24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fe,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 799bbb48a1f3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 799bbb48a1f3…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 12/28 AV engines flagged this file. 10 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/799bbb48a1f3d7822992b3d7d6388e0ee2b3d6c358ad7587d10e63a5d1cc6f72","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","799bbb48a1f3d7822992b3d7d6388e0ee2b3d6c358ad7587d10e63a5d1cc6f72"],"about":{"@type":"SoftwareApplication","name":"SATIN ALMA SİPARİŞİ-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe","applicationCategory":["peexe","executable"],"identifier":"799bbb48a1f3d7822992b3d7d6388e0ee2b3d6c358ad7587d10e63a5d1cc6f72","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T51d,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe")26:T871,Assembly shows XOR instruction xor eax ebp in Stream UID: 42541-116-0042B043 Assembly shows XOR instruction xor ecx ebp in Stream UID: 42541-116-0042B043 Assembly shows XOR instruction xor ecx edx in Stream UID: 42541-1827-0046A63F Assembly shows XOR instruction xor ebx 10h in Stream UID: 42541-1832-00469A75 Assembly shows XOR instruction xor eax 01h in Stream UID: 42541-1839-004692B1 Assembly shows XOR instruction xor eax 08h in Stream UID: 42541-1975-00444DDD Assembly shows XOR instruction xor eax ecx in Stream UID: 42541-2015-0041A856 Assembly shows XOR instruction xor eax ebp in Stream UID: 42541-2162-004272C4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 42541-2162-004272C4 Assembly shows XOR instruction xor eax ebp in Stream UID: 42541-2163-004276A5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 42541-2163-004276A5 Assembly shows XOR instruction xor byte ptr [ebp+eax-00000124h] 80h in Stream UID: 42541-2452-00443A61 Assembly shows XOR instruction xor al cl in Stream UID: 42541-2470-00443DA8 Assembly shows XOR instruction xor byte ptr [ebp-60h] cl in Stream UID: 42541-2470-00443DA8 Assembly shows XOR instruction xor byte ptr [ebp-5Fh] cl in Stream UID: 42541-2470-00443DA8 Assembly shows XOR instruction xor byte ptr [ebp-000000EFh] cl in Stream UID: 42541-2470-00443DA8 Assembly shows XOR instruction xor byte ptr [ebp-000000EEh] cl in Stream UID: 42541-2470-00443DA8 Assembly shows XOR instruction xor byte ptr [ebp-000000A5h] cl in Stream UID: 42541-2470-00443DA8 Assembly shows XOR instruction xor eax 000087BCh in Stream UID: 42541-2550-0044BFA4 Assembly shows XOR instruction xor eax 0000A685h in Stream UID: 42541-2550-0044BFA4 Assembly shows XOR instruction xor byte ptr [ebx+esi] al in Stream UID: 42541-2550-0044BFA4 Assembly shows XOR instruction xor ebx 08h in Stream UID: 42541-2606-0044FE7E Assembly shows XOR instruction xor dword ptr [ebp-04h] 08000000h in Stream UID: 42541-2868-00459F50 Assembly shows XOR instruction xor eax 08000000h in Stream UID: 42541-2877-0045A2A9 Assembly shows XOR instruction xor eax ecx in Stream UID: 42541-3095-00468A3727:T705,Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Keep" in header "GET /xml/64.124.12.162 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive"28:T1213,"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000003a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f3800000000008603d0fa5f017c7d7e7f808182838485868788898a8b8c8d8e8fd007f6004000000098999a9b610000000000f600a4a5a6a7f200aaabacadaeafb0b1b2b300bd880328cd88031900000000000000200000000000f600d801f6007c0cf60000000000780cf600dcdddedfc8fa5f0159161a7738000000000000008cd88f00000086030400000010ed88008460860308000000c4fa5f018469890000008603000000008cd88f003a1a8e0000000000d8fa5f016b7e89001802930018fb5f01c0128900 (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002076) "interseminating.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005016) "interseminating.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000003a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f380000000000a300c8fe7f007c7d7e7f808182838485868788898a8b8c8d8e8fd0071a004000000098999a9b4900000000001a00a4a5a6a7fa00aaabacadaeafb0b1b2b348c9a50090c5a50012000000000000002000000000001a00d8011a007c0c1a0000000000780c1a00dcdddedfc0fe7f0059161a7738000000000000008cd801010000a3000400000010edfa0044d1a30008000000bcfe7f008469fb000000a300000000008cd801013a1a000100000000d0fe7f006b7efb001802050110ff7f00c012fb00 (UID: 00000000-00005016) "interseminating.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005016)29:T9f4,"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "LoadLibrary" with a parameter C:\SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002076) "interseminating.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005016) "interseminating.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005016) "interseminating.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005016) "interseminating.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005016) "interseminating.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005016) "interseminating.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\lophophorine\interseminating.exe (UID: 00000000-00005016) "interseminating.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005016) "interseminating.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005016) "interseminating.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005016) "interseminating.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005016)2a:T3c92,"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00002076) "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00002076) "interseminating.