124778 124752 2e49ef3 124752->124458 124754->124526 124756 2e4cf46 124755->124756 124757 2e4cf40 124755->124757 124758 2e4cf6c 124756->124758 124759 2e4bf90 2 API calls 124756->124759 124757->124633 124758->124633 124759->124758 124760->124637 124762 2e4cfd0 124761->124762 124763 2e4d02d 124762->124763 124764 2e4bf90 2 API calls 124762->124764 124763->124637 124765 2e4d00a 124764->124765 124766 2e4bdc0 2 API calls 124765->124766 124766->124763 124767->124651 124768->124653 124769->124655 124770->124658 124771->124630 124773 2e4ac4b 124772->124773 124774 2e44e50 LdrLoadDll 124773->124774 124775 2e4ac6b 124774->124775 124776 2e44e50 LdrLoadDll 124775->124776 124777 2e4ad17 124775->124777 124776->124777 124777->124675 124778->124752 124780 37c2c1f LdrInitializeThunk 124779->124780 124781 37c2c11 124779->124781 124780->124536 124781->124536 124783 2e4a68c RtlFreeHeap 124782->124783 124784 2e4af60 LdrLoadDll 124782->124784 124783->124540 124784->124783 124786 2e37eb0 124785->124786 124787 2e37eab 124785->124787 124788 2e4bd40 LdrLoadDll 124786->124788 124787->124466 124791 2e37ed5 124788->124791 124789 2e37f38 124789->124466 124790 2e49ec0 2 API calls 124790->124791 124791->124789 124791->124790 124792 2e37f3e 124791->124792 124796 2e4bd40 LdrLoadDll 124791->124796 124801 2e4a5c0 124791->124801 124793 2e37f64 124792->124793 124795 2e4a5c0 2 API calls 124792->124795 124793->124466 124797 2e37f55 124795->124797 124796->124791 124797->124466 124799 2e4a5c0 2 API calls 124798->124799 124800 2e3817e 124799->124800 124800->124427 124802 2e4af60 LdrLoadDll 124801->124802 124803 2e4a5dc 124802->124803 124806 37c2c70 LdrInitializeThunk 124803->124806 124804 2e4a5f3 124804->124791 124806->124804 124808 2e4b5c3 124807->124808 124809 2e3acf0 LdrLoadDll 124808->124809 124810 2e39c5b 124809->124810 124810->124435 124812 2e3b063 124811->124812 124813 2e3b0e0 124812->124813 124826 2e49c90 LdrLoadDll 124812->124826 124813->124440 124816 2e4af60 LdrLoadDll 124815->124816 124817 2e3f1bb 124816->124817 124817->124448 124818 2e4a7d0 124817->124818 124819 2e4a7ef LookupPrivilegeValueW 124818->124819 124820 2e4af60 LdrLoadDll 124818->124820 124819->124444 124820->124819 124822 2e4af60 LdrLoadDll 124821->124822 124823 2e4a27c 124822->124823 124827 37c2ea0 LdrInitializeThunk 124823->124827 124824 2e4a29b 124824->124445 124826->124813 124827->124824 124829 2e3b1f0 124828->124829 124830 2e3b040 LdrLoadDll 124829->124830 124831 2e3b204 124830->124831 124831->124380 124833 2e3af34 124832->124833 124905 2e49c90 LdrLoadDll 124833->124905 124835 2e3af6e 124835->124382 124837 2e3f3ac 124836->124837 124838 2e3b1c0 LdrLoadDll 124837->124838 124839 2e3f3be 124838->124839 124906 2e3f290 124839->124906 124842 2e3f3f1 124844 2e3f402 124842->124844 124847 2e4a490 2 API calls 124842->124847 124843 2e3f3d9 124845 2e3f3e4 124843->124845 124846 2e4a490 2 API calls 124843->124846 124844->124385 124845->124385 124846->124845 124847->124844 124849 2e3f43c 124848->124849 124925 2e3b2b0 124849->124925 124851 2e3f44e 124852 2e3f290 3 API calls 124851->124852 124853 2e3f45f 124852->124853 124854 2e3f481 124853->124854 124855 2e3f469 124853->124855 124856 2e3f492 124854->124856 124859 2e4a490 2 API calls 124854->124859 124857 2e3f474 124855->124857 124858 2e4a490 2 API calls 124855->124858 124856->124387 124857->124387 124858->124857 124859->124856 124861 2e3caa6 124860->124861 124862 2e3cab0 124860->124862 124861->124396 124863 2e3af10 LdrLoadDll 124862->124863 124864 2e3cb4e 124863->124864 124865 2e3cb74 124864->124865 124866 2e3b040 LdrLoadDll 124864->124866 124865->124396 124867 2e3cb90 124866->124867 124868 2e44a50 8 API calls 124867->124868 124869 2e3cbe5 124868->124869 124869->124396 124871 2e3d646 124870->124871 124872 2e3b040 LdrLoadDll 124871->124872 124873 2e3d65a 124872->124873 124929 2e3d310 124873->124929 124875 2e3908b 124876 2e3cc00 124875->124876 124877 2e3cc26 124876->124877 124878 2e3b040 LdrLoadDll 124877->124878 124879 2e3cca9 124877->124879 124878->124879 124880 2e3b040 LdrLoadDll 124879->124880 124881 2e3cd16 124880->124881 124882 2e3af10 LdrLoadDll 124881->124882 124883 2e3cd7f 124882->124883 124884 2e3b040 LdrLoadDll 124883->124884 124885 2e3ce2f 124884->124885 124885->124408 124958 2e3f6d0 124886->124958 124888 2e38d14 124899 2e38f25 124888->124899 124963 2e443a0 124888->124963 124890 2e38d70 124890->124899 124966 2e38ab0 124890->124966 124893 2e4cf30 2 API calls 124894 2e38db2 124893->124894 124895 2e4d060 3 API calls 124894->124895 124900 2e38dc7 124895->124900 124896 2e37ea0 3 API calls 124896->124900 124899->124367 124900->124896 124900->124899 124901 2e3c7b0 16 API calls 124900->124901 124902 2e38160 2 API calls 124900->124902 124971 2e3f670 124900->124971 124975 2e3f080 19 API calls 124900->124975 124901->124900 124902->124900 124903->124388 124904->124414 124905->124835 124907 2e3f2aa 124906->124907 124915 2e3f360 124906->124915 124908 2e3b040 LdrLoadDll 124907->124908 124909 2e3f2cc 124908->124909 124916 2e49f40 124909->124916 124911 2e3f30e 124919 2e49f80 124911->124919 124914 2e4a490 2 API calls 124914->124915 124915->124842 124915->124843 124917 2e4af60 LdrLoadDll 124916->124917 124918 2e49f5c 124917->124918 124918->124911 124920 2e4af60 LdrLoadDll 124919->124920 124921 2e49f9c 124920->124921 124924 37c35c0 LdrInitializeThunk 124921->124924 124922 2e3f354 124922->124914 124924->124922 124926 2e3b2d7 124925->124926 124927 2e3b040 LdrLoadDll 124926->124927 124928 2e3b313 124927->124928 124928->124851 124930 2e3d327 124929->124930 124931 2e3d36f 124930->124931 124938 2e3f710 124930->124938 124946 2e4a6e0 124931->124946 124934 2e3d39b 124935 2e3d3a2 124934->124935 124949 2e4a2a0 LdrLoadDll 124934->124949 124935->124875 124937 2e3d3b5 124937->124875 124939 2e3f735 124938->124939 124950 2e381a0 124939->124950 124941 2e3f759 124942 2e3f766 124941->124942 124943 2e44a50 8 API calls 124941->124943 124945 2e4bdc0 2 API calls 124941->124945 124957 2e3f550 LdrLoadDll CreateProcessInternalW LdrInitializeThunk 124941->124957 124942->124931 124943->124941 124945->124941 124947 2e4af60 LdrLoadDll 124946->124947 124948 2e4a6ff CreateProcessInternalW 124947->124948 124948->124934 124949->124937 124951 2e3829f 124950->124951 124952 2e381b5 124950->124952 124951->124941 124952->124951 124953 2e44a50 8 API calls 124952->124953 124954 2e38222 124953->124954 124955 2e4bdc0 2 API calls 124954->124955 124956 2e38249 124954->124956 124955->124956 124956->124941 124957->124941 124959 2e44e50 LdrLoadDll 124958->124959 124960 2e3f6ef 124959->124960 124961 2e3f6f6 SetErrorMode 124960->124961 124962 2e3f6fd 124960->124962 124961->124962 124962->124888 124976 2e3f4a0 124963->124976 124965 2e443c6 124965->124890 124967 2e4bd40 LdrLoadDll 124966->124967 124970 2e38ad5 124966->124970 124967->124970 124968 2e38cea 124968->124893 124970->124968 124995 2e49880 124970->124995 124972 2e3f683 124971->124972 125043 2e49e90 124972->125043 124975->124900 124977 2e3f4bd 124976->124977 124983 2e49fc0 124977->124983 124980 2e3f505 124980->124965 124984 2e4af60 LdrLoadDll 124983->124984 124985 2e49fdc 124984->124985 124993 37c2f30 LdrInitializeThunk 124985->124993 124986 2e3f4fe 124986->124980 124988 2e4a010 124986->124988 124989 2e4af60 LdrLoadDll 124988->124989 124990 2e4a02c 124989->124990 124994 37c2d10 LdrInitializeThunk 124990->124994 124991 2e3f52e 124991->124965 124993->124986 124994->124991 124996 2e4bf90 2 API calls 124995->124996 124997 2e49897 124996->124997 125016 2e39310 124997->125016 124999 2e498b2 125000 2e498f0 124999->125000 125001 2e498d9 124999->125001 125004 2e4bd40 LdrLoadDll 125000->125004 125002 2e4bdc0 2 API calls 125001->125002 125003 2e498e6 125002->125003 125003->124968 125005 2e4992a 125004->125005 125006 2e4bd40 LdrLoadDll 125005->125006 125007 2e49943 125006->125007 125013 2e49be4 125007->125013 125022 2e4bd80 LdrLoadDll 125007->125022 125009 2e49bc9 125010 2e49bd0 125009->125010 125009->125013 125011 2e4bdc0 2 API calls 125010->125011 125012 2e49bda 125011->125012 125012->124968 125014 2e4bdc0 2 API calls 125013->125014 125015 2e49c39 125014->125015 125015->124968 125017 2e39335 125016->125017 125018 2e3acf0 LdrLoadDll 125017->125018 125019 2e39368 125018->125019 125021 2e3938d 125019->125021 125023 2e3cf20 125019->125023 125021->124999 125022->125009 125024 2e3cf4c 125023->125024 125025 2e4a1e0 LdrLoadDll 125024->125025 125026 2e3cf65 125025->125026 125027 2e3cf6c 125026->125027 125034 2e4a220 125026->125034 125027->125021 125031 2e3cfa7 125032 2e4a490 2 API calls 125031->125032 125033 2e3cfca 125032->125033 125033->125021 125035 2e4af60 LdrLoadDll 125034->125035 125036 2e4a23c 125035->125036 125042 37c2ca0 LdrInitializeThunk 125036->125042 125037 2e3cf8f 125037->125027 125039 2e4a810 125037->125039 125040 2e4a82f 125039->125040 125041 2e4af60 LdrLoadDll 125039->125041 125040->125031 125041->125040 125042->125037 125044 2e49eac 125043->125044 125045 2e4af60 LdrLoadDll 125043->125045 125048 37c2dd0 LdrInitializeThunk 125044->125048 125045->125044 125046 2e3f6ae 125046->124900 125048->125046 125051 37c2ad0 LdrInitializeThunk

                                                              Executed Functions

                                                              Function 0362A036 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 481nativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • NtQueryInformationProcess.NTDLL ref: 0362A19F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539920967.0000000003620000.00000040.00000800.00020000.00000000.sdmp, Offset: 03620000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3620000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InformationProcessQuery
                                                              • String ID: 0
                                                              • API String ID: 1778838933-4108050209
                                                              • Opcode ID: 7bc916a415ef614ffafa7f75d0ec115445e44d1b24a8fe03bb76e065ae57333e
                                                              • Instruction ID: 1221dc6ab4993b310c2daf5869dc6e54b41e593b8f7d7536cdd94dd4e52d817a
                                                              • Opcode Fuzzy Hash: 7bc916a415ef614ffafa7f75d0ec115445e44d1b24a8fe03bb76e065ae57333e
                                                              • Instruction Fuzzy Hash: FDF16F74918A9C8FDBA5EF68C894AEEBBE0FB98304F41462ED44ADB210DF309541CB45
                                                              Function 03629BAF Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 227nativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 209 3629baf-3629bfe call 3629102 212 3629c00 209->212 213 3629c0c-3629c9a call 362b942 * 2 NtCreateSection 209->213 214 3629c02-3629c0a 212->214 219 3629ca0-3629d0a call 362b942 NtMapViewOfSection 213->219 220 3629d5a-3629d68 213->220 214->213 214->214 223 3629d52 219->223 224 3629d0c-3629d4c 219->224 223->220 226 3629d69-3629d6b 224->226 227 3629d4e-3629d4f 224->227 228 3629d88-3629ddc call 362cd62 NtClose 226->228 229 3629d6d-3629d72 226->229 227->223 230 3629d74-3629d86 call 3629172 229->230 230->228
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539920967.0000000003620000.00000040.00000800.00020000.00000000.sdmp, Offset: 03620000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3620000_cmd.jbxd
                                                              Similarity
                                                              • API ID: Section$CloseCreateView
                                                              • String ID: @$@
                                                              • API String ID: 1133238012-149943524
                                                              • Opcode ID: db7dcd85dc853400a789dde9de35cb8114d6383d98fd4a16120e7ccab82aa783
                                                              • Instruction ID: d92d491ebc60cea885385c0c6a31d5252307184198f48a54f7d97489d1d482c0
                                                              • Opcode Fuzzy Hash: db7dcd85dc853400a789dde9de35cb8114d6383d98fd4a16120e7ccab82aa783
                                                              • Instruction Fuzzy Hash: 38617170618B498FCB5CEF68D8856AABBE0FF98314F50062EE58AC3651DF35D441CB86
                                                              Function 03629BB2 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 171nativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 268 3629bb2-3629bef 269 3629bf7-3629bfe 268->269 270 3629bf2 call 3629102 268->270 271 3629c00 269->271 272 3629c0c-3629c9a call 362b942 * 2 NtCreateSection 269->272 270->269 273 3629c02-3629c0a 271->273 278 3629ca0-3629d0a call 362b942 NtMapViewOfSection 272->278 279 3629d5a-3629d68 272->279 273->272 273->273 282 3629d52 278->282 283 3629d0c-3629d4c 278->283 282->279 285 3629d69-3629d6b 283->285 286 3629d4e-3629d4f 283->286 287 3629d88-3629ddc call 362cd62 NtClose 285->287 288 3629d6d-3629d72 285->288 286->282 289 3629d74-3629d86 call 3629172 288->289 289->287
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539920967.0000000003620000.00000040.00000800.00020000.00000000.sdmp, Offset: 03620000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3620000_cmd.jbxd
                                                              Similarity
                                                              • API ID: Section$CreateView
                                                              • String ID: @$@
                                                              • API String ID: 1585966358-149943524
                                                              • Opcode ID: d19581801156352ea8c1368f03ac477e7143ca4b49b2be0ea58d8e64d299f740
                                                              • Instruction ID: db93380acdb068e116497ce40b90ed972bd4e928ff2bfe3667203e9ead9f1b39
                                                              • Opcode Fuzzy Hash: d19581801156352ea8c1368f03ac477e7143ca4b49b2be0ea58d8e64d299f740
                                                              • Instruction Fuzzy Hash: 53516EB0618B088FD758DF18D8956AABBE0FF98314F50062EE98ED3651DF35D441CB86
                                                              Function 0362A042 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163nativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • NtQueryInformationProcess.NTDLL ref: 0362A19F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539920967.0000000003620000.00000040.00000800.00020000.00000000.sdmp, Offset: 03620000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3620000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InformationProcessQuery
                                                              • String ID: 0
                                                              • API String ID: 1778838933-4108050209
                                                              • Opcode ID: 4a13b2017a61ababd9bba988d9a9b5b8b8f576b3da72e298de5122239bed11ad
                                                              • Instruction ID: 015caf64646833a3f059b902fd0cdea5eedc3f03b1d170f1bd87c54e3d40ef8c
