Windows Analysis Report
ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe

Overview

General Information

Sample name: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Analysis ID: 1528229
MD5: acdb58c5abad0535de184d32c04c75a5
SHA1: 7323524e5f90cbc698ce33f2bdd00e62c3694943
SHA256: 61460220761a54e3263ca427e082c7542bd531ed5c2aae397757be3cb313bb74
Tags: exeuser-lowmal3
Infos:

Detection

Snake Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected Snake Keylogger
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates processes with suspicious names
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Found malware configuration
Source: 00000003.00000002.4107406678.0000000000402000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "6783395654:AAGHZk1wugh441q673h1nDNWiVYW4p6ewXc", "Chat_id": "-4209622687", "Version": "5.1"}
Multi AV Scanner detection for submitted file
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe ReversingLabs: Detection: 39%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org
Uses 32bit PE files
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: aGZb.pdbSHA256 source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Source: Binary string: aGZb.pdb source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 07238A61h 0_2_072380DE
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 0118F20Eh 3_2_0118F01F
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 0118FB98h 3_2_0118F01F
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 3_2_0118E540
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 3_2_0118EB73
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 3_2_0118ED54
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05767C4Dh 3_2_05767910
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05760FF1h 3_2_05760D48
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05766049h 3_2_05765DA0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05764EE9h 3_2_05764C40
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05766EB1h 3_2_05766C08
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05765799h 3_2_057654F0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05767761h 3_2_057674B8
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05760741h 3_2_05760498
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05764A91h 3_2_057647E8
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05766A59h 3_2_057667B0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05765BF1h 3_2_05765948
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05767309h 3_2_05767060
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 057602E9h 3_2_05760040
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05760B99h 3_2_057608F0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05765341h 3_2_05765098
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 05764611h 3_2_05764368
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 4x nop then jmp 057664CBh 3_2_05766220

Networking
barindex
Yara detected Generic Downloader
Source: Yara match File source: 3.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, type: UNPACKEDPE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 132.226.247.73 132.226.247.73
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
May check the online IP address of the machine
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 132.226.247.73:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 132.226.247.73:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49753 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49745 -> 188.114.97.3:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002CE8000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D89000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.com
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002CE8000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D2B000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D89000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002DB2000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002C21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002C21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1716836366.000000000387A000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4107406678.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D89000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D01000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://reallyfreegeoip.org
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1715367720.0000000002869000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002C21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718237504.0000000005940000.00000004.00000020.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718259469.0000000006A12000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002CE8000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D2B000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D89000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1716836366.000000000387A000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002CE8000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4107406678.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002DD1000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D2B000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D89000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002D7B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 3.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 3.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000003.00000002.4107406678.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000003.00000002.4107406678.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1716836366.000000000387A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1716836366.000000000387A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 280, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 280, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 6308, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 6308, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 0_2_0103D55C 0_2_0103D55C