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005016) "interseminating.exe" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00005016)2b:Tdc18,Found reference to API (Indicator: "CopySid"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegConnectRegistryW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DuplicateTokenEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FreeSid"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetUserNameW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "AddAce"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateProcessWithLogonW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InitializeAcl"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegCloseKey"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetAclInformation"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LogonUserW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetLengthSid"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetAce"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetSaveFileNameW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetDIBits"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetObjectW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DeleteObject"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DeleteDC"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RoundRect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SelectObject"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetStockObject"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "StretchBlt"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IcmpSendEcho"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetPrivateProfileSectionW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetVolumeLabelW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CompareStringW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetFileSize"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SizeofResource"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "HeapFree"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetProcessIoCounters"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "TlsFree"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "TlsSetValue"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CopyFileW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FindNextFileW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetErrorMode"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetLastError"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetFileType"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreatePipe"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WriteFile"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FindResourceW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "HeapSize"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RtlUnwind"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RaiseException"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetPriorityClass"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateThread"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetCPInfo"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetTempPathW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GlobalLock"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetStdHandle"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FindResourceExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "TerminateProcess"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetLastError"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "TerminateThread"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetACP"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateEventW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetVersionExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetOEMCP"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GlobalFree"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "MulDiv"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "Sleep"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FindClose"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetFileTime"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "Process32FirstW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ReadFile"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LockResource"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "MoveFileW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateFileW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LCMapStringW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ResumeThread"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetStdHandle"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "TlsAlloc"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "VirtualFreeEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetLocalTime"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ExitThread"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DeleteFileW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FormatMessageW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetEvent"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "VirtualFree"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "Process32NextW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "lstrcpyW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CloseHandle"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateProcessW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FreeLibrary"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WritePrivateProfileSectionW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "OpenProcess"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetSystemPowerState"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetProcAddress"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "TlsGetValue"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetFilePointer"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ExitProcess"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "EnumResourceNamesW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "lstrlenW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "HeapAlloc"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LoadResource"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetLongPathNameW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WNetAddConnection2W"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WNetUseConnectionW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WNetGetConnectionW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WNetCancelConnection2W"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "VariantCopyInd"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "VariantChangeType"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SysAllocString"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "VariantClear"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "VariantCopy"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SysStringLen"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "VariantInit"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SysFreeString"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SafeArrayAccessData"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SHGetDesktopFolder"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "OpenClipboard"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetAsyncKeyState"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "TranslateMessage"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateMenu"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetParent"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "BeginPaint"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateIconFromResourceEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsCharAlphaNumericW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "AttachThreadInput"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CheckMenuRadioItem"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetCursorPos"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CharLowerBuffW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetMenuStringW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetCapture"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CopyRect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SendInput"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetCursorInfo"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegisterHotKey"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetClipboardData"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsWindow"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "OpenWindowStationW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InvalidateRect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsCharUpperW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ShowWindow"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetCaretPos"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetRect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ClientToScreen"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetMenu"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetFocus"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "MoveWindow"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InflateRect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RedrawWindow"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CountClipboardFormats"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DestroyWindow"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetSysColor"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetCursor"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetWindowPos"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "MessageBoxA"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetProcessWindowStation"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "KillTimer"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LoadCursorW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetMenuDefaultItem"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InsertMenuItemW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsZoomed"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CloseDesktop"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetClipboardData"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FillRect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CopyImage"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetWindowDC"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsIconic"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "EnableWindow"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FrameRect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetDC"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetTimer"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "MessageBoxW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetClientRect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DeleteMenu"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "EnumThreadWindows"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LoadStringW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetKeyState"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsCharAlphaW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetFocus"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ScreenToClient"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CloseClipboard"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ReleaseDC"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "MessageBeep"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "EnumWindows"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetMenuItemID"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DrawMenuBar"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CharNextW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CharUpperBuffW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetMenu"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "wsprintfW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DestroyIcon"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "PtInRect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LoadIconW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "UnregisterHotKey"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetSubMenu"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DestroyMenu"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LoadImageW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "OpenDesktopW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CloseWindowStation"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "PeekMessageW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetWindowRect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InternetCloseHandle"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InternetSetOptionW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InternetReadFile"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FtpOpenFileW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InternetCrackUrlW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InternetQueryOptionW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FtpGetFileSize"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InternetConnectW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InternetOpenW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "HttpOpenRequestW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InternetOpenUrlW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InternetQueryDataAvailable"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "HttpQueryInfoW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "HttpSendRequestW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "closesocket"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "inet_ntoa"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "inet_addr"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "__WSAFDIsSet"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WSACleanup"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "gethostbyname"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ntohs"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "htons"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "recvfrom"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "gethostname"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WSAStartup"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CoInitialize"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CoUninitialize"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "ProgIDFromCLSID"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IIDFromString"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CoGetObject"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "OleSetMenuDescriptor"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CoInitializeSecurity"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "StringFromGUID2"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FlsAlloc"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FlsFree"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FlsGetValue"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FlsSetValue"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateThreadpoolWait"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetThreadpoolWait"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CloseThreadpoolWait"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetCurrentProcessorNumber"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CompareStringEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "CreateFile2"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "IsWow64Process"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "GetProcessId"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API (Indicator: "SeDebugPrivilege"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe")2c:T4958,"GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:33 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a2bc7fa70cec41af94fb84bdb84d578d with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:33 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7919e0fcf453b95ea44ea59b02817240 with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:33 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Cf-Ray: 95095d14da7a67f2-SJC Age: 16763 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Mon 16 Jun 2025 05:04:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PptUtBeu2QBBaoNEhatO1vC72EmqT3vxT%2BbZyDJuhC9stVnagRgLemKejZLgLiiVI%2FQt%2BK9EThmJrGl9ezCyqBrJHyiFpPkNO708wgSch49v87ONcjgAKbipeHfEAExjbCgD7jJ9"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2088&min_rtt=1561&rtt_var=962&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=505&delivery_rate=1870595&cwnd=251&unsent_bytes=0&cid=d8ff0d8a79644e4f&ts=88&x=0" with response body ==>33633A35323A36353A37333A37303A36663A36653A37333A36353A33653A30613A30393A33633A34393A35303A33653A33363A33343A32653A33313A33323A33....