                                                              • Opcode Fuzzy Hash: 4a13b2017a61ababd9bba988d9a9b5b8b8f576b3da72e298de5122239bed11ad
                                                              • Instruction Fuzzy Hash: D5514B70918A9C8FDBA9EF68C8946EEBBF4FB98304F41462ED44AD7210DF309645CB45
                                                              Function 02E4A35A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44filenativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 548 2e4a35a-2e4a376 549 2e4a37c-2e4a3b1 NtCreateFile 548->549 550 2e4a377 call 2e4af60 548->550 550->549
                                                              APIs
                                                              • NtCreateFile.NTDLL(00000060,00000000,.z`,02E44BB7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,02E44BB7,007A002E,00000000,00000060,00000000,00000000), ref: 02E4A3AD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: CreateFile
                                                              • String ID: .z`
                                                              • API String ID: 823142352-1441809116
                                                              • Opcode ID: 7c417f45352538f3dbc70b9006c8c35baf7fa9f0c61c4a99e0ec42fa983afd1d
                                                              • Instruction ID: 0cf62f4ce6eb996e5c62a127f02e5e018d886e8264149539f8843de9e0f2dfac
                                                              • Opcode Fuzzy Hash: 7c417f45352538f3dbc70b9006c8c35baf7fa9f0c61c4a99e0ec42fa983afd1d
                                                              • Instruction Fuzzy Hash: 7101E4B2241108AFCB48CF88DC90DEB37E9AF8C754F158618FA0DD7240D630E8418BA0
                                                              Function 02E4A360 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 551 2e4a360-2e4a3b1 call 2e4af60 NtCreateFile
                                                              APIs
                                                              • NtCreateFile.NTDLL(00000060,00000000,.z`,02E44BB7,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,02E44BB7,007A002E,00000000,00000060,00000000,00000000), ref: 02E4A3AD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: CreateFile
                                                              • String ID: .z`
                                                              • API String ID: 823142352-1441809116
                                                              • Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                                              • Instruction ID: 36919445fa90459387bd06b4ac834be81cebebff520936dd3440a590630494fc
                                                              • Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
                                                              • Instruction Fuzzy Hash: 1DF0B2B2240208ABCB08CF89DC94EEB77ADAF8C754F158248BA0D97240C630E8118BA4
                                                              Function 02E4A410 Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • NtReadFile.NTDLL(02E44D72,5EB65239,FFFFFFFF,02E44A31,?,?,02E44D72,?,02E44A31,FFFFFFFF,5EB65239,02E44D72,?,00000000), ref: 02E4A455
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FileRead
                                                              • String ID:
                                                              • API String ID: 2738559852-0
                                                              • Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                                              • Instruction ID: c70c8aa54ccf2fa3c3e7c4ee9573c59a734885f5c44264c7db7ec17467e7118c
                                                              • Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
                                                              • Instruction Fuzzy Hash: 4FF0B7B2200208AFDB14DF89DC90EEB77ADEF8C754F158258BE1D97241DA30E811CBA0
                                                              Function 02E4A40A Relevance: 1.5, APIs: 1, Instructions: 33filenativeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • NtReadFile.NTDLL(02E44D72,5EB65239,FFFFFFFF,02E44A31,?,?,02E44D72,?,02E44A31,FFFFFFFF,5EB65239,02E44D72,?,00000000), ref: 02E4A455
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FileRead
                                                              • String ID:
                                                              • API String ID: 2738559852-0
                                                              • Opcode ID: 502a9b782b303b8a28e01c6a188142a589d386d33725d39a54a7567b0150e13c
                                                              • Instruction ID: e87a4fa3137b0ce7dffc5d8f517575f58052c7d4948231d236c70489ca3c9016
                                                              • Opcode Fuzzy Hash: 502a9b782b303b8a28e01c6a188142a589d386d33725d39a54a7567b0150e13c
                                                              • Instruction Fuzzy Hash: 70F017B6200149ABCB04DFA8D990CEB77ADFF8C314B15864DFD5D97201C634E8558BA4
                                                              Function 02E4A490 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • NtClose.NTDLL(02E44D50,?,?,02E44D50,00000000,FFFFFFFF), ref: 02E4A4B5
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: Close
                                                              • String ID:
                                                              • API String ID: 3535843008-0
                                                              • Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
                                                              • Instruction ID: 2dca69187632b7574183d43d9696877757d37b7f8efbe14235d51c046ed825ad
                                                              • Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
                                                              • Instruction Fuzzy Hash: 5AD012762402146BD710EB99DC45E97775DEF44760F158555BA185B241C530F50086E0
                                                              Function 037C2B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 4af07a1a94da320baa6020fea37b114ead1ada30cc033f1325f3fc585b25872e
                                                              • Instruction ID: 101c6d479b5fa4aaf8434dc419e658a308f5fbad4d204e70652cdd7504aa6ad9
                                                              • Opcode Fuzzy Hash: 4af07a1a94da320baa6020fea37b114ead1ada30cc033f1325f3fc585b25872e
                                                              • Instruction Fuzzy Hash: 21900265202414135105B1584454616402A87E0201B55C031E10145A0DC62589916126
                                                              Function 037C2AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 97d857e2408daf51aad9a91b04324d7673e8555489d74891e040e782d49b11e5
                                                              • Instruction ID: 4d19f696646dda05ed30b09c87860dec9c63b065fa40574aedbeee01a82bf278
                                                              • Opcode Fuzzy Hash: 97d857e2408daf51aad9a91b04324d7673e8555489d74891e040e782d49b11e5
                                                              • Instruction Fuzzy Hash: D290043D311414131105F55C07445070077C7D5351355C031F1015570CD731CD715133
                                                              Function 037C2F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 19a5b14eb957f1e8f81129bd7efbe0c214726cbea485317eb80238ad47e58de6
                                                              • Instruction ID: 337fbe1df92e9ea568e2d6bc8ae5a4f25f1d2dfbb363180d3b3f9c31763ffa79
                                                              • Opcode Fuzzy Hash: 19a5b14eb957f1e8f81129bd7efbe0c214726cbea485317eb80238ad47e58de6
                                                              • Instruction Fuzzy Hash: 2190026534141852E100B1584454B060025C7E1301F55C025E1064564D8719CD526127
                                                              Function 037C2FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 371a6f5d90659c238c671321b79a831598bd1abe9538c31924bdcad38e7f82dd
                                                              • Instruction ID: f69e55caf416feaa6ae77873ee19d02b3c4466463d44a192a5ee627f7539d9ea
                                                              • Opcode Fuzzy Hash: 371a6f5d90659c238c671321b79a831598bd1abe9538c31924bdcad38e7f82dd
                                                              • Instruction Fuzzy Hash: 7F900225211C1452E200B5684C54B07002587D0303F55C125A0154564CCA1589615522
                                                              Function 037C2EA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 10a3bfd9c0b5ca67bd8f593db3202de1c044d1f539c2f3d03128a3b5a001bd3c
                                                              • Instruction ID: fa0c1be9caaab653ebbdbf1c1d17edc605279f05ad868bd328ec781bde101b74
                                                              • Opcode Fuzzy Hash: 10a3bfd9c0b5ca67bd8f593db3202de1c044d1f539c2f3d03128a3b5a001bd3c
                                                              • Instruction Fuzzy Hash: D890027520141812E140B1584444746002587D0301F55C021A5064564E87598ED56666
                                                              Function 037C2D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 883e05cd413fc13d89004ce1d7f2d55a777c97374b077427ac18333d229d3514
                                                              • Instruction ID: 648a7feea166d898ed93bb3b6b9b4b32fc05988ee7af3462cca43591cb78dacd
                                                              • Opcode Fuzzy Hash: 883e05cd413fc13d89004ce1d7f2d55a777c97374b077427ac18333d229d3514
                                                              • Instruction Fuzzy Hash: F990022D21341412E180B158544860A002587D1202F95D425A0015568CCA1589695322
                                                              Function 037C2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 59ec6109d677fd766403f7d2aa34bb5685e12de80c86fb8db68cb2db00c29025
                                                              • Instruction ID: 33677293ebb8810fc72c646f542cd1e700af54dda91674d30cf3417e0aaa282d
                                                              • Opcode Fuzzy Hash: 59ec6109d677fd766403f7d2aa34bb5685e12de80c86fb8db68cb2db00c29025
                                                              • Instruction Fuzzy Hash: 0D90023520141823E111B1584544707002987D0241F95C422A0424568D97568A52A122
                                                              Function 037C2DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 19d9ac7d531c265f97f7cac105f51d39051a065aea53b84c0fd1ecc0e720ed7a
                                                              • Instruction ID: 4719d8382b2ed04c9dac3e90a9043ec71c77d74bc2041abb58989c6c4793f94d
                                                              • Opcode Fuzzy Hash: 19d9ac7d531c265f97f7cac105f51d39051a065aea53b84c0fd1ecc0e720ed7a
                                                              • Instruction Fuzzy Hash: 53900225242455626545F1584444507402697E0241795C022A1414960C86269956D622
                                                              Function 037C2C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 7dfbaed9d7e79b38c36cb570dfd3f9e3c1b68949e79c601c0f4b3960aeb2d9d5
                                                              • Instruction ID: 1bf7206093474f8dbeb68b20b294cf9bdcadfc9d72afa08fc3a0f505438040bc
                                                              • Opcode Fuzzy Hash: 7dfbaed9d7e79b38c36cb570dfd3f9e3c1b68949e79c601c0f4b3960aeb2d9d5
                                                              • Instruction Fuzzy Hash: 3590023520149C12E110B158844474A002587D0301F59C421A4424668D879589917122
                                                              Function 037C2C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: fd0cfac0ca98cceb5c3ea58cf741e27345af519d715a9073b2d54ac813f5f932
                                                              • Instruction ID: 5291f3add23f9f1eb1a9be0e9f2be8a59f0efb88489850141229f09c928ec10d
                                                              • Opcode Fuzzy Hash: fd0cfac0ca98cceb5c3ea58cf741e27345af519d715a9073b2d54ac813f5f932
                                                              • Instruction Fuzzy Hash: BF90023520141C52E100B1584444B46002587E0301F55C026A0124664D8715C9517522
                                                              Function 037C2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: daa4bf881d205f61f9a5a2b40f83016f96ebb2f7e004a2192f8d5ed65a4df847
                                                              • Instruction ID: 53c0608eaea488509d2254c246c46a9401400f7f9589258b1050341093a939a5
                                                              • Opcode Fuzzy Hash: daa4bf881d205f61f9a5a2b40f83016f96ebb2f7e004a2192f8d5ed65a4df847
                                                              • Instruction Fuzzy Hash: 4090023520141812E100B5985448646002587E0301F55D021A5024565EC76589916132
                                                              Function 037C35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: dc4e687eb8f5d51e7404558704928d28a6d7554a6050dfc398b5928eac4258bd
                                                              • Instruction ID: 41f9e3e33abf1d1e958f6df484e093c3c5fc8a3d2a6e602cb1446cd193df8a3a
                                                              • Opcode Fuzzy Hash: dc4e687eb8f5d51e7404558704928d28a6d7554a6050dfc398b5928eac4258bd
                                                              • Instruction Fuzzy Hash: 0E90023560551812E100B1584554706102587D0201F65C421A0424578D87958A5165A3
                                                              Function 02E49080 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 90sleepCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 405 2e49080-2e490c2 call 2e4bd40 408 2e4919c-2e491a2 405->408 409 2e490c8-2e49118 call 2e4be10 call 2e3acf0 call 2e44e50 405->409 416 2e49120-2e49131 Sleep 409->416 417 2e49196-2e4919a 416->417 418 2e49133-2e49139 416->418 417->408 417->416 419 2e49163-2e49184 call 2e48eb0 418->419 420 2e4913b-2e49161 call 2e48ca0 418->420 424 2e49189-2e4918c 419->424 420->424 424->417
                                                              APIs
                                                              • Sleep.KERNELBASE(000007D0), ref: 02E49128
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: Sleep
                                                              • String ID: net.dll$wininet.dll
                                                              • API String ID: 3472027048-1269752229
                                                              • Opcode ID: d1ce1d2f53975676f43c5162e91f6ad561eb5cdea69a7d1ac403106fe8445731
                                                              • Instruction ID: 89a88340eb6b00e70a3e5dcacd3f5a7e845212ea670255a2fe61c7b731c1c8aa
                                                              • Opcode Fuzzy Hash: d1ce1d2f53975676f43c5162e91f6ad561eb5cdea69a7d1ac403106fe8445731