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 0_2_07239350 0_2_07239350
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 0_2_07235530 0_2_07235530
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 0_2_072335A2 0_2_072335A2
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 0_2_072335B0 0_2_072335B0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 0_2_07239341 0_2_07239341
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 0_2_07233168 0_2_07233168
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 0_2_072350E8 0_2_072350E8
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 0_2_072350F8 0_2_072350F8
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 0_2_07232D32 0_2_07232D32
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_01186108 3_2_01186108
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0118C190 3_2_0118C190
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0118F01F 3_2_0118F01F
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0118B328 3_2_0118B328
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0118C470 3_2_0118C470
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_01186730 3_2_01186730
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0118C752 3_2_0118C752
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_01189858 3_2_01189858
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0118BBD2 3_2_0118BBD2
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0118CA32 3_2_0118CA32
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_01184AD9 3_2_01184AD9
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0118BEB0 3_2_0118BEB0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0118E52F 3_2_0118E52F
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0118E540 3_2_0118E540
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_01183572 3_2_01183572
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0118B4F2 3_2_0118B4F2
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576C448 3_2_0576C448
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576A4C0 3_2_0576A4C0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576B7B0 3_2_0576B7B0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05769E78 3_2_05769E78
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576BE00 3_2_0576BE00
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05767EEB 3_2_05767EEB
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576B160 3_2_0576B160
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05767910 3_2_05767910
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057691E0 3_2_057691E0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05769830 3_2_05769830
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576AB10 3_2_0576AB10
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05760D48 3_2_05760D48
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05760D39 3_2_05760D39
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576BDF1 3_2_0576BDF1
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576BDFB 3_2_0576BDFB
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05765DA0 3_2_05765DA0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05765D92 3_2_05765D92
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05764C40 3_2_05764C40
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05764C30 3_2_05764C30
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576C438 3_2_0576C438
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05766C08 3_2_05766C08
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057654F0 3_2_057654F0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057654E2 3_2_057654E2
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576A4B3 3_2_0576A4B3
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057674B8 3_2_057674B8
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057674A8 3_2_057674A8
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05760498 3_2_05760498
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05760488 3_2_05760488
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05767F58 3_2_05767F58
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057647E8 3_2_057647E8
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057647DA 3_2_057647DA
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057667B0 3_2_057667B0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057647B0 3_2_057647B0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057667A0 3_2_057667A0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576B7A0 3_2_0576B7A0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05769E67 3_2_05769E67
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05763600 3_2_05763600
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576B150 3_2_0576B150
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05765948 3_2_05765948
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05765938 3_2_05765938
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05762900 3_2_05762900