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:34 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6e2ecfade70f2d85a112f2e647e4667e with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:34 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Cf-Ray: 95095d161b3f67f2-SJC Age: 16763 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Mon 16 Jun 2025 05:04:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gKqRZSWDGaGm0cynfNbzpwE4LZq6RIFOiuLntUfpvUb8cevCf%2FqPJcGV3Prj4GASs%2FE82pXbTUaWldY98lTdOJLkA6zNtojLsYhIOurPLucMULma06%2Fy03rh28CjAfi24U4JBhb%2B"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2039&min_rtt=1561&rtt_var=819&sent=7&recv=8&lost=0&retrans=0&sent_bytes=4538&recv_bytes=589&delivery_rate=1870595&cwnd=253&unsent_bytes=0&cid=d8ff0d8a79644e4f&ts=283&x=0" with response body ==>33633A35323A36353A37333A37303A36663A36653A37333A36353A33653A30613A30393A33633A34393A35303A33653A33363A33343A32653A33313A33323A33....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:34 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 85ed6da976c5c88387cf231d97fec2f2 with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:34 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Cf-Ray: 95095d175c1867f2-SJC Age: 16763 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Mon 16 Jun 2025 05:04:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oqFbg2yyhacJbEUY19rjBMRc%2FlDzHuOBCS9j50heL1lVNYyKHZdUTeZM3aWpni4v6n4oZ71r%2BhLn%2FWdcyy6K8%2FWh7KqYbv0o5EXZTtFFORGzeHcmmm98%2BKLJk2fTSsvsI1%2Bqb%2F3o"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7044&min_rtt=1561&rtt_var=10624&sent=8&recv=10&lost=0&retrans=0&sent_bytes=5780&recv_bytes=673&delivery_rate=1870595&cwnd=254&unsent_bytes=0&cid=d8ff0d8a79644e4f&ts=481&x=0" with response body ==>33633A35323A36353A37333A37303A36663A36653A37333A36353A33653A30613A30393A33633A34393A35303A33653A33363A33343A32653A33313A33323A33....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:34 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cec9cb41901172098c491c994f04b66c with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:34 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Cf-Ray: 95095d188cbb67f2-SJC Age: 16763 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Mon 16 Jun 2025 05:04:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CP5%2Fm1kxBylOx8XJY0ZZXjE%2BDQcddP3xlUgsGfSpEuQPFjSyWHHkXA82ZPc8IlRR1OvWHXUuxvsu6jyh2A719ng0CsEMJb7BK0cKi5NC%2FkBPHKEFDqFs6eAYPg6E98qw6rKUaqKQ"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12145&min_rtt=1561&rtt_var=18170&sent=9&recv=12&lost=0&retrans=0&sent_bytes=7031&recv_bytes=757&delivery_rate=1870595&cwnd=255&unsent_bytes=0&cid=d8ff0d8a79644e4f&ts=676&x=0" with response body ==>33633A35323A36353A37333A37303A36663A36653A37333A36353A33653A30613A30393A33633A34393A35303A33653A33363A33343A32653A33313A33323A33....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:34 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5ba96ed2babc212a16a1cac1085236b0 with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:34 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Cf-Ray: 95095d19cdb167f2-SJC Age: 16764 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Mon 16 Jun 2025 05:04:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4GjS%2FMx%2Fr57y6Fx11DfX2b7JDSEbapB4KhLz1H%2BfZHe1ySMx3%2F9Mt%2BdlcSNeuB94OhchuwaDtdKnPS7e3A%2FVqxk64yMQjvuA6donlBbmyBJzNygg9JY3cPX0DzNeRJio2O97GeGW"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17579&min_rtt=1561&rtt_var=24494&sent=10&recv=14&lost=0&retrans=0&sent_bytes=8275&recv_bytes=841&delivery_rate=1870595&cwnd=256&unsent_bytes=0&cid=d8ff0d8a79644e4f&ts=876&x=0" with response body ==>33633A35323A36353A37333A37303A36663A36653A37333A36353A33653A30613A30393A33633A34393A35303A33653A33363A33343A32653A33313A33323A33....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:34 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d3e8c4ef7f03c55121929c9ee558256d with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:34 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Cf-Ray: 95095d1b0e6a67f2-SJC Age: 16764 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Mon 16 Jun 2025 05:04:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kEZtVLT4HhDSvopnWic9gkn4wb8D2oRZtlbFvx4W6ZwdF6FCUSc%2Fs%2FSqFWK57n0BcnG2L%2FvwTjJfY31p3u8J230WRud0q%2FaEyVlElNF07pbNMlgtOIOlTPSYNXLoqPtH0tqxPXRc"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=20775&min_rtt=1561&rtt_var=24763&sent=11&recv=16&lost=0&retrans=0&sent_bytes=9526&recv_bytes=925&delivery_rate=1870595&cwnd=257&unsent_bytes=0&cid=d8ff0d8a79644e4f&ts=1079&x=0" with response body ==>33633A35323A36353A37333A37303A36663A36653A37333A36353A33653A30613A30393A33633A34393A35303A33653A33363A33343A32653A33313A33323A33....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:35 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b0c52313ed94b3c922399f127bf2e025 with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:35 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Cf-Ray: 95095d1c5f3967f2-SJC Age: 16764 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Mon 16 Jun 2025 05:04:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hYSMhIiFleWEV%2FDVIX%2FsDC0hdh4gE2%2Bj7rmPw2pz44IsMczfnSkNxOa0eDxBs7bQTNEC1wPNQoOUX0x1v0vhWI3mEZnEURX%2BISKWo%2FAxMu0cJORXLZid5C5qU9MpRmZbdfoCCZPF"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=23643&min_rtt=1561&rtt_var=24309&sent=12&recv=18&lost=0&retrans=0&sent_bytes=10774&recv_bytes=1009&delivery_rate=1870595&cwnd=257&unsent_bytes=0&cid=d8ff0d8a79644e4f&ts=1283&x=0" with response body ==>33633A35323A36353A37333A37303A36663A36653A37333A36353A33653A30613A30393A33633A34393A35303A33653A33363A33343A32653A33313A33323A33....