                                                              • Instruction Fuzzy Hash: B13181B2940644ABC714DF64DC85FA7B7B9AB48B05F00811DF62A6B245DA30B650CBA4
                                                              Function 02E49076 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 81sleepCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 425 2e49076-2e490af 426 2e490bb-2e490c2 425->426 427 2e490b6 call 2e4bd40 425->427 428 2e4919c-2e491a2 426->428 429 2e490c8-2e49118 call 2e4be10 call 2e3acf0 call 2e44e50 426->429 427->426 436 2e49120-2e49131 Sleep 429->436 437 2e49196-2e4919a 436->437 438 2e49133-2e49139 436->438 437->428 437->436 439 2e49163-2e49184 call 2e48eb0 438->439 440 2e4913b-2e49161 call 2e48ca0 438->440 444 2e49189-2e4918c 439->444 440->444 444->437
                                                              APIs
                                                              • Sleep.KERNELBASE(000007D0), ref: 02E49128
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: Sleep
                                                              • String ID: net.dll$wininet.dll
                                                              • API String ID: 3472027048-1269752229
                                                              • Opcode ID: e44eda693c9692d6e34c9af40cce3cbe0d69ca59bb2fcf075d80831b13a35a93
                                                              • Instruction ID: 45492c63507a46317d56f033f20ee3798da1306f5748d6cd730aa4f86e14ccd5
                                                              • Opcode Fuzzy Hash: e44eda693c9692d6e34c9af40cce3cbe0d69ca59bb2fcf075d80831b13a35a93
                                                              • Instruction Fuzzy Hash: 5121D2B1980344ABC714DF64DC85BA7B7B5FB88B04F10D01DF62D6B246DB70A550CBA5
                                                              Function 02E4A662 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 554 2e4a662-2e4a687 call 2e4af60 556 2e4a68c-2e4a6a1 RtlFreeHeap 554->556
                                                              APIs
                                                              • RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,02E33AF8), ref: 02E4A69D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FreeHeap
                                                              • String ID: .z`
                                                              • API String ID: 3298025750-1441809116
                                                              • Opcode ID: 3b169a03a4d6d4869557df61860f443006a029f9ed7622e83cbd9cf270615e2b
                                                              • Instruction ID: ce376ec2b4872ce1f288060c54abfff9ea4a3d656648e59ffd35cd6cf5cccb44
                                                              • Opcode Fuzzy Hash: 3b169a03a4d6d4869557df61860f443006a029f9ed7622e83cbd9cf270615e2b
                                                              • Instruction Fuzzy Hash: 97E068A51442850FD700EE79A4A049F37D4FF80324720866AEC584B307D020C40B8761
                                                              Function 02E4A670 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 557 2e4a670-2e4a686 558 2e4a68c-2e4a6a1 RtlFreeHeap 557->558 559 2e4a687 call 2e4af60 557->559 559->558
                                                              APIs
                                                              • RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,02E33AF8), ref: 02E4A69D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: FreeHeap
                                                              • String ID: .z`
                                                              • API String ID: 3298025750-1441809116
                                                              • Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                                              • Instruction ID: 14b939f743bcde0d98bff9017ece6cd173355d5fd2dce476b128813e2b768cb0
                                                              • Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
                                                              • Instruction Fuzzy Hash: BCE04FB12402086BD714DF59DC44EA777ADEF88750F118554FD0857341C630F910CAF0
                                                              Function 02E38310 Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 02E3836A
                                                              • PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 02E3838B
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: MessagePostThread
                                                              • String ID:
                                                              • API String ID: 1836367815-0
                                                              • Opcode ID: 9e70c73f60def60f65b4c435396576adf58625eb4223d803369717d0cef32593
                                                              • Instruction ID: 6257e609374dd3035822d9bfd6505402b4aca251faf3db6f031c1e0c660b86d1
                                                              • Opcode Fuzzy Hash: 9e70c73f60def60f65b4c435396576adf58625eb4223d803369717d0cef32593
                                                              • Instruction Fuzzy Hash: B201F731AC022877EB21AA949C02FFE772C5B40F55F048119FF04BA2C0EAA4690587F6
                                                              Function 02E3ACF0 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 02E3AD62
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: Load
                                                              • String ID:
                                                              • API String ID: 2234796835-0
                                                              • Opcode ID: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                                              • Instruction ID: 76f1bd93b891037180543e383862eeca669c6a912ee4db854c3c05ecce8d6b27
                                                              • Opcode Fuzzy Hash: dc2098e385e942efcd48a296202403441f5905bb34daa24398974f8d6af8945c
                                                              • Instruction Fuzzy Hash: 23015EB5E4020DABDF10DAE0EC45FDDB3799B0430DF4085A5E90897240FA30E744CB91
                                                              Function 02E4A6E0 Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 02E4A734
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: CreateInternalProcess
                                                              • String ID:
                                                              • API String ID: 2186235152-0
                                                              • Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                                              • Instruction ID: 51ed452edc142974786fe6c33fd4fbb6c7b877aaec95404a338330a97d3f2b7b
                                                              • Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
                                                              • Instruction Fuzzy Hash: 7301B2B2210108BFCB54DF89DC80EEB77ADAF8C754F158258FA0D97240C630E851CBA4
                                                              Function 02E4A7C2 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LookupPrivilegeValueW.ADVAPI32(00000000,?,02E3F1D2,02E3F1D2,?,00000000,?,?), ref: 02E4A800
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: LookupPrivilegeValue
                                                              • String ID:
                                                              • API String ID: 3899507212-0
                                                              • Opcode ID: a74d6b44c497589037dee59f5b64dfe1477963b6447a0ab723df86f9e3b050e7
                                                              • Instruction ID: fd2f075e38b7834f7e61841ae7be6b9d6fc7e77741d36ee8327d7738fbbdc6ff
                                                              • Opcode Fuzzy Hash: a74d6b44c497589037dee59f5b64dfe1477963b6447a0ab723df86f9e3b050e7
                                                              • Instruction Fuzzy Hash: 1EF04FB22401147FDB14DF99DC84EEB37A9EF88250F10C519F90CD7241C631E9118BB4
                                                              Function 02E491B0 Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000,?,?,02E3F050,?,?,00000000), ref: 02E491EC
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: CreateThread
                                                              • String ID:
                                                              • API String ID: 2422867632-0
                                                              • Opcode ID: d8d341beacf55d3aadfcb46bdd6eb0ebc06c290d7a953d7ae1546744555f20b2
                                                              • Instruction ID: e1a9a70b2dc2467c09051c6ab08cea2f9c7b96dbb58cbe050bf2f7df85edeb48
                                                              • Opcode Fuzzy Hash: d8d341beacf55d3aadfcb46bdd6eb0ebc06c290d7a953d7ae1546744555f20b2
                                                              • Instruction Fuzzy Hash: 8AE06D373802043AE3206999AC02FA7B29CCB81B25F154026FA0DEA2C1D995F40146A8
                                                              Function 02E4A630 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • RtlAllocateHeap.NTDLL(02E44536,?,02E44CAF,02E44CAF,?,02E44536,?,?,?,?,?,00000000,00000000,?), ref: 02E4A65D
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: AllocateHeap
                                                              • String ID:
                                                              • API String ID: 1279760036-0
                                                              • Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                                              • Instruction ID: 498e20d9a64e68545ed56abeef6ba6fb010d797a423507219a7b52c2b13760ae
                                                              • Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
                                                              • Instruction Fuzzy Hash: 1EE012B2240208ABDB14EF99DC40EA777ADEF88664F118558BE085B241CA30F9118AB0
                                                              Function 02E4A7D0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LookupPrivilegeValueW.ADVAPI32(00000000,?,02E3F1D2,02E3F1D2,?,00000000,?,?), ref: 02E4A800
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: LookupPrivilegeValue
                                                              • String ID:
                                                              • API String ID: 3899507212-0
                                                              • Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
                                                              • Instruction ID: 64ff22334a007b8afcf76729e43427804c5473ccb7f719c3caf0598a545ab4f9
                                                              • Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
                                                              • Instruction Fuzzy Hash: DEE01AB12402086BDB10DF49DC84EE737ADEF88650F118164BE0857241C930E8118BF5
                                                              Function 02E3F6D0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetErrorMode.KERNELBASE(00008003,?,02E38D14,?), ref: 02E3F6FB
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538973840.0000000002E30000.00000040.80000000.00040000.00000000.sdmp, Offset: 02E30000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_2e30000_cmd.jbxd
                                                              Yara matches
                                                              Similarity
                                                              • API ID: ErrorMode
                                                              • String ID:
                                                              • API String ID: 2340568224-0
                                                              • Opcode ID: 2932bcf02bc07d7163de81b169680dc5c005ffd35bbbe1c0c8f45c66faab01c4
                                                              • Instruction ID: 438b06dd28f42ff7ce022b221a7efc22b11ea25af08c5b5ca7f35e20c56a875c
                                                              • Opcode Fuzzy Hash: 2932bcf02bc07d7163de81b169680dc5c005ffd35bbbe1c0c8f45c66faab01c4
                                                              • Instruction Fuzzy Hash: 5AD05E617903082AE610AAA49C06F2632895B44A04F494064F9499A2C3DD60E0008565
                                                              Function 037C2C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4539998201.0000000003750000.00000040.00001000.00020000.00000000.sdmp, Offset: 03750000, based on PE: true
                                                              • Associated: 00000008.00000002.4539998201.0000000003879000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.000000000387D000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4539998201.00000000038EE000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_3750000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InitializeThunk
                                                              • String ID:
                                                              • API String ID: 2994545307-0
                                                              • Opcode ID: 5ff34477fbaee3c97b2bc84b76507f9495608d864988b1e2add2cd033245590f
                                                              • Instruction ID: 4211d71b10142f6d07b047ed7c8b94b49e8587f358b13ffc19fb850a1ce67257
                                                              • Opcode Fuzzy Hash: 5ff34477fbaee3c97b2bc84b76507f9495608d864988b1e2add2cd033245590f
                                                              • Instruction Fuzzy Hash: 89B09B719015D5D5EF11E7604608717795467D0701F19C475D2030651F4739C5D1E176

                                                              Non-executed Functions

                                                              Function 00798572 Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 392COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00798791: GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00796906,0000001F,?,00000080), ref: 00798791
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001E,007CC9E0,00000008), ref: 0079859E
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000023,?,00000080), ref: 007985BC
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000021,?,00000080), ref: 00798614
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000024,?,00000080), ref: 00798653
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001D,007CC9D0,00000008), ref: 0079867D
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000031,007CC970,00000020), ref: 00798698
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000032,007CC930,00000020), ref: 007986B0
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000033,007CC8F0,00000020), ref: 007986C8