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05767900 3_2_05767900
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057691CF 3_2_057691CF
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057611A0 3_2_057611A0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05761191 3_2_05761191
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05767060 3_2_05767060
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05767054 3_2_05767054
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05760040 3_2_05760040
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05769820 3_2_05769820
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05760007 3_2_05760007
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057608F0 3_2_057608F0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_057608E0 3_2_057608E0
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05765098 3_2_05765098
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576508A 3_2_0576508A
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05764368 3_2_05764368
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05764358 3_2_05764358
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_0576AB03 3_2_0576AB03
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05766BF8 3_2_05766BF8
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05766220 3_2_05766220
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 3_2_05766210 3_2_05766210
Sample file is different than original file name gathered from version info
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1715367720.0000000002869000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1719295386.0000000007180000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1713336778.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1718833989.0000000006F4F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePowerShell.EXEj% vs ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1716836366.000000000387A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1716836366.000000000387A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4107691383.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4107406678.0000000000422000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Binary or memory string: OriginalFilenameaGZb.exe8 vs ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Uses 32bit PE files
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 3.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 3.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000003.00000002.4107406678.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000003.00000002.4107406678.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1716836366.000000000387A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1716836366.000000000387A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 280, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 280, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 6308, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 6308, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, -.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, -.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, -.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, -.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, -.cs Base64 encoded string: 'G4pV1kZlzrWG3ii/qsKXSnYs+5NUWVZZLTztKeesew9//zKKMVqxJyBhDWLI4hit'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, -.cs Base64 encoded string: 'G4pV1kZlzrWG3ii/qsKXSnYs+5NUWVZZLTztKeesew9//zKKMVqxJyBhDWLI4hit'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, Eg32AZ3VE7tJNcho4Z.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, Eg32AZ3VE7tJNcho4Z.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, TucfSNeqMt9wmb7xnA.cs Security API names: _0020.SetAccessControl
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, TucfSNeqMt9wmb7xnA.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, TucfSNeqMt9wmb7xnA.cs Security API names: _0020.AddAccessRule
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, TucfSNeqMt9wmb7xnA.cs Security API names: _0020.SetAccessControl
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, TucfSNeqMt9wmb7xnA.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, TucfSNeqMt9wmb7xnA.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@6/6@2/2
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.log Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6984:120:WilError_03
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Mutant created: \Sessions\1\BaseNamedObjects\LmrOTkVcqJhIamEAhoqiBxwN
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_szrs0nhg.lhe.ps1 Jump to behavior
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002E7C000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002E6E000.00000004.00000800.00020000.00000000.sdmp, ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4109948122.0000000002E5E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe ReversingLabs: Detection: 39%
Source: unknown Process created: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe "C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe"
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe"
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process created: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe "C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe" Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process created: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe "C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe" Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: aGZb.pdbSHA256 source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe
Source: Binary string: aGZb.pdb source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, Form1.cs .Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.6ef0000.4.raw.unpack, RZ.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, TucfSNeqMt9wmb7xnA.cs .Net Code: lGn6g61h4T System.Reflection.Assembly.Load(byte[])
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, TucfSNeqMt9wmb7xnA.cs .Net Code: lGn6g61h4T System.Reflection.Assembly.Load(byte[])
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.28449d0.0.raw.unpack, RZ.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Code function: 0_2_0103F530 pushfd ; iretd 0_2_0103F531
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Static PE information: section name: .text entropy: 7.9844464661439245
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, Y5apbQjWegHFdPvvWRl.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'KKIeNApHjS', 'F1heWUKCjg', 'kZyedLRRG8', 'am3eldgTfT', 'ButesOdP14', 'hkLeVQnc11', 'RyQecGLXIB'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, R7kWbK7FD32e16m2uD.cs High entropy of concatenated method names: 'oSlyhHmqqb', 'ITTyR4hPtC', 'Y4gyPN9VLZ', 'BKZyf2topn', 't9wyNLFKPh', 'a51yBKcRUX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, d0OyUnsHiXk6GXSrY1.cs High entropy of concatenated method names: 'AxQviLTwBE', 'Q1Qv40ZpxP', 'VqpvNw7HgY', 'K7avWOiTdE', 'gJIvR5VES9', 'WE6vPfmaZ7', 'nhQvfH7bOX', 'kpIvB0rTWM', 'xBZvwQRF2d', 'xAav0Dc2W1'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, ojvgQiz4fo796QiyxY.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'prF9o0jK1U', 'tD59v1vEGf', 'n8v9xM86UC', 'NA59OjlPWA', 'PGR9yUXrbx', 'SFp991cGdw', 'dJ79eDsrAv'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, y9Ap8UavNRuNPGZkg8.cs High entropy of concatenated method names: 'SYRIjsVxSG', 'DqfInHWOeR', 'xEBIgygu58', 'SNZImpiJCb', 'w5lIJ9Slgc', 'hJnI23MoRF', 'WPsIXbINAM', 'd2UI1ygqQo', 'VWKVgEabpPpkcvXdi0x', 'pvZZBCa6rlUCDKHplCK'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, QloNyZVyoip4Zjrf8N.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'uddYbybVJx', 'py9YA2VdRq', 'LRpYzytes4', 'brxuLQPHWD', 'NnIuMoc1yZ', 'fLNuYNcohO', 'zlKuuSAi4R', 'ua4FEHmpSPBvobvg5Ef'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, gX1kCuMEOYtDh2YCB9.cs High entropy of concatenated method names: 'kVLoZNTCgl', 'Vs6oXrbhmA', 'N3aohSkCPa', 'InIoRN6YDy', 'KkZofHAyMV', 'QOXoB5UBwJ', 'gRUo0wgvam', 'EN9oHdMJRo', 'R2eoiTKvx0', 'VtpoDpNyCU'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, lRhYI0Q82ZS9CQMrvh.cs High entropy of concatenated method names: 'jq2IdYi3CS', 'UmYIlVrEJG', 'jZ7IsKLBbN', 'ToString', 'keVIVV8VP8', 'HrDIcNFdWk', 'tHxQw2adljxv1df1Mc2', 'hBJrjGaLR2tKo9onDaG', 'j3xs0eaOEuP0hRnYNnt'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, Eg32AZ3VE7tJNcho4Z.cs High entropy of concatenated method names: 'yykKNMWGF2', 'oBnKWjDgek', 'KWDKdJVM2n', 'xQPKla8TtZ', 'vAwKspyeZG', 'QhyKVJQpjx', 'aZ5KcNTAv6', 'sJ1KEMBBZh', 'AgmKb8EdSA', 'xemKArm5Yy'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, D3S8ceuBOMQkX3uhsR.cs High entropy of concatenated method names: 'ppeyCcyOgO', 'oMGyKPEgNf', 'I0Xy5kPddV', 'MxAyF4FRqq', 'rlAyI7Dxgk', 'NEWyp6vHo7', 'qYHyTg6qiY', 'jiyyavVeDB', 'sAlyQtyurJ', 'POrytorhKB'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, xfcuZHPI6XjDeysgsY.cs High entropy of concatenated method names: 'mFhpnICB6c', 'ADxpSRAMif', 'obZpgWWMJf', 'xhppmiWbFR', 'ILnpGyHryT', 'jd5pJ4SCNq', 'AIYp2Gmt28', 'MtdpZneuDd', 'SPNpX4lmio', 'LJIp1kOCTa'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, b2LBV0jjYxwqi6oa9Vc.cs High entropy of concatenated method names: 'ToString', 'DIJeu6V1lg', 'rYqe6Kocep', 'K7Ve8VNLn8', 'smbeCfIcQp', 'uZHeKeYcQw', 'c2Ze5UmyEl', 'hmLeFvsPUc', 'w2B8i4y8qP2lZ6iSmEH', 'C8YijayYxYgGbTxHVIi'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, vICAAsbJZCf9L4FA9P.cs High entropy of concatenated method names: 'Dispose', 'r8TMbgURh3', 'KhXYRgCTmF', 'lgxkkuL20Q', 'Iu8MAYmQ3g', 'cnbMzOoXcw', 'ProcessDialogKey', 'zoaYLTUZRp', 'FI3YM3eLj1', 'sLoYYO9TwE'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, XvgdNVGErGfBUMMcmY.cs High entropy of concatenated method names: 'RXoM1KaQioAXWsdpdCL', 'hMKCDJa4ps62B1rrPhV', 'dj5NecaS1ATlU2FIIEJ', 'OvqIyFc9pa', 'GQ1I9crWBt', 'CA8IeQgbEV', 'Q6OQoaaqrBp5Y5Z1tH4', 'llVTfraTwk49B1h1iFg'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, i2uIeu09J2hevpq6Y6.cs High entropy of concatenated method names: 'uctMpSfsee', 'VbaMTJGSST', 'E5MMQAJiWY', 'ysdMtcBAd4', 'RHCMvIZGW9', 'K0IMxMBQpV', 's9G8GAfMgoENF0APSt', 'BKBs0RlrqbvjMAHXZu', 'zgyaXIKxKoOONiqG53', 'uirMMnjB7y'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, eLeLkIZBDCXijV2Xjy.cs High entropy of concatenated method names: 'M7HI8Wdhlv', 'ubTIKfdrR0', 'dWYIFXFXiy', 'kamIpiOFH5', 'hcLITr0ks3', 'SSMFsFyUh0', 'sxhFVPcv5p', 'r9KFcXsHd6', 'NraFEFc64w', 'Kw5FbWY11i'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, K856vDNhK1Rx5nI99Z.cs High entropy of concatenated method names: 'SmcpCCNtUo', 'pCbp5VsxKF', 'IulpIprg1H', 'z7MIAYO8Tv', 'wsKIzsQqdw', 'VMRpLnd7dh', 'pIupMEDLw6', 'kn0pY0uNqL', 'BWdpuUTf80', 'vqmp65mCHO'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, w8B95JyHCrohgEWweo.cs High entropy of concatenated method names: 'WNoFGWlkH4', 'wXDF2tnVwJ', 'UoL5PoRX24', 'l0d5fClMEy', 'fJF5BZfWHc', 'sDA5wbeXIo', 'zKM50Z3WKX', 'HDK5H12f9m', 'Q3Y5372qRT', 