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:35 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1c727e6d523c5d41a4b47aaabb6b77ff with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:35 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Cf-Ray: 95095d1d981f67f2-SJC Age: 16764 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Mon 16 Jun 2025 05:04:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YkpxUK3LzOflJy5ZvmDm4tAY0LBO0APsOaX3dnPDO4q%2BHMk2gTeelp9wK0%2BlS2gNn7gKnT5szP0OKcRahOW%2BjyyPMQxEm4AHS5iZonmKoR08YrUmRn26uAollO9f5r0nAPi2vA1P"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=25950&min_rtt=1561&rtt_var=22845&sent=13&recv=20&lost=0&retrans=0&sent_bytes=12026&recv_bytes=1093&delivery_rate=1870595&cwnd=257&unsent_bytes=0&cid=d8ff0d8a79644e4f&ts=1484&x=0" with response body ==>33633A35323A36353A37333A37303A36663A36653A37333A36353A33653A30613A30393A33633A34393A35303A33653A33363A33343A32653A33313A33323A33....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:35 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 07332bc7f1becdc4817333509993e12b with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:43:35 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Cf-Ray: 95095d1ed91767f2-SJC Age: 16764 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Mon 16 Jun 2025 05:04:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=duQ2Zjhkz5%2FIzk4kxjZiLsMiCVtbOJp6m0La4LkiEZa2ySyG1VLLjj3urBdgiYaU0%2FGh9Hv4zrx%2FIertAlRjvKB7OLO8Uh28OFhiR%2BYVPih2lVnDQwdyU3KVfcd9pMwJyyHSa4Rb"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=28260&min_rtt=1561&rtt_var=21754&sent=14&recv=22&lost=0&retrans=0&sent_bytes=13274&recv_bytes=1177&delivery_rate=1870595&cwnd=257&unsent_bytes=0&cid=d8ff0d8a79644e4f&ts=1685&x=0" with response body ==>33633A35323A36353A37333A37303A36663A36653A37333A36353A33653A30613A30393A33633A34393A35303A33653A33363A33343A32653A33313A33323A33....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:46:02 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c6ba4fc553f8dd7d0d441c6e15aa1993 with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:46:02 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 95a1d1f9440d0145c8d6026279457c28 with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:46:02 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Cf-Ray: 950960b64e2f9441-SJC Age: 16912 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Mon 16 Jun 2025 05:04:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hPAPWDB52kXEfsnrEkSoh8TQdDWeLrJzPajPKTfDRVWmO2jMgRd5nJPsdvaa%2Fiv7h5elJhltVPsLoHyIyXwdy2MhnD0P5oYnLGjZTS1swS8EOmnjScy3ukcVNU7Af6w3HXR7gihI"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1584&min_rtt=1546&rtt_var=607&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=505&delivery_rate=1888745&cwnd=250&unsent_bytes=0&cid=026228ec3e45d63a&ts=54&x=0" with response body ==>33633A35323A36353A37333A37303A36663A36653A37333A36353A33653A30613A30393A33633A34393A35303A33653A33363A33343A32653A33313A33323A33....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:46:03 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cd9407ea8e56a81aa66172fd750d4c36 with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:46:03 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Cf-Ray: 950960bddc3d9441-SJC Age: 16913 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Mon 16 Jun 2025 05:04:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Vg76e%2BALL7bqfumTb%2BPlK9NcPyJw%2FDV16vHIXUbKtynbHxWRIPyj8D0vbMHysA%2BK93HWIDQwsUDu%2B5DfbcVH5H5t3hQ%2F%2BoRBaCt3G1ik7iuNCI8CFx%2BNQwBYU17PGTpZtRH%2BSL%2B"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1546&rtt_var=459&sent=6&recv=8&lost=0&retrans=0&sent_bytes=4533&recv_bytes=589&delivery_rate=1888745&cwnd=252&unsent_bytes=0&cid=026228ec3e45d63a&ts=1257&x=0" with response body ==>33633A35323A36353A37333A37303A36663A36653A37333A36353A33653A30613A30393A33633A34393A35303A33653A33363A33343A32653A33313A33323A33....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 16 Jun 2025 09:46:04 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 11dbc6d58460dc83656048e0f5fd578b with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A34333A37353A37.......2d:Tb33,"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74300000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74300000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74300000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "KERNEL32" at base 74b60000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d80000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "KERNEL32.DLL" at base 74b60000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73630000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "COMCTL32.DLL" at base 71020000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "COMCTL32" at base 71020000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "USER32.DLL" at base 73ba0000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "ADVAPI32.DLL" at base 74980000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "SHELL32.DLL" at base 758a0000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "SHLWAPI.DLL" at base 74cd0000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72ce0000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "NTDLL.DLL" at base 77160000 "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73ad0000 "interseminating.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74300000 "interseminating.