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000034,007CC8B0,00000020), ref: 007986E0
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000035,007CC870,00000020), ref: 007986F8
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000036,007CC830,00000020), ref: 00798710
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000037,007CC7F0,00000020), ref: 00798728
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000000E,007CC9C0,00000008), ref: 00798743
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000000F,007CC9B0,00000008), ref: 0079875B
                                                              • setlocale.MSVCRT ref: 00798770
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: InfoLocale$DefaultUsersetlocale
                                                              • String ID: .OCP$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
                                                              • API String ID: 1351325837-2236139042
                                                              • Opcode ID: 668b8c15e26bc8f0cfbf0760a22200005ef874f79ba0322ee9414f89cbd83d63
                                                              • Instruction ID: 70a661631109c30b5a952d856fb24d317e316f84435548b80b1c81f583cde588
                                                              • Opcode Fuzzy Hash: 668b8c15e26bc8f0cfbf0760a22200005ef874f79ba0322ee9414f89cbd83d63
                                                              • Instruction Fuzzy Hash: 68C1D271700252A6DF308F399D08B7B27ACEF96754F24432EE846DA286EB7DC941C761
                                                              Function 00799458 Relevance: 42.3, APIs: 15, Strings: 9, Instructions: 328threadprocessstringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000001,00000000,00000020,007BC9D0,00000108,007A2107,?,00000000,00000000,00000000), ref: 007994AA
                                                              • UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000000,00060001,?,00000004,00000000,00000000,?,00000000,00000000,00000000), ref: 007994D9
                                                              • memset.MSVCRT ref: 007994F1
                                                              • memset.MSVCRT ref: 0079954A
                                                              • GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000044), ref: 0079955D
                                                                • Part of subcall function 007A1D90: _wcsnicmp.MSVCRT ref: 007A1E14
                                                              • lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(00000000,\XCOPY.EXE), ref: 007995B8
                                                              • CreateProcessW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,00000001,00080000,00000000,?,?,?), ref: 00799602
                                                              • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 00799624
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00000000,00000000), ref: 007ABDF1
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00000000,00000000), ref: 007ABE0D
                                                              • DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,00000000), ref: 007ABE26
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: AttributeProcThread$ErrorLastListmemset$CloseCreateDeleteHandleInfoInitializeProcessStartupUpdate_wcsnicmplstrcmp
                                                              • String ID: $%01C$%08X$=ExitCode$=ExitCodeAscii$COPYCMD$D$H$\XCOPY.EXE
                                                              • API String ID: 1449572041-3461277227
                                                              • Opcode ID: 635bb5b172e8cbf8773f1f0fce788d39bb1f3dd0121692730364c469ef7d968e
                                                              • Instruction ID: 4065ef0a9ec7dd06a1f59a9ff6eb29081f7ec0e1ae56aee663aaabae5c66ce2a
                                                              • Opcode Fuzzy Hash: 635bb5b172e8cbf8773f1f0fce788d39bb1f3dd0121692730364c469ef7d968e
                                                              • Instruction Fuzzy Hash: C2C1A471A01315DFEF249F68AC45BEA77B8EB45300F1085AEE605D6281EB7C8D81CF66
                                                              Function 00794C10 Relevance: 33.8, APIs: 14, Strings: 5, Instructions: 552COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: [...]$ [..]$ [.]$...$:
                                                              • API String ID: 0-1980097535
                                                              • Opcode ID: 630666781d76d42bbe5f6989ba284c64ae4bafb62e79567e84d24fdcecf817ff
                                                              • Instruction ID: acb63c35ad24e4972a0813640347ec4ef261f57dd043d2a2a8c3258e0b850655
                                                              • Opcode Fuzzy Hash: 630666781d76d42bbe5f6989ba284c64ae4bafb62e79567e84d24fdcecf817ff
                                                              • Instruction Fuzzy Hash: 6E12A0B1208341DFDB64DB24D889A6B77E9EFC9340F044A2DF589C7291EB38D905CB66
                                                              Function 00796854 Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 366timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,007BE590,?,00002000), ref: 00796896
                                                              • SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 007968AA
                                                              • FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0(?,?), ref: 007968BE
                                                              • FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 007968D2
                                                              • realloc.MSVCRT ref: 007AA5E7
                                                                • Part of subcall function 00798791: GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00796906,0000001F,?,00000080), ref: 00798791
                                                              • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001F,?,00000080), ref: 00796907
                                                              • GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?), ref: 0079698F
                                                              • memmove.MSVCRT ref: 00796A86
                                                              • GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?,00000000,00000000), ref: 00796AAF
                                                              • realloc.MSVCRT ref: 00796ACA
                                                              • GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?,00000000,00000001), ref: 00796AFE
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: Time$File$DateFormatSystem$realloc$DefaultInfoLocalLocaleUsermemmove
                                                              • String ID: %02d%s%02d%s%02d$%s $%s %s
                                                              • API String ID: 2927284792-4023967598
                                                              • Opcode ID: 87aefec69c5f533835e6576b4bbad32c72dbdacffa6e62d881148f6033ab10f4
                                                              • Instruction ID: 52a33b006708e451e8cc878d3f537e2c3121e2a15173fa6306b05b67ff4050f9
                                                              • Opcode Fuzzy Hash: 87aefec69c5f533835e6576b4bbad32c72dbdacffa6e62d881148f6033ab10f4
                                                              • Instruction Fuzzy Hash: 0AC1D872900215EBDF24DF64DC49AEA73B9EB89300F1481AAE90AE7150EB3D9D41CF65
                                                              Function 007A589A Relevance: 15.1, APIs: 10, Instructions: 106memoryfileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,?,00000000,00000000,00000002,00000000,00000000,?,007A59D0,?,00796054,-00001038,00000000,?,?), ref: 007A58BB
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,007A59D0,?,00796054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 007A58CD
                                                              • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000014,?,007A59D0,?,00796054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 007A5944
                                                              • HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,007A59D0,?,00796054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 007A594B
                                                              • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,007A59D0,?,00796054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 007A596C
                                                              • HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,007A59D0,?,00796054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 007A5973
                                                              • FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,007A59D0,?,00796054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 007A598F
                                                              • FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,007A59D0,?,00796054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 007A59B6
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,007A59D0,?,00796054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 007B160B
                                                              • FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,007A59D0,?,00796054,-00001038,00000000,?,?,00000000,00000000,-00000001), ref: 007B1618
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: FindHeap$AllocCloseErrorFileLastProcess$FirstNext
                                                              • String ID:
                                                              • API String ID: 3609286125-0
                                                              • Opcode ID: 55841ee4733b9d3a97f48915979640a0b57f8d1ebecf2b67d4406ae95027cd9b
                                                              • Instruction ID: 62f8ad48a74b96f8ec7717f859080c3a5e0a4ef26df489f182e97fbe94c06def
                                                              • Opcode Fuzzy Hash: 55841ee4733b9d3a97f48915979640a0b57f8d1ebecf2b67d4406ae95027cd9b
                                                              • Instruction Fuzzy Hash: EC319231602600FFDB149F24DC49B6A3BB5FB86335F248A1DE996872E0D73DA801DB55
                                                              Function 007B7460 Relevance: 13.6, APIs: 9, Instructions: 66filenativeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 007B7483
                                                              • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 007B7495
                                                              • fprintf.MSVCRT ref: 007B74BB
                                                              • fflush.MSVCRT ref: 007B74C9
                                                              • TryAcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(007D8E04), ref: 007B74E2
                                                              • NtCancelSynchronousIoFile.NTDLL(00000000,00000000), ref: 007B74F8
                                                              • ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(007D8E04), ref: 007B74FF
                                                              • _get_osfhandle.MSVCRT ref: 007B751C
                                                              • FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 007B7524
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: CriticalExclusiveLockSection$AcquireBufferCancelConsoleEnterFileFlushInputLeaveReleaseSynchronous_get_osfhandlefflushfprintf
                                                              • String ID:
                                                              • API String ID: 3139166086-0
                                                              • Opcode ID: 0b81bd143735dc4d8379e2877338aeb2951d5e936a31113f0685bae5fc3326f2
                                                              • Instruction ID: 44383fd8d0739bd92ec7251dbff99984356f5fa6608153ad555cf3df67b8cfb1
                                                              • Opcode Fuzzy Hash: 0b81bd143735dc4d8379e2877338aeb2951d5e936a31113f0685bae5fc3326f2
                                                              • Instruction Fuzzy Hash: 13119330109200FFDB292B64ED4EFAA3B38FF85716F14811AF401950A1E77C8961CA6A
                                                              Function 007A4875 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 376COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 007A1D90: _wcsnicmp.MSVCRT ref: 007A1E14
                                                                • Part of subcall function 0079BC30: wcschr.MSVCRT ref: 0079BCA7
                                                                • Part of subcall function 0079BC30: iswspace.MSVCRT ref: 0079BD1D
                                                                • Part of subcall function 0079BC30: wcschr.MSVCRT ref: 0079BD39
                                                                • Part of subcall function 0079BC30: wcschr.MSVCRT ref: 0079BD5D
                                                                • Part of subcall function 007A4BAF: _wcsnicmp.MSVCRT ref: 007A4C1A
                                                                • Part of subcall function 007A4BAF: _wcsnicmp.MSVCRT ref: 007B0B39
                                                              • memset.MSVCRT ref: 007A4975
                                                              • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,-00000001,00000000,-00000001,00000104,00000000,00000001), ref: 007A4ABC
                                                              • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 007A4AF4
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 007A4AFF
                                                              • ??_V@YAXPAX@Z.MSVCRT ref: 007A4B28
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: _wcsnicmpwcschr$ErrorLast$AttributesFileiswspacememset
                                                              • String ID: COPYCMD
                                                              • API String ID: 1068965577-3727491224
                                                              • Opcode ID: 18161a0353144e7156e41d5e668637b2c1bd8afc6ab0c8014738e26ac688c701
                                                              • Instruction ID: 3c3678244c24c9dfef8b44466f3a7b23a82d7216e5d0100a340fedda8444d3fa
                                                              • Opcode Fuzzy Hash: 18161a0353144e7156e41d5e668637b2c1bd8afc6ab0c8014738e26ac688c701
                                                              • Instruction Fuzzy Hash: 8DD1D535A00215DBCB28DF68DC95BABB3F1EFD9300F558669D806D7281EA78ED41CB90