'hNe5iKxK3g'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, TucfSNeqMt9wmb7xnA.cs High entropy of concatenated method names: 'uMBu8Rt4oo', 'DvSuCIYfAy', 'aXEuKj40M5', 'TKau5TmJO8', 'BCEuFqA7rC', 'TqWuISq9pa', 'pqNupkbGwt', 'WWZuTvxr4H', 'h5duay3Nk7', 'bUIuQKxrIw'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, mThtq8FQIyVrHQWEh9.cs High entropy of concatenated method names: 'RsTOEOMoT4', 'vuoOA8KJYQ', 'REyyLVdCJK', 'R0NyMTJrtA', 'hZvODeOkYE', 'mPFO4BQ6Sm', 'X21O7aZhU2', 'X32ONu9SiV', 'KO8OWIaYH7', 'YFUOdBBD6A'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, OEWbdXRZoZKorpKpKb.cs High entropy of concatenated method names: 'ToString', 'fKTxD6JKs6', 'GIpxRbiDeL', 'AVFxP7K3Ha', 'a9hxfPP94F', 'WA6xBI2VN3', 'NYixwwdmBH', 'yUdx0RcEFv', 'Bf9xHqwsP7', 'nVcx3dFqro'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, YTxZkKl8MORpMRYJKr.cs High entropy of concatenated method names: 'wWE9Mhfgn4', 'Fq69uBXqgo', 'vYi96pIw8H', 'dat9CECFH0', 'LHV9KbZKh3', 'WQl9FTx2PO', 'kUD9ICD8UC', 'KDhycw6bnf', 'KqTyEmi9LL', 'GTmybLFcS4'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, nZLshlvWFIXMKa6mV6.cs High entropy of concatenated method names: 'DVegThmFo', 'Mg3mP5nKy', 'Df3J8DheE', 'zqx24Wg2F', 'jx7XTtkOD', 'qA71IPnVg', 'Pk3lyw3YA7Mat3IHcH', 'CRJGk3WdJdLIZsCY9P', 'pdGyBZQyi', 'Kd5eUnuVR'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, SNLrwMCKxEMFBjyART.cs High entropy of concatenated method names: 'twK5maAuTj', 'FGo5J8GiHK', 'eMo5ZweHmG', 'UpL5X9uFSy', 'Pqp5vWiP3b', 'Ipd5xw3O0N', 'Fc15OMBHLE', 'Mj65yZb0YQ', 'C8659XJp1O', 'N9y5ev5a37'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.7180000.5.raw.unpack, Yf9VmijcZv3rrdRA9m6.cs High entropy of concatenated method names: 'Pfe9naQrNP', 'S679Se8jls', 'iMb9grZiac', 'Kxe9mBn7Ms', 'kD99G5kSQ3', 'Q9X9Jn4QPB', 'CYG92NvGZC', 'WFV9ZShsrY', 'fDR9XHd6tP', 'DW291QqGFN'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, Y5apbQjWegHFdPvvWRl.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'KKIeNApHjS', 'F1heWUKCjg', 'kZyedLRRG8', 'am3eldgTfT', 'ButesOdP14', 'hkLeVQnc11', 'RyQecGLXIB'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, R7kWbK7FD32e16m2uD.cs High entropy of concatenated method names: 'oSlyhHmqqb', 'ITTyR4hPtC', 'Y4gyPN9VLZ', 'BKZyf2topn', 't9wyNLFKPh', 'a51yBKcRUX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, d0OyUnsHiXk6GXSrY1.cs High entropy of concatenated method names: 'AxQviLTwBE', 'Q1Qv40ZpxP', 'VqpvNw7HgY', 'K7avWOiTdE', 'gJIvR5VES9', 'WE6vPfmaZ7', 'nhQvfH7bOX', 'kpIvB0rTWM', 'xBZvwQRF2d', 'xAav0Dc2W1'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, ojvgQiz4fo796QiyxY.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'prF9o0jK1U', 'tD59v1vEGf', 'n8v9xM86UC', 'NA59OjlPWA', 'PGR9yUXrbx', 'SFp991cGdw', 'dJ79eDsrAv'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, y9Ap8UavNRuNPGZkg8.cs High entropy of concatenated method names: 'SYRIjsVxSG', 'DqfInHWOeR', 'xEBIgygu58', 'SNZImpiJCb', 'w5lIJ9Slgc', 'hJnI23MoRF', 'WPsIXbINAM', 'd2UI1ygqQo', 'VWKVgEabpPpkcvXdi0x', 'pvZZBCa6rlUCDKHplCK'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, QloNyZVyoip4Zjrf8N.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'uddYbybVJx', 'py9YA2VdRq', 'LRpYzytes4', 'brxuLQPHWD', 'NnIuMoc1yZ', 'fLNuYNcohO', 'zlKuuSAi4R', 'ua4FEHmpSPBvobvg5Ef'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, gX1kCuMEOYtDh2YCB9.cs High entropy of concatenated method names: 'kVLoZNTCgl', 'Vs6oXrbhmA', 'N3aohSkCPa', 'InIoRN6YDy', 'KkZofHAyMV', 'QOXoB5UBwJ', 'gRUo0wgvam', 'EN9oHdMJRo', 'R2eoiTKvx0', 'VtpoDpNyCU'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, lRhYI0Q82ZS9CQMrvh.cs High entropy of concatenated method names: 'jq2IdYi3CS', 'UmYIlVrEJG', 'jZ7IsKLBbN', 'ToString', 'keVIVV8VP8', 'HrDIcNFdWk', 'tHxQw2adljxv1df1Mc2', 'hBJrjGaLR2tKo9onDaG', 'j3xs0eaOEuP0hRnYNnt'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, Eg32AZ3VE7tJNcho4Z.cs High entropy of concatenated method names: 'yykKNMWGF2', 'oBnKWjDgek', 'KWDKdJVM2n', 'xQPKla8TtZ', 'vAwKspyeZG', 'QhyKVJQpjx', 'aZ5KcNTAv6', 'sJ1KEMBBZh', 'AgmKb8EdSA', 'xemKArm5Yy'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, D3S8ceuBOMQkX3uhsR.cs High entropy of concatenated method names: 'ppeyCcyOgO', 'oMGyKPEgNf', 'I0Xy5kPddV', 'MxAyF4FRqq', 'rlAyI7Dxgk', 'NEWyp6vHo7', 'qYHyTg6qiY', 'jiyyavVeDB', 'sAlyQtyurJ', 'POrytorhKB'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, xfcuZHPI6XjDeysgsY.cs High entropy of concatenated method names: 'mFhpnICB6c', 'ADxpSRAMif', 'obZpgWWMJf', 'xhppmiWbFR', 'ILnpGyHryT', 'jd5pJ4SCNq', 'AIYp2Gmt28', 'MtdpZneuDd', 'SPNpX4lmio', 'LJIp1kOCTa'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, b2LBV0jjYxwqi6oa9Vc.cs High entropy of concatenated method names: 'ToString', 'DIJeu6V1lg', 'rYqe6Kocep', 'K7Ve8VNLn8', 'smbeCfIcQp', 'uZHeKeYcQw', 'c2Ze5UmyEl', 'hmLeFvsPUc', 'w2B8i4y8qP2lZ6iSmEH', 'C8YijayYxYgGbTxHVIi'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, vICAAsbJZCf9L4FA9P.cs High entropy of concatenated method names: 'Dispose', 'r8TMbgURh3', 'KhXYRgCTmF', 'lgxkkuL20Q', 'Iu8MAYmQ3g', 'cnbMzOoXcw', 'ProcessDialogKey', 'zoaYLTUZRp', 'FI3YM3eLj1', 'sLoYYO9TwE'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, XvgdNVGErGfBUMMcmY.cs High entropy of concatenated method names: 'RXoM1KaQioAXWsdpdCL', 'hMKCDJa4ps62B1rrPhV', 'dj5NecaS1ATlU2FIIEJ', 'OvqIyFc9pa', 'GQ1I9crWBt', 'CA8IeQgbEV', 'Q6OQoaaqrBp5Y5Z1tH4', 'llVTfraTwk49B1h1iFg'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, i2uIeu09J2hevpq6Y6.cs High entropy of concatenated method names: 'uctMpSfsee', 'VbaMTJGSST', 