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74300000 "interseminating.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74300000 "interseminating.exe" loaded module "KERNEL32" at base 74b60000 "interseminating.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d80000 "interseminating.exe" loaded module "KERNEL32.DLL" at base 74b60000 "interseminating.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73630000 "interseminating.exe" loaded module "COMCTL32.DLL" at base 71020000 "interseminating.exe" loaded module "COMCTL32" at base 71020000 "interseminating.exe" loaded module "USER32.DLL" at base 73ba0000 "interseminating.exe" loaded module "ADVAPI32.DLL" at base 74980000 "interseminating.exe" loaded module "SHELL32.DLL" at base 758a0000 "interseminating.exe" loaded module "SHLWAPI.DLL" at base 74cd0000 "interseminating.exe" loaded module "NTDLL.DLL" at base 771600002e:T43e,"SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe" file has an entrypoint instructions - "call 0x432de3,jmp 0x425dfd,int3 ,int3 ,push edi,push esi,mov esi, dword ptr [esp + 0x10],mov ecx, dword ptr [esp + 0x14],mov edi, dword ptr [esp + 0xc],mov eax, ecx,mov edx, ecx,add eax, esi,cmp edi, esi,jbe 0x425fa0,cmp edi, eax,jb 0x426308,bt dword ptr [0x4c0158], 1,jae 0x425fb1,rep movsb byte ptr es:[edi], byte ptr [esi],jmp 0x4262c8,cmp ecx, 0x80,jb 0x42618b,mov eax, edi,xor eax, esi,test eax, 0xf,jne 0x425fd6,bt dword ptr [0x4ba370], 1,jb 0x4264b0," "interseminating.exe" file has an entrypoint instructions - "call 0x432de3,jmp 0x425dfd,int3 ,int3 ,push edi,push esi,mov esi, dword ptr [esp + 0x10],mov ecx, dword ptr [esp + 0x14],mov edi, dword ptr [esp + 0xc],mov eax, ecx,mov edx, ecx,add eax, esi,cmp edi, esi,jbe 0x425fa0,cmp edi, eax,jb 0x426308,bt dword ptr [0x4c0158], 1,jae 0x425fb1,rep movsb byte ptr es:[edi], byte ptr [esi],jmp 0x4262c8,cmp ecx, 0x80,jb 0x42618b,mov eax, edi,xor eax, esi,test eax, 0xf,jne 0x425fd6,bt dword ptr [0x4ba370], 1,jb 0x4264b0,"2f:T516,Process "interseminating.exe" (UID: 00000000-00005016) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "interseminating.exe" (UID: 00000000-00005016) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "WScript.exe" (UID: 00000000-00001696) was launched with new environment variables: "PROMPT="$P$G"" Process "WScript.exe" (UID: 00000000-00001696) was launched with modified environment variables: "PSModulePath, Path, PATHEXT, NUMBER_OF_PROCESSORS" Process "WScript.exe" (UID: 00000000-00001696) was launched with missing environment variables: "USERDNSDOMAIN" Process "interseminating.exe" (UID: 00000000-00000404) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "interseminating.exe" (UID: 00000000-00000404) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "RegSvcs.exe" (UID: 00000000-00006628) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "RegSvcs.exe" (UID: 00000000-00006628) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles"30:T683,The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 34:0B:28:80:F4:46:FC:C0:4E:59:ED:33:F5:2B:3D:08:D6:24:29:64; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 31:BC:5A:89:C1:05:F7:DD:36:BA:3A:54:6D:38:92:56:66:D7:D9:02; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)31:T764,"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "")32:Te88,"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANVETICAS_DOCX.EXE"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANVETICAS_DOCX"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "")33:T528,"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to touch file "C:\SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to touch file "C:\SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANVETICAS_DOCX.EXE.LOCAL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to touch file "C:\WSOCK32.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to touch file "C:\Windows\SysWOW64\wsock32.dll" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to touch file "C:\VERSION.DLL"34:Tb9d,"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\WSOCK32.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\VERSION.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\WINMM.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\MPR.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\WININET.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\USERENV.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\UXTHEME.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\DWMAPI.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\dwmapi.dll" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\lophophorine\INTERSEMINATING.EXE" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\lophophorine\interseminating.exe" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\BCRYPT.DLL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\bcrypt.dll" "interseminating.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "interseminating.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\lophophorine\WSOCK32.DLL" "interseminating.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\lophophorine\VERSION.DLL" "interseminating.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\lophophorine\WINMM.DLL" "interseminating.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\lophophorine\MPR.DLL"35:T7df,"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANVETICAS_DOCX.EXE.LOCAL" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe.Local\" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\SCHOOLMA" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\schoolma" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\TERES" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\teres" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\LOPHOPHORINE" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\lophophorine" "interseminating.