                                                              Function 0079DC60 Relevance: 3.0, APIs: 2, Instructions: 41memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,00000000,00798E86,00798E5A,00000000), ref: 0079DC98
                                                              • RtlFreeHeap.NTDLL(00000000), ref: 0079DC9F
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: Heap$FreeProcess
                                                              • String ID:
                                                              • API String ID: 3859560861-0
                                                              • Opcode ID: b0e33556f3e53b45a8e38d4127a84d105214399a45e6b85736d916fff859027e
                                                              • Instruction ID: 3c4b50b3e5ef94df9eb19878407bcf8e7f338163498b8adbacbb322ba70096a4
                                                              • Opcode Fuzzy Hash: b0e33556f3e53b45a8e38d4127a84d105214399a45e6b85736d916fff859027e
                                                              • Instruction Fuzzy Hash: 1FF09672B021119F8F349F64FA84D55777ADBC5722715882EE505D7214D3B99C01C764
                                                              Function 0079E0B0 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 308COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: _wcsicmp$iswspace
                                                              • String ID: =,;$FOR$FOR/?$IF/?$REM$REM/?
                                                              • API String ID: 759518647-875390083
                                                              • Opcode ID: 8f393f735d79e3f4499347bb3aa848997bb2dac8f8e221132bec70945a5b1065
                                                              • Instruction ID: 2c9514f4395c73c9680022e375f7d3bb36f9fae9e85cfe0ed5088f6749a13bae
                                                              • Opcode Fuzzy Hash: 8f393f735d79e3f4499347bb3aa848997bb2dac8f8e221132bec70945a5b1065
                                                              • Instruction Fuzzy Hash: 31A1E871244312EBDF34A769FC1AB7A33B4ABC1714F14852FF502865D2DABC9842C76A
                                                              Function 0079EC2E Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 139COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,007BE590,00002000,?,007D8BF0,00000000,?,?,00798F0D), ref: 0079EC51
                                                              • _wcsicmp.MSVCRT ref: 0079EC77
                                                              • _wcsicmp.MSVCRT ref: 0079EC8D
                                                              • _wcsicmp.MSVCRT ref: 0079ECA3
                                                              • _wcsicmp.MSVCRT ref: 0079ECB9
                                                              • _wcsicmp.MSVCRT ref: 0079ECCF
                                                              • _wcsicmp.MSVCRT ref: 0079ECE5
                                                              • _wcsicmp.MSVCRT ref: 0079ECF7
                                                              • _wcsicmp.MSVCRT ref: 0079ED0D
                                                                • Part of subcall function 00799310: GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,007BE590,?,00002000), ref: 00799342
                                                                • Part of subcall function 00799310: SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00799356
                                                                • Part of subcall function 00799310: FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0(?,?), ref: 0079936A
                                                                • Part of subcall function 00799310: FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 0079937E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: _wcsicmp$Time$File$System$EnvironmentLocalVariable
                                                              • String ID: CMDCMDLINE$CMDEXTVERSION$DATE$ERRORLEVEL$HIGHESTNUMANODENUMBER$RANDOM$TIME
                                                              • API String ID: 2447294730-2301591722
                                                              • Opcode ID: 4ad0e128e610ba096c84cdb08b798c00ba3dc17cdbc28775ca70095dfe070147
                                                              • Instruction ID: f1aecdfc2c8f2b72569c3d35de02842d4f19d911a8467130a025a27f5dac3824
                                                              • Opcode Fuzzy Hash: 4ad0e128e610ba096c84cdb08b798c00ba3dc17cdbc28775ca70095dfe070147
                                                              • Instruction Fuzzy Hash: AE31BA72309602FBAF14A725BC1EB7B276DFB86325B18841AF506D00D1EF9D9501827A
                                                              Function 007B9C2E Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 250COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _wcsupr.MSVCRT ref: 007B9CC8
                                                              • LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000,00000000,?), ref: 007B9D22
                                                              • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 007B9D2A
                                                              • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 007B9D3A
                                                              • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 007B9D50
                                                              • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 007B9D58
                                                              • GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 007B9D68
                                                              • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 007B9D7C
                                                              • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 007B9DDB
                                                              • FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 007B9DE2
                                                              • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,00000001,?), ref: 007B9DF2
                                                              • towupper.MSVCRT ref: 007B9E13
                                                                • Part of subcall function 0079A16C: _close.MSVCRT ref: 0079A19B
                                                              • wcschr.MSVCRT ref: 007B9E6A
                                                              • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 007B9E9B
                                                              • SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 007B9EA9
                                                                • Part of subcall function 0079DD98: _get_osfhandle.MSVCRT ref: 0079DDA3
                                                                • Part of subcall function 0079DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,007AC050), ref: 0079DDAD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: Console$Mode$Handle$BufferFileFlushFreeInputLocalType_close_get_osfhandle_wcsuprtowupperwcschr
                                                              • String ID: <noalias>$CMD.EXE
                                                              • API String ID: 2015057810-1690691951
                                                              • Opcode ID: 8dd203fdd5ee700719296328b423d28288fc484fda6bf0aee966f61cdce9423a
                                                              • Instruction ID: 4aa26d3154edac9bc75a6cff647bc37b68b4409d079ce9645581b09f70c58134
                                                              • Opcode Fuzzy Hash: 8dd203fdd5ee700719296328b423d28288fc484fda6bf0aee966f61cdce9423a
                                                              • Instruction Fuzzy Hash: 0B810672A01214ABCF149BB4EC48BEEBBB9AF45710F14411EFA12E7290EB7D9D01C765
                                                              Function 007B2859 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 165windowthreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001200,00000000,?,00000400,?,00000100,00000000,?,?,?), ref: 007B2931
                                                              • GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?), ref: 007B2998
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: CurrentFormatMessageThread
                                                              • String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $P3y$ReturnHr$[%hs(%hs)]$[%hs]
                                                              • API String ID: 2411632146-4147659618
                                                              • Opcode ID: 6962cd4387bac5cf88b5bae747e72befeb0615d596979c0e145d3aa0e846492e
                                                              • Instruction ID: 96f9acbf40b3b2c9f94cfdb14aad784d377812e86337e2a850dd9f822c98850b
                                                              • Opcode Fuzzy Hash: 6962cd4387bac5cf88b5bae747e72befeb0615d596979c0e145d3aa0e846492e
                                                              • Instruction Fuzzy Hash: 205106B1601304FBDF316B699C09FA7B7B9EF44B00F00855DF55AA2162D67DEA81CB21
                                                              Function 007A00E9 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 169COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • memset.MSVCRT ref: 007A011A
                                                                • Part of subcall function 0079E3F0: memset.MSVCRT ref: 0079E455
                                                              • GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,?,?,-00000001,?,?,00000000), ref: 007A0156
                                                                • Part of subcall function 0079EC2E: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,007BE590,00002000,?,007D8BF0,00000000,?,?,00798F0D), ref: 0079EC51
                                                                • Part of subcall function 0079EC2E: _wcsicmp.MSVCRT ref: 0079EC77
                                                                • Part of subcall function 0079EC2E: _wcsicmp.MSVCRT ref: 0079EC8D
                                                                • Part of subcall function 0079EC2E: _wcsicmp.MSVCRT ref: 0079ECA3
                                                                • Part of subcall function 0079EC2E: _wcsicmp.MSVCRT ref: 0079ECB9
                                                                • Part of subcall function 0079EC2E: _wcsicmp.MSVCRT ref: 0079ECCF
                                                                • Part of subcall function 0079EC2E: _wcsicmp.MSVCRT ref: 0079ECE5
                                                                • Part of subcall function 0079EC2E: _wcsicmp.MSVCRT ref: 0079ECF7
                                                                • Part of subcall function 0079EC2E: _wcsicmp.MSVCRT ref: 0079ED0D
                                                              • ??_V@YAXPAX@Z.MSVCRT ref: 007A01DB
                                                              • exit.MSVCRT ref: 007AE621
                                                              • _wcsupr.MSVCRT ref: 007AE683
                                                              • _wcsicmp.MSVCRT ref: 007AE71A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: _wcsicmp$memset$EnvironmentFileModuleNameVariable_wcsuprexit
                                                              • String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
                                                              • API String ID: 2336066422-4197029667
                                                              • Opcode ID: d9b43aec2c70efbc8b134f5e11735143d8aa9f22f127d14d5172cf73f50b42c4
                                                              • Instruction ID: 650965f7239d077c0f7a69ebf6af1a78fad0b3e53530b6360c66d25faa2a7b1a
                                                              • Opcode Fuzzy Hash: d9b43aec2c70efbc8b134f5e11735143d8aa9f22f127d14d5172cf73f50b42c4
                                                              • Instruction Fuzzy Hash: F551E671B0021A9BDF18EB60DC596FE7365AF92304F144A69E802A7281EF7CDE428795
                                                              Function 007A3065 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 152COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: _errnoiswdigit$iswalphawcschrwcstolwcstoul
                                                              • String ID: +-~!$/z$/z
                                                              • API String ID: 2191331888-2265454683
                                                              • Opcode ID: 751ad056b772a95388f71180d6b27628c2e9829d5e3546a3334ba183d98d142a
                                                              • Instruction ID: ce6467cdc294311d92e85e07048df463edbc35030173327a874c765886be50c8
                                                              • Opcode Fuzzy Hash: 751ad056b772a95388f71180d6b27628c2e9829d5e3546a3334ba183d98d142a
                                                              • Instruction Fuzzy Hash: DD517D71500609EBCB04DF64E8499EB37B6FF86360B148226FC169B150EBBC9B05DBA1
                                                              Function 0079BC30 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: wcschr$iswspace
                                                              • String ID: =,;
                                                              • API String ID: 3458554142-1539845467
                                                              • Opcode ID: f3d15c27af5db4e2f1922cb0eb27e67b3abf91f53a3c99989a41295591ac6d6a
                                                              • Instruction ID: b6a3aed9807651ba56b90d6472f001dea47492df6652eede69b9acdb1fd006d4
                                                              • Opcode Fuzzy Hash: f3d15c27af5db4e2f1922cb0eb27e67b3abf91f53a3c99989a41295591ac6d6a
                                                              • Instruction Fuzzy Hash: DE81B0B5A00215DBDF309F64FE457BA73B6AF50305F1444AAED4AA7240EB7C8D84CB61
                                                              Function 007B64DB Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 128registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,007BCD00,00000018,?,?,007ABFD6), ref: 007B650F
                                                              • RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,00000000,00000000,00000001,?,00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,007BCD00), ref: 007B6545
                                                              • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,007BCD00,00000018,?,?,007ABFD6), ref: 007B6553