'E5MMQAJiWY', 'ysdMtcBAd4', 'RHCMvIZGW9', 'K0IMxMBQpV', 's9G8GAfMgoENF0APSt', 'BKBs0RlrqbvjMAHXZu', 'zgyaXIKxKoOONiqG53', 'uirMMnjB7y'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, eLeLkIZBDCXijV2Xjy.cs High entropy of concatenated method names: 'M7HI8Wdhlv', 'ubTIKfdrR0', 'dWYIFXFXiy', 'kamIpiOFH5', 'hcLITr0ks3', 'SSMFsFyUh0', 'sxhFVPcv5p', 'r9KFcXsHd6', 'NraFEFc64w', 'Kw5FbWY11i'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, K856vDNhK1Rx5nI99Z.cs High entropy of concatenated method names: 'SmcpCCNtUo', 'pCbp5VsxKF', 'IulpIprg1H', 'z7MIAYO8Tv', 'wsKIzsQqdw', 'VMRpLnd7dh', 'pIupMEDLw6', 'kn0pY0uNqL', 'BWdpuUTf80', 'vqmp65mCHO'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, w8B95JyHCrohgEWweo.cs High entropy of concatenated method names: 'WNoFGWlkH4', 'wXDF2tnVwJ', 'UoL5PoRX24', 'l0d5fClMEy', 'fJF5BZfWHc', 'sDA5wbeXIo', 'zKM50Z3WKX', 'HDK5H12f9m', 'Q3Y5372qRT', 'hNe5iKxK3g'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, TucfSNeqMt9wmb7xnA.cs High entropy of concatenated method names: 'uMBu8Rt4oo', 'DvSuCIYfAy', 'aXEuKj40M5', 'TKau5TmJO8', 'BCEuFqA7rC', 'TqWuISq9pa', 'pqNupkbGwt', 'WWZuTvxr4H', 'h5duay3Nk7', 'bUIuQKxrIw'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, mThtq8FQIyVrHQWEh9.cs High entropy of concatenated method names: 'RsTOEOMoT4', 'vuoOA8KJYQ', 'REyyLVdCJK', 'R0NyMTJrtA', 'hZvODeOkYE', 'mPFO4BQ6Sm', 'X21O7aZhU2', 'X32ONu9SiV', 'KO8OWIaYH7', 'YFUOdBBD6A'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, OEWbdXRZoZKorpKpKb.cs High entropy of concatenated method names: 'ToString', 'fKTxD6JKs6', 'GIpxRbiDeL', 'AVFxP7K3Ha', 'a9hxfPP94F', 'WA6xBI2VN3', 'NYixwwdmBH', 'yUdx0RcEFv', 'Bf9xHqwsP7', 'nVcx3dFqro'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, YTxZkKl8MORpMRYJKr.cs High entropy of concatenated method names: 'wWE9Mhfgn4', 'Fq69uBXqgo', 'vYi96pIw8H', 'dat9CECFH0', 'LHV9KbZKh3', 'WQl9FTx2PO', 'kUD9ICD8UC', 'KDhycw6bnf', 'KqTyEmi9LL', 'GTmybLFcS4'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, nZLshlvWFIXMKa6mV6.cs High entropy of concatenated method names: 'DVegThmFo', 'Mg3mP5nKy', 'Df3J8DheE', 'zqx24Wg2F', 'jx7XTtkOD', 'qA71IPnVg', 'Pk3lyw3YA7Mat3IHcH', 'CRJGk3WdJdLIZsCY9P', 'pdGyBZQyi', 'Kd5eUnuVR'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, SNLrwMCKxEMFBjyART.cs High entropy of concatenated method names: 'twK5maAuTj', 'FGo5J8GiHK', 'eMo5ZweHmG', 'UpL5X9uFSy', 'Pqp5vWiP3b', 'Ipd5xw3O0N', 'Fc15OMBHLE', 'Mj65yZb0YQ', 'C8659XJp1O', 'N9y5ev5a37'
Source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, Yf9VmijcZv3rrdRA9m6.cs High entropy of concatenated method names: 'Pfe9naQrNP', 'S679Se8jls', 'iMb9grZiac', 'Kxe9mBn7Ms', 'kD99G5kSQ3', 'Q9X9Jn4QPB', 'CYG92NvGZC', 'WFV9ZShsrY', 'fDR9XHd6tP', 'DW291QqGFN'
Creates processes with suspicious names
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe File created: \abh projesi_slg6%0190%_fiyat teklif - po240017 xlsx.exe
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe File created: \abh projesi_slg6%0190%_fiyat teklif - po240017 xlsx.exe
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe File created: \abh projesi_slg6%0190%_fiyat teklif - po240017 xlsx.exe Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe File created: \abh projesi_slg6%0190%_fiyat teklif - po240017 xlsx.exe Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 280, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory allocated: 1030000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory allocated: 2810000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory allocated: 4810000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory allocated: 75D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory allocated: 85D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory allocated: 8780000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory allocated: 9780000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory allocated: 1140000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory allocated: 2C20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory allocated: 4C20000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599672 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599343 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599125 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599015 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598906 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598797 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598687 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598576 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598463 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598359 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598237 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598110 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597996 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597887 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597781 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597668 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597562 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597453 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597343 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597228 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597125 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597015 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596905 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596796 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596687 