                                                              • RegDeleteKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,007BCD00,00000018,?,?,007ABFD6), ref: 007B6590
                                                              • RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?,?,?,00000000,00000000,007BCD00,00000018,?,?,007ABFD6), ref: 007B65AD
                                                              • RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,007920B8,?,00000000,02000000,?,?,?,00000000,00000000,007BCD00,00000018,?,?,007ABFD6), ref: 007B65D4
                                                              • RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?,?,?,00000000,00000000,007BCD00,00000018,?,?,007ABFD6), ref: 007B65EF
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: CloseDeleteValue$CreateOpen
                                                              • String ID: %s=%s$p~u
                                                              • API String ID: 1019019434-3637927334
                                                              • Opcode ID: 5e1b829aa13585fc2f2bc31a38cfa1af41826cac00d2f797ad483c4fd3ca2d76
                                                              • Instruction ID: 68b910a9faab57f2fcfa873a5d84e0b83857ae0ec0c1b0464f5b27df079de2dd
                                                              • Opcode Fuzzy Hash: 5e1b829aa13585fc2f2bc31a38cfa1af41826cac00d2f797ad483c4fd3ca2d76
                                                              • Instruction Fuzzy Hash: 9D41BCB2901225ABDF31AB559C09FEF7B78FFC9B50B00411AF905A6290D62E5E11CAA4
                                                              Function 0079C897 Relevance: 15.1, APIs: 10, Instructions: 119fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,00000001,007CA7F0,00000000,?,00000200), ref: 0079C818
                                                              • wcschr.MSVCRT ref: 0079C882
                                                              • _get_osfhandle.MSVCRT ref: 0079C8BA
                                                              • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0079C8C4
                                                              • _get_osfhandle.MSVCRT ref: 0079C8DB
                                                              • GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0079C8ED
                                                              • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000000,00000001), ref: 0079C90D
                                                              • AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(007D8E04), ref: 0079C91E
                                                              • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,007CA7F0,00000200,00000000,00000000), ref: 0079C934
                                                              • ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(007D8E04), ref: 0079C941
                                                              • _get_osfhandle.MSVCRT ref: 0079CAC4
                                                              • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0079CACE
                                                              • memcmp.MSVCRT ref: 007AD16E
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: File$Pointer_get_osfhandle$LockShared$AcquireByteCharMultiReadReleaseTypeWidememcmpwcschr
                                                              • String ID:
                                                              • API String ID: 1383533039-0
                                                              • Opcode ID: 2896b7ccfa0769f68fd998d7094243e283f583e74c472d3e8b522efc7f8e763f
                                                              • Instruction ID: 10673a027fd36e6fcc2f04d4d238cbc8d60764dffd96c144eb531d94115ceaff
                                                              • Opcode Fuzzy Hash: 2896b7ccfa0769f68fd998d7094243e283f583e74c472d3e8b522efc7f8e763f
                                                              • Instruction Fuzzy Hash: FF4137709013189BEF318F14EC89BA93776BB84310F5841AEF00A93190DB7D4D91CF5A
                                                              Function 007A0444 Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 97COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: _wcsicmp
                                                              • String ID: CMDEXTVERSION$DEFINED$ERRORLEVEL$EXIST$NOT
                                                              • API String ID: 2081463915-1668778490
                                                              • Opcode ID: ddfb1e94febc981f62a13c29f1964e61fd7f81868a55fc5090a2d8c53be2ea50
                                                              • Instruction ID: cf35e2f5c6712c369c3d3613dd65b7b513849e670c6110ec5f32fcad8035af12
                                                              • Opcode Fuzzy Hash: ddfb1e94febc981f62a13c29f1964e61fd7f81868a55fc5090a2d8c53be2ea50
                                                              • Instruction Fuzzy Hash: F221BCB1605345AAEF282B75BC1AB3A67D8EBC6354F244E1FE042811D1EEFC88108666
                                                              Function 007B6035 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 113libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(NTDLL.DLL,00000000,00000000,?,00000000,?), ref: 007B6069
                                                              • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,NtQueryInformationProcess), ref: 007B607E
                                                              • ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000480,?), ref: 007B60DC
                                                              • ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000004,00000000), ref: 007B6128
                                                              • ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000002,00000000), ref: 007B614F
                                                              • ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,00000000,?,00000002,00000000), ref: 007B6186
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: MemoryProcessRead$AddressLibraryLoadProc
                                                              • String ID: NTDLL.DLL$NtQueryInformationProcess
                                                              • API String ID: 1580871199-2613899276
                                                              • Opcode ID: d1961062c04aa84f59e1597138b95d8b837c018f268c23a372ad35b4466432cf
                                                              • Instruction ID: cf41ba095b311cf2da266fefd0fb7d77f8e61de816c73e289ba0f7513f3c6f8c
                                                              • Opcode Fuzzy Hash: d1961062c04aa84f59e1597138b95d8b837c018f268c23a372ad35b4466432cf
                                                              • Instruction Fuzzy Hash: BC4158B0A0121DABDB209B15DC89FBB777CEB41744F0080A5E705E3181EB7C9E45CB69
                                                              Function 0079802C Relevance: 13.7, APIs: 9, Instructions: 175COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • memset.MSVCRT ref: 00798060
                                                                • Part of subcall function 0079E3F0: memset.MSVCRT ref: 0079E455
                                                              • ??_V@YAXPAX@Z.MSVCRT ref: 007981BE
                                                                • Part of subcall function 0079DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0079ACD8,00000001,?,00000000,00798C23,-00000105,007BC9B0,00000240,007A1E92,00000000,00000000,007AACE0,00000000), ref: 0079DCE1
                                                                • Part of subcall function 0079DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0079ACD8,00000001,?,00000000,00798C23,-00000105,007BC9B0,00000240,007A1E92,00000000,00000000,007AACE0,00000000,00000000), ref: 0079DCE8
                                                              • GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00000000,-00000001,00000000,?,00000000), ref: 0079818C
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00798197
                                                              • longjmp.MSVCRT(007D0A30,00000001,-00000001,00000000,?,00000000), ref: 007AB09E
                                                              • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,007B7FC9,?,007B99AE,00000000,?,00000000,007ACF94,00000000,?), ref: 007AB0AB
                                                              • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,007B7FC9,?,007B99AE,00000000,?,00000000,007ACF94,00000000,?), ref: 007AB0C1
                                                              • fprintf.MSVCRT ref: 007AB0D5
                                                              • fflush.MSVCRT ref: 007AB0E3
                                                                • Part of subcall function 00798F21: _wcsicmp.MSVCRT ref: 00798FCD
                                                                • Part of subcall function 00798F21: _wcsicmp.MSVCRT ref: 00798FE3
                                                                • Part of subcall function 00798F21: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00799002
                                                                • Part of subcall function 00798F21: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00799013
                                                                • Part of subcall function 00798E9E: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,007D8BF0,00000000,?), ref: 00798EC3
                                                                • Part of subcall function 007A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D3A
                                                                • Part of subcall function 007A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D44
                                                                • Part of subcall function 007A1CD5: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D57
                                                                • Part of subcall function 007A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D61
                                                                • Part of subcall function 007A01F5: wcsrchr.MSVCRT ref: 007A01FB
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: Error$Mode$AttributesCriticalFileHeapLastSection_wcsicmpmemset$AllocCurrentDirectoryEnterFullLeaveNamePathProcessfflushfprintflongjmpwcsrchr
                                                              • String ID:
                                                              • API String ID: 3753564779-0
                                                              • Opcode ID: 766c63ff7ccd4848c3756f1e707e0edca2f4f5b6de203a98e0a76d6baccc1f80
                                                              • Instruction ID: feb3f7658c3675e68f2d5af2b74ca2ec14234b462f54685d184bbec44525f0f1
                                                              • Opcode Fuzzy Hash: 766c63ff7ccd4848c3756f1e707e0edca2f4f5b6de203a98e0a76d6baccc1f80
                                                              • Instruction Fuzzy Hash: 3051DE30A00215EBCF24ABB4AC5AB7B77B5FF49310F14452EE506D7292EB3C8981CB56
                                                              Function 007A38D0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 247COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: memset
                                                              • String ID: %s
                                                              • API String ID: 2221118986-3043279178
                                                              • Opcode ID: 26e32f0a5c220bbc6476216ac63ae707c121b6d1b86dbd67d114e11fd372b63f
                                                              • Instruction ID: 5be5e076665c694ff439f5f351dd5997f1cab783d48bf3790daa12e6cdc2fd89
                                                              • Opcode Fuzzy Hash: 26e32f0a5c220bbc6476216ac63ae707c121b6d1b86dbd67d114e11fd372b63f
                                                              • Instruction Fuzzy Hash: 9E917D716093419FEB34DE50D889BABB3E4BFD5304F004A2DF58996190EB3CEA04CB52
                                                              Function 007A3CD0 Relevance: 9.4, APIs: 6, Instructions: 438COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • memset.MSVCRT ref: 007A3D30
                                                                • Part of subcall function 0079E3F0: memset.MSVCRT ref: 0079E455
                                                              • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00000000,?,?,-00000105,?,?,00000000), ref: 007A3E3D
                                                              • ??_V@YAXPAX@Z.MSVCRT ref: 007A3E88
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: memset$FullNamePath
                                                              • String ID:
                                                              • API String ID: 3158150540-0
                                                              • Opcode ID: 349bd937d5f10cac34b31d6a14e4d1071db8093f3a2ceb57ec5fc2b716c4fdba
                                                              • Instruction ID: 2b047c97cc0acb6e0a7e557e30b94f05b5e5046e8c7a068a9594513486a1179b
                                                              • Opcode Fuzzy Hash: 349bd937d5f10cac34b31d6a14e4d1071db8093f3a2ceb57ec5fc2b716c4fdba
                                                              • Instruction Fuzzy Hash: 0A02B635A01115DBCB25DF68DC997B9B3B1FF89310F1882E9E80A97254D738AE82CF54
                                                              Function 0079AD60 Relevance: 9.3, APIs: 6, Instructions: 328COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(?,00000104,BB8C217B,00000001,?), ref: 0079ADB6
                                                                • Part of subcall function 007A5A2E: memset.MSVCRT ref: 007A5A5A
                                                                • Part of subcall function 0079E3F0: memset.MSVCRT ref: 0079E455
                                                              • towupper.MSVCRT ref: 0079B0E3
                                                                • Part of subcall function 0079E950: memset.MSVCRT ref: 0079E9A0
                                                                • Part of subcall function 0079E950: wcschr.MSVCRT ref: 0079E9FC
                                                                • Part of subcall function 0079E950: wcschr.MSVCRT ref: 0079EA14
                                                                • Part of subcall function 0079E950: _wcsicmp.MSVCRT ref: 0079EA80
                                                              • wcschr.MSVCRT ref: 0079AED2