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596576 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596468 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596359 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596250 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596140 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596031 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595921 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595812 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595703 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595592 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595484 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595283 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595156 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595030 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 594920 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 594812 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 594703 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 594593 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 594484 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7794 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1909 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Window / User API: threadDelayed 1984 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Window / User API: threadDelayed 7874 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 2992 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7280 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep count: 32 > 30 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -29514790517935264s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7372 Thread sleep count: 1984 > 30 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -599890s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7372 Thread sleep count: 7874 > 30 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -599781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -599672s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -599562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -599453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -599343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -599234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -599125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -599015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -598906s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -598797s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -598687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -598576s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -598463s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -598359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -598237s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -598110s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -597996s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -597887s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -597781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -597668s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -597562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -597453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -597343s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -597228s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -597125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -597015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -596905s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -596796s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -596687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -596576s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -596468s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -596359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -596250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -596140s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -596031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -595921s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -595812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -595703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -595592s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -595484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -595283s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -595156s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -595030s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -594920s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -594812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -594703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -594593s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe TID: 7368 Thread sleep time: -594484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599672 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599343 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599125 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 599015 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598906 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598797 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598687 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598576 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598463 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598359 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598237 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 598110 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597996 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597887 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597781 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597668 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597562 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597453 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597343 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597228 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597125 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 597015 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596905 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596796 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596687 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596576 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596468 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596359 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596250 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596140 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 596031 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595921 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595812 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595703 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595592 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595484 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595283 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595156 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 595030 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 594920 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 594812 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 594703 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 594593 Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Thread delayed: delay time: 594484 Jump to behavior
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000000.00000002.1713336778.0000000000CB6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe, 00000003.00000002.4108402068.0000000000F77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe"
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Memory written: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe" Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Process created: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe "C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 3.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.4109948122.0000000002DED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4107406678.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1716836366.000000000387A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4109948122.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 280, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 6308, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 3.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38fd5d0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.38dd1b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe.387b590.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.4109948122.0000000002DED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4107406678.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1716836366.000000000387A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4109948122.0000000002C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 280, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe PID: 6308, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1528229 Sample: ABH projesi_SLG6%0190%_fiya... Startdate: 07/10/2024 Architecture: WINDOWS Score: 100 22 reallyfreegeoip.org 2->22 24 checkip.dyndns.org 2->24 26 checkip.dyndns.com 2->26 32 Found malware configuration 2->32 34 Malicious sample detected (through community Yara rule) 2->34 36 Multi AV Scanner detection for submitted file 2->36 40 8 other signatures 2->40 8 ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe 4 2->8         started        signatures3 38 Tries to detect the country of the analysis system (by using the IP) 22->38 process4 file5 20 ABH projesi_SLG6%0...240017 xlsx.exe.log, ASCII 8->20 dropped 42 Adds a directory exclusion to Windows Defender 8->42 44 Injects a PE file into a foreign processes 8->44 12 ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe 15 2 8->12         started        16 powershell.exe 23 8->16         started        signatures6 process7 dnsIp8 28 reallyfreegeoip.org 188.114.97.3, 443, 49734, 49736 CLOUDFLARENETUS European Union 12->28 30 checkip.dyndns.com 132.226.247.73, 49733, 49738, 49740 UTMEMUS United States 12->30 46 Tries to steal Mail credentials (via file / registry access) 12->46 48 Tries to harvest and steal browser information (history, passwords, etc) 12->48 50 Loading BitLocker PowerShell Module 16->50 18 conhost.exe 16->18         started        signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.97.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS true
132.226.247.73
 checkip.dyndns.com United States
16989 UTMEMUS false

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.97.3 true
checkip.dyndns.com 132.226.247.73 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://reallyfreegeoip.org/xml/8.46.123.33 false
  • URL Reputation: safe
 unknown
http://checkip.dyndns.org/ false
  • URL Reputation: safe
 unknown