                                                              • wcsncmp.MSVCRT(00000000,007922A8,00000004,00000002,00007FE7), ref: 0079B016
                                                                • Part of subcall function 0079BC30: wcschr.MSVCRT ref: 0079BCA7
                                                                • Part of subcall function 0079BC30: iswspace.MSVCRT ref: 0079BD1D
                                                                • Part of subcall function 0079BC30: wcschr.MSVCRT ref: 0079BD39
                                                                • Part of subcall function 0079BC30: wcschr.MSVCRT ref: 0079BD5D
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00007FE7), ref: 007ACC6C
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 007ACCCB
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: wcschr$memset$ErrorLast$ConsoleTitle_wcsicmpiswspacetowupperwcsncmp
                                                              • String ID:
                                                              • API String ID: 4198873954-0
                                                              • Opcode ID: 08ef65c2d8b97126be5591dceacb022b8015fd0ce4e4fcb457b53ff2be5f1bb1
                                                              • Instruction ID: d38546a33c613faa45d82301b02f19c5581eec52453e20644690d3d105a8e56d
                                                              • Opcode Fuzzy Hash: 08ef65c2d8b97126be5591dceacb022b8015fd0ce4e4fcb457b53ff2be5f1bb1
                                                              • Instruction Fuzzy Hash: 64B18871A01215E7CF24AB28FD897BA7372EF81300F144669E90A97291EB3CDD45C7E6
                                                              Function 00795020 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • memset.MSVCRT ref: 00795074
                                                                • Part of subcall function 0079E3F0: memset.MSVCRT ref: 0079E455
                                                              • ??_V@YAXPAX@Z.MSVCRT ref: 0079515F
                                                                • Part of subcall function 0079BC30: wcschr.MSVCRT ref: 0079BCA7
                                                                • Part of subcall function 0079BC30: iswspace.MSVCRT ref: 0079BD1D
                                                                • Part of subcall function 0079BC30: wcschr.MSVCRT ref: 0079BD39
                                                                • Part of subcall function 0079BC30: wcschr.MSVCRT ref: 0079BD5D
                                                              • iswspace.MSVCRT ref: 007A9289
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: wcschr$iswspacememset
                                                              • String ID: %s
                                                              • API String ID: 2220997661-3043279178
                                                              • Opcode ID: 5249a8f2ac364e334e25471a6888652b3a5cc1d8ee9791633ff7429cc6724137
                                                              • Instruction ID: c96a3b17d93e8d39e99a285b71b2ab28fe5a934b85aa4117c0fd53c8527b74b0
                                                              • Opcode Fuzzy Hash: 5249a8f2ac364e334e25471a6888652b3a5cc1d8ee9791633ff7429cc6724137
                                                              • Instruction Fuzzy Hash: 62510471A00126ABCF24DF68A84667AB3F5FF99310F24416EE945D7280EB389D41CB95
                                                              Function 007B70D6 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • RtlCreateUnicodeStringFromAsciiz.NTDLL(?,?), ref: 007B7121
                                                              • GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(00000040,00000000), ref: 007B7197
                                                              • GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?), ref: 007B71FF
                                                              Strings
                                                              • %WINDOWS_COPYRIGHT%, xrefs: 007B7107
                                                              • Copyright (c) Microsoft Corporation. All rights reserved., xrefs: 007B70EE
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: Global$AllocAsciizCreateFreeFromStringUnicode
                                                              • String ID: %WINDOWS_COPYRIGHT%$Copyright (c) Microsoft Corporation. All rights reserved.
                                                              • API String ID: 1103618819-4062316587
                                                              • Opcode ID: a1f5218e881d4fdf9b2caf80a5fc72e710d416933ecb82101065caf886103bec
                                                              • Instruction ID: 251311aecb30dcef6dce02a04c7883a8ff8b484bab145394346d7027e6057ee2
                                                              • Opcode Fuzzy Hash: a1f5218e881d4fdf9b2caf80a5fc72e710d416933ecb82101065caf886103bec
                                                              • Instruction Fuzzy Hash: C141D535A0121D8BCB24DFA898517FA73B1BFC8740F68406AE941EB390EA699D42C360
                                                              Function 0079FCE9 Relevance: 7.8, APIs: 5, Instructions: 297COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • memset.MSVCRT ref: 0079FD3A
                                                              • wcsspn.MSVCRT ref: 0079FF18
                                                              • ??_V@YAXPAX@Z.MSVCRT ref: 007A000F
                                                                • Part of subcall function 007A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D3A
                                                                • Part of subcall function 007A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D44
                                                                • Part of subcall function 007A1CD5: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D57
                                                                • Part of subcall function 007A1CD5: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D61
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$FullNamePathmemsetwcsspn
                                                              • String ID:
                                                              • API String ID: 1535828850-0
                                                              • Opcode ID: 3509ad635389108d811387fae65eb41a7d26a2ddb72f102cb37748591a634a4b
                                                              • Instruction ID: 97828f1d8a9f1ed78bd216f05f7e8fddada357a506ab2b9c2246313c549f8f8d
                                                              • Opcode Fuzzy Hash: 3509ad635389108d811387fae65eb41a7d26a2ddb72f102cb37748591a634a4b
                                                              • Instruction Fuzzy Hash: 04C19071A01215CFDB24DF18D894BA9B7B6FF85304F5482AED40A9B351EB389E81CF44
                                                              Function 007B94E0 Relevance: 7.6, APIs: 5, Instructions: 102fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _get_osfhandle.MSVCRT ref: 007B9527
                                                              • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 007B952F
                                                              • _get_osfhandle.MSVCRT ref: 007B95B5
                                                              • SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 007B95BD
                                                                • Part of subcall function 007B8C50: longjmp.MSVCRT(007D0A70,00000001,0079206C,00795E68,?,?,?,?,00000000), ref: 007B8CC4
                                                                • Part of subcall function 007B8C50: memset.MSVCRT ref: 007B8D1D
                                                                • Part of subcall function 007B8C50: memset.MSVCRT ref: 007B8D45
                                                                • Part of subcall function 007B8C50: memset.MSVCRT ref: 007B8D6D
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 007B95CC
                                                                • Part of subcall function 0079A16C: _close.MSVCRT ref: 0079A19B
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: memset$File_get_osfhandle$ErrorLastPointerRead_closelongjmp
                                                              • String ID:
                                                              • API String ID: 288106245-0
                                                              • Opcode ID: d734f4fb15f7b9277fbeef375f1035da346961d616536bcb3f31f4a29bde14f3
                                                              • Instruction ID: efd0abd7799106530504ab6aa07823d6c901c2178140b1a0cfd649bd2270b34e
                                                              • Opcode Fuzzy Hash: d734f4fb15f7b9277fbeef375f1035da346961d616536bcb3f31f4a29bde14f3
                                                              • Instruction Fuzzy Hash: 51318171A10104AFEF29AF74D849BAE7779EF84311F20812AE712D61C1EA7CDE418B60
                                                              Function 007A4CA0 Relevance: 7.6, APIs: 5, Instructions: 98fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _get_osfhandle.MSVCRT ref: 007A4CC2
                                                              • ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,007B8FB3,?,00000000,?,?,?,?,?,?,?,00000000,?,00000021,00000000,?), ref: 007A4CCA
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 007B0BFC
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 007B0C48
                                                              • DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 007B0C71
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: ErrorFileLast$DeleteRead_get_osfhandle
                                                              • String ID:
                                                              • API String ID: 3588551418-0
                                                              • Opcode ID: 519feb56541938dcc14dce07088b51667ef3da97c2d78e69eb611c6ccae3e4b4
                                                              • Instruction ID: 26228f6d2ef0c7ee098b6a4d2146180301fcce9f3a1f3bf0abee0043df9f76cf
                                                              • Opcode Fuzzy Hash: 519feb56541938dcc14dce07088b51667ef3da97c2d78e69eb611c6ccae3e4b4
                                                              • Instruction Fuzzy Hash: 8931AD31601104EFDB189F24D889ABF7BAAFFC5314B20852AE902D3251DB7EDC40DBA5
                                                              Function 007A70F5 Relevance: 7.6, APIs: 5, Instructions: 50timethreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(00000000), ref: 007A7122
                                                              • GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 007A7131
                                                              • GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 007A713A
                                                              • GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 007A7143
                                                              • QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?), ref: 007A7158
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                              • String ID:
                                                              • API String ID: 1445889803-0
                                                              • Opcode ID: 892c38469df74b204ac613aed125352e93d9e50168564261804dfcb4f1bfbf2d
                                                              • Instruction ID: 2c752da6b98d875d54434dd9eb1336523a313d96a0d0dcfe444a0c28cc142da0
                                                              • Opcode Fuzzy Hash: 892c38469df74b204ac613aed125352e93d9e50168564261804dfcb4f1bfbf2d
                                                              • Instruction Fuzzy Hash: 17111C71D05208EBCB14DBB9D948A9EB7F5FF98315F618966E401E7250E7389B00CB46
                                                              Function 007B4840 Relevance: 7.5, APIs: 5, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,007A87E5,00000000,?,00794A0A), ref: 007B484A
                                                                • Part of subcall function 0079DD98: _get_osfhandle.MSVCRT ref: 0079DDA3
                                                                • Part of subcall function 0079DD98: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,007AC050), ref: 0079DDAD
                                                              • FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,007A87E5,00000000,?,00794A0A), ref: 007B4879
                                                              • _getch.MSVCRT ref: 007B487F
                                                              • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,007A87E5,00000000,?,00794A0A), ref: 007B4897
                                                              • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,007A87E5,00000000,?,00794A0A), ref: 007B48AD
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: CriticalSection$BufferConsoleEnterFileFlushHandleInputLeaveType_get_osfhandle_getch
                                                              • String ID:
                                                              • API String ID: 491502236-0
                                                              • Opcode ID: 9116ef30f41d4a083dc6738b78d467392d019dd0bc21fd9f37d4b2515c5f8c16
                                                              • Instruction ID: 4617862d459519e26d32d5e60406492b850faea3595b8e5b59fa4acf02530505
                                                              • Opcode Fuzzy Hash: 9116ef30f41d4a083dc6738b78d467392d019dd0bc21fd9f37d4b2515c5f8c16
                                                              • Instruction Fuzzy Hash: 8101D431101354FFEB146BA1AC0EFAE3B75EF41720F10811AF905961A2DBBD9940CA59
                                                              Function 00796488 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 296COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00796513: memset.MSVCRT ref: 00796593
                                                                • Part of subcall function 0079DC60: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,00000000,00798E86,00798E5A,00000000), ref: 0079DC98
                                                                • Part of subcall function 0079DC60: RtlFreeHeap.NTDLL(00000000), ref: 0079DC9F
                                                              • memset.MSVCRT ref: 007AA097
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: Heapmemset$FreeProcess
                                                              • String ID: *.*
                                                              • API String ID: 1291122668-438819550
                                                              • Opcode ID: 9e6466c33242729514020b1c0ee7382a7407dc61cc38274f9166d65d1f51653a
                                                              • Instruction ID: 7caebb8309f6f0551c5d8f96a12e0e1474f1bae3c351aa51242cc2e67e7c4e37
                                                              • Opcode Fuzzy Hash: 9e6466c33242729514020b1c0ee7382a7407dc61cc38274f9166d65d1f51653a
                                                              • Instruction Fuzzy Hash: 53B1D071D00209EFCF24EFA4D945AAEBBB1FF9A300F154259E805AB241E739DD51CB91
                                                              Function 0079CCD0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 178COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: GeToken: (%x) '%s'$Ungetting: '%s'
                                                              • API String ID: 0-1704545398
                                                              • Opcode ID: 5c3d02347c963fb3370d22a880a69982bb3f9661bccd8356baacaee9b3cd619a
                                                              • Instruction ID: 24436e724ff64b9a31beed12a93177672ece843e1cebbb8427b6f5cc85442f05
                                                              • Opcode Fuzzy Hash: 5c3d02347c963fb3370d22a880a69982bb3f9661bccd8356baacaee9b3cd619a
                                                              • Instruction Fuzzy Hash: 3D513631B0010197DF26AB28F84A77A77B2FB91754F54813AE80787291EBBD9C40C7A1
                                                              Function 007B38F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(kernelbase.dll), ref: 007B38FB
                                                              • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,RaiseFailFastException), ref: 007B3907
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: AddressHandleModuleProc
                                                              • String ID: RaiseFailFastException$kernelbase.dll
                                                              • API String ID: 1646373207-919018592
                                                              • Opcode ID: 5068408e0e594684ebc0ca2c693f58da2e363464348a36eea2b086d9c70407fa
                                                              • Instruction ID: 616f9d6764c5d0f9e7c2c85c1f3d4bf0eab1620cbec3026ede85a7ec25450eda
                                                              • Opcode Fuzzy Hash: 5068408e0e594684ebc0ca2c693f58da2e363464348a36eea2b086d9c70407fa
                                                              • Instruction Fuzzy Hash: DFE0EC72541629BB8F211FA5EC0DC9BBF39EB447A17058122F909961608A7A8910DAA5
                                                              Function 007A1CD5 Relevance: 6.1, APIs: 4, Instructions: 118COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D3A
                                                              • SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D44
                                                              • GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D57
                                                              • SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,007980F4,00000000,00000000,-00000001,00000000,?,00000000), ref: 007A1D61
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$FullNamePath
                                                              • String ID:
                                                              • API String ID: 268959451-0
                                                              • Opcode ID: 1c06bfc011814631876adcbb8ffaac4eaad979283140beda582c96e119a87887
                                                              • Instruction ID: 3de61a25de7d4170c412196e7e414c1d0f9e99eba495b39959eb08abf809c1bd
                                                              • Opcode Fuzzy Hash: 1c06bfc011814631876adcbb8ffaac4eaad979283140beda582c96e119a87887
                                                              • Instruction Fuzzy Hash: 6E311D39200101EBDB28DFA8C85597BB7B5EFC5304B68CA1DE906C7251E7B9AD41C754
                                                              Function 0079C570 Relevance: 6.1, APIs: 4, Instructions: 101memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0079C5BD
                                                              • RtlFreeHeap.NTDLL(00000000), ref: 0079C5C4
                                                              • _setjmp3.MSVCRT ref: 0079C630
                                                              • VirtualFree.API-MS-WIN-CORE-MEMORY-L1-1-0(?,00000000,00008000,00000000,00000000,00000000,00000000,00000000), ref: 0079C69D
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: FreeHeap$ProcessVirtual_setjmp3
                                                              • String ID:
                                                              • API String ID: 2613391085-0
                                                              • Opcode ID: 1931ebd011e8553b71fe49fcf8716a807c210095f69b34fee0da1997a45e767d
                                                              • Instruction ID: 26df37d63883f2dcc45aba67d418581aa1c2bf804cca773548e94e0ed3917a3c
                                                              • Opcode Fuzzy Hash: 1931ebd011e8553b71fe49fcf8716a807c210095f69b34fee0da1997a45e767d
                                                              • Instruction Fuzzy Hash: AF31AB70A002009BDF12DF28B985B2A7BB4FB48704F21846EE809C7250E77C9C50CBA9
                                                              Function 007A4C40 Relevance: 6.1, APIs: 4, Instructions: 68COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d401ff1075b9e152ed8a9902c421ed953c6b65b9949b472eab69e51ccf68797f
                                                              • Instruction ID: 064aa6b6599805fe184a3cd07f738004616632b1a21c905bc31f52a8ea134c2e
                                                              • Opcode Fuzzy Hash: d401ff1075b9e152ed8a9902c421ed953c6b65b9949b472eab69e51ccf68797f
                                                              • Instruction Fuzzy Hash: B811BFB1202604BADB245B249C99FEF7729EF85324F14811AE802C61D0DBBCDE4187E6
                                                              Function 007B9809 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _get_osfhandle.MSVCRT ref: 007B9822
                                                              • WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,007B92EA,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 007B982A
                                                              • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 007B9841
                                                              • DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 007B986E
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: File$DeleteErrorLastWrite_get_osfhandle
                                                              • String ID:
                                                              • API String ID: 2448200120-0
                                                              • Opcode ID: 642362ff863e9efa1a7acaddfff882fa30a0e10aeb5a5402423903159a5125bc
                                                              • Instruction ID: ef575a09883a8318413299d5234a98c1b28233a14dc22ebf7f9e64d54318be81
                                                              • Opcode Fuzzy Hash: 642362ff863e9efa1a7acaddfff882fa30a0e10aeb5a5402423903159a5125bc
                                                              • Instruction Fuzzy Hash: BB11C131200204FFDF25AB21EC89FBF7769EB85B25F10802EF61582162DA7C9C41CA69
                                                              Function 007B8496 Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,?,?,?,?,?,?,?,?,?,00798A51), ref: 007B84B9
                                                              • GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,00798A51), ref: 007B84C6
                                                              • FillConsoleOutputAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00798A51), ref: 007B84EA
                                                              • SetConsoleTextAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,00798A51), ref: 007B84F2
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: Console$Attribute$BufferFillHandleInfoOutputScreenText
                                                              • String ID:
                                                              • API String ID: 1033415088-0
                                                              • Opcode ID: 8dfe87dddcfa25f86c8e6b612b78c1aa47609e90d2e5a522a4c120eb898e367b
                                                              • Instruction ID: 313e65a38d9b1ed75c567c595370204ee83087bc22dd2171855ba7542e0ee179
                                                              • Opcode Fuzzy Hash: 8dfe87dddcfa25f86c8e6b612b78c1aa47609e90d2e5a522a4c120eb898e367b
                                                              • Instruction Fuzzy Hash: EC014471A01159AF8B049F749C84EFFB7FCFF0D310B10412AF516D2150EA289D05C769
                                                              Function 007B24F6 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,007B22F8), ref: 007B2514
                                                              • RtlFreeHeap.NTDLL(00000000,?,?), ref: 007B251B
                                                              • GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,007B22F8), ref: 007B2539
                                                              • RtlFreeHeap.NTDLL(00000000), ref: 007B2540
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: Heap$FreeProcess
                                                              • String ID:
                                                              • API String ID: 3859560861-0
                                                              • Opcode ID: 86e523d1d766025ea50f9a2fed94bc5ae2ce879ac4e81bc07881d1a63f4e7770
                                                              • Instruction ID: b45d73ddf22a307fb10b29625eeaa2ac758829b9ae46332d7b15afda0d63c02a
                                                              • Opcode Fuzzy Hash: 86e523d1d766025ea50f9a2fed94bc5ae2ce879ac4e81bc07881d1a63f4e7770
                                                              • Instruction Fuzzy Hash: 71F06272611211BFD7249FA0EC89B65B7F8FF48312F10492EE141C6040D779E9A5CBA5
                                                              Function 007A6860 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 007A6F48: GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 007A6F4F
                                                              • __set_app_type.MSVCRT ref: 007A6872
                                                              • __p__fmode.MSVCRT ref: 007A6888
                                                              • __p__commode.MSVCRT ref: 007A6896
                                                              • __setusermatherr.MSVCRT ref: 007A68B7
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
                                                              • String ID:
                                                              • API String ID: 1632413811-0
                                                              • Opcode ID: 1c37eeb2d1357a91d3915713f17bb1222da996116728e9d74d7fada5270c7527
                                                              • Instruction ID: dbdd771161d8e9f47b5ac50c78d5e80090256e6e2f3f5519f7de437bfb7974c5
                                                              • Opcode Fuzzy Hash: 1c37eeb2d1357a91d3915713f17bb1222da996116728e9d74d7fada5270c7527
                                                              • Instruction Fuzzy Hash: F0F0F870505304DFC7286F30FC4EA483BA1BB86321B148B1AF462823E1DB7D9440CA1A
                                                              Function 00799CC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 191COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0079DCD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0079ACD8,00000001,?,00000000,00798C23,-00000105,007BC9B0,00000240,007A1E92,00000000,00000000,007AACE0,00000000), ref: 0079DCE1
                                                                • Part of subcall function 0079DCD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0079ACD8,00000001,?,00000000,00798C23,-00000105,007BC9B0,00000240,007A1E92,00000000,00000000,007AACE0,00000000,00000000), ref: 0079DCE8
                                                                • Part of subcall function 0079A62F: wcschr.MSVCRT ref: 0079A635
                                                                • Part of subcall function 0079C570: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0079C5BD
                                                                • Part of subcall function 0079C570: RtlFreeHeap.NTDLL(00000000), ref: 0079C5C4
                                                                • Part of subcall function 0079C570: _setjmp3.MSVCRT ref: 0079C630
                                                              • _wcsupr.MSVCRT ref: 007AC21F
                                                                • Part of subcall function 007A1A47: memset.MSVCRT ref: 007A1AE2
                                                                • Part of subcall function 007A1A47: ??_V@YAXPAX@Z.MSVCRT ref: 007A1BA4
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000008.00000002.4538576758.0000000000790000.00000040.80000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true
                                                              • Associated: 00000008.00000002.4538576758.00000000007BE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538576758.00000000007DA000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              • Associated: 00000008.00000002.4538782785.00000000007DE000.00000040.80000000.00040000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_8_2_790000_cmd.jbxd
                                                              Similarity
                                                              • API ID: Heap$Process$AllocFree_setjmp3_wcsuprmemsetwcschr
                                                              • String ID: FOR$ IF
                                                              • API String ID: 3818062306-2924197646
                                                              • Opcode ID: a3f5a3d15b34d69ee5e1f324f3e225c0f68042adf849db2761dad312728e4a6a
                                                              • Instruction ID: e0f45b0255f260767ce00df424be55db58cd79456b574f5084fff3553912f31c
                                                              • Opcode Fuzzy Hash: a3f5a3d15b34d69ee5e1f324f3e225c0f68042adf849db2761dad312728e4a6a
                                                              • Instruction Fuzzy Hash: 74513A21700502A6EF366B7CE89577732A6EFD2714B584129DA06CB3D4FB6EDD41C390