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\lophophorine\INTERSEMINATING.EXE.LOCAL" "interseminating.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "interseminating.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\lophophorine\interseminating.exe.Local\" "interseminating.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\INTERSEMINATING.VBS" "interseminating.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\interseminating.vbs"36:T465,"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" writes file "c:\users\%osuser%\appdata\local\temp\aut84a6.tmp" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" writes file "c:\users\%osuser%\appdata\local\temp\schoolma" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" writes file "c:\users\%osuser%\appdata\local\temp\aut862e.tmp" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" writes file "c:\users\%osuser%\appdata\local\temp\teres" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" writes file "c:\users\%osuser%\appdata\local\lophophorine\interseminating.exe" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" writes file "%temp%\aut84a6.tmp" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" writes file "%temp%\schoolma" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" writes file "%temp%\aut862e.tmp" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" writes file "%temp%\teres" "SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe" writes file "%localappdata%\lophophorine\interseminating.exe"37:T48f,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe")38:T4d2,Observed import api "WNetAddConnection" which can "make a connection to a network resource" [Source: SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe] Observed import api "WNetCancelConnection" which can "cancel an existing network connection" [Source: SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe] Observed import api "WNetUseConnection" which can "make a connection to a network resource" [Source: SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe] Observed import api "WNetAddConnection" which can "make a connection to a network resource" [Source: interseminating.exe] Observed import api "WNetCancelConnection" which can "cancel an existing network connection" [Source: interseminating.exe] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: interseminating.exe] Observed import api "WNetUseConnection" which can "make a connection to a network resource" [Source: interseminating.exe]39:T1945,Observed string: "EA065j]^S+S=iSZ5n3YL,f5pk[:}Mg2i\@,>8-qg[j\jmjgO_*oFXiU}}T/UkU*uY5Ug_ ZE^YTjV+Xn49lt:M#r%4iiRJ5jW+MkT)%XUiTk0Z%uf7pg4 ;"zMRsR5vSv'7zM^c\HotZdpZc3Z5&lp`&,qp&vuZ&.V 4jesgtm^c?6@"cx-cX^c 4Zh(4=JEr[6hVg\j4`Nb(3+U V&wQyT0-`,RksJW&G;zwfuWsiUZ-Z5,0x \D PisYm*ISMlq ='j&TLw:b8UR(P%IS|'\x/sx;LW2hTjEV!YP+0?@MzAYa$(N)t*Yj 8fh@p25Qv+5)E*#No*t+MJWMPi~0(> wP0#3d1T#8a`.luy-SkT>]0&1R\irObp_%}pEs6ddi2 JmRJir<0']K`bJ9pap?FAW /L$Ti\XUd {P#;lWBm)thWNc QfBmM#DQ@^3K6zUjPhR!mT+F2YUbDM]zDjMU/uhOb.#iQF5ACb_Q&AJ1nw>Z5fHW3D4pkRXr&(t#PoX-[A*y3"gLMp!ka<_1`$p:Mb-hTt/"7G,,=bQ}QJVI7>Z5JIO+IA_V+L>c|bqP8}!=z$5*AXpGmU[ p0V*a+4D`b0V*4>(]$20mB+2gcSIaSGTow@8bgKN:`BH)r]:p%%x?APv@M6Qm3q3dS&Hl|!8_Bh!2*hz!XS;b%FC*v K/.T'bS0)E*4ZGm*GmVQX^E&qYh5Wh'v@7"GFY`aK<:E8Z}KkTp`Jk:va`ZZ84HG&GEN;&T!HhU*<|}!U]TToTr4J5^H38mxNaF5V!R|RJUk=>gcN/@.'*vz+V,#VTz%+U:*VUZ5j!R{kc\I.bRQk("(5;DejPMl .gP+PT4JC< JCU+MT73WQ*nnmw&@kB`hbSFKiBR-/2"(&(0*ujgPZ~`T5*EyxkpJ@"aCwhj8mM;6x]YX\&,)D5H^a>JU2AL]Ha*"SC{z`|p R+"VnnEkkl*-.u_;|5zx9?=L|p#6_h(yo'*cuQJ[ieTc#%T^#%T8mM:CW$(T(#9H*;F50CbzhtZw:2'vbj'vz^'w%bxufB'wZL'>_mDO3`JM&_rf]e{AA,UNPBR>ImA?>it@2*4z-:*R*k(Cx&% P'r'i3.hSf~u*l@'\^TST*)UL}E>6/Eq3Zpg>\ej}!Sr1IxK>\U ocwh-R+sWN1FN:f56&.\9s1Z1#>7>pCg21N$j9MG=#MG>T3uzMb|S+x+S_d|t)?l|RyB(4@4B`P4l))T[uH%x2PkB0Nc@t|'2y,Ui4->jDXGz9,BguMN(V*'KH\9&G}>d4+/Tj gjZ^d%Zk 4$H37\H3Cb|y&)@+)8'PbpMW=7*"J*ti $P*S*s;=28xK_(?@+2['2kupRaHVc MtP'0PfDWemtz-Il\A%2P9W,uz-bgnb ^1(0!E`E{SPVIhG8B1t-,/(m7X\ Kce%M7]2"FyM1>]St'K* C91t8mN|> Pz=LLYM1>86ys-TkCK%rZ\}E%6P;".c+3+w1eyJ?g'_(nYOW;Yh|2J'r}33d|QB20k2O>J%rM@2F|Q.(4C}C9>J;<>hrxkT_Pku*o4M=m:I~6x?CU0"! d5 +S{^QGOt.T@Q&;Id']^d*T+5+mWr-SfEv $/o/`sapdKn5S-n;u-n>:imO:[q5C; ;`; 0}'*{?-_< @axkCN5Z)Oju:=&ThT@^h)@kT+5&tW uzd4A)@Jh4kWbtjOb vEcI04P`tLN+;*`j4:Oj;*_j@#_j5zf&FZ5V]F%5n)5xDI7;]\L#[)e^A&<'*Vi[J $WM*0Gf`(tzeB7>-3z\TfS P/!Q,tz5@B)EGiUB3_(O=@GB>ZhU/Tz0i5Nep5H%EzF;UNO?3iyf@`LS+4JJ5VunVxZ5zgNH`C[4q&GZq)AC*5hLl=X<< 6si"]J-T@snV t1`un]B,!Bj=6}KNb"A|/w&rV5HW)SX<,9Md##zFVjViY=@3$Dcw/xocGjTZMFt-i4)5N'0LDt`#%.o0t:Z5t*2* z`{q [jW<_+!.06Vi"`-$LRYL"^rsnUnfC^n2yLoeZ5b-BUBg9:mr'Lefqqx=Bg&|;dwVaLS"wjyZM.1p9VfpDw4~PkwO=uJ'f\jQT?(+VZfZJ4xPClS&_P9u|N McWfMXHMcyl_A4(}pSPMb_TuR0z}`Mb_'M2mp&v|XM5ze>LqcWMcCkjEZSM<-880!EMc{kVM2gEMc1I3t@MbeeMciRMc;sR=e^;3@VMbuWUZ#TNhQ`N>hFM9!}k"}L'dUb+TW<5L,Z'@up%&]Cyp/3}?5^lz6mUSS;szlw|E3=ce<_6S-Uq*$f.#xAPX%2*dEstOuU F'ODUJK^E83^-lEBE@}UlU5M]GP03_jwfgYZfnwUW%A!:h0!6h`F@!(*=Y/!\;b)6Py!uc"mr;]jbnk;0\&u@V&w&LftZ7-n<_Yb!5\uZKP53[W:%2324h]Z+uJMZe*2jHI8)urY\F3IaRY\ZCJ4beA9Mr[2\np;E!V(\/W8m/4h\A!pXth4\'29|FfR)p0!szDZMLUWZ~'5iLA$SYf2XJrI%^i(}*i2I*4iOd3Ix\' 4LdrzTJSqA2 -bI%s8Mf`!`P$2$4iTV/sRIj\fq#UZ?>E*;'\V-#BDx9Of3Y4A$SlF&2)@g"G?[zUFSY}b:< yMBk4Cg3z\FK.6"K#N#2@#OgUh\P)|$X,r+?!.$ hH&gzb^/ZGHduxWdqH8F pytcj':Tp4@I=ji>@M$"kWy$b25HE'\e3$9]l-cvp;yGf2I=vWb$sy|Y}lv\ SI$nbS:4_mr94>q6\"K!+PdJ`s9UnE%pn[pd`)M^RIg%`-g`R=jE(,,O+dR)l\$B+*n):L$a+MA`32bpy\j)"'n&H`R0*I%"uMebe`2;$$.-BE>'\MfrY4U$2)Dh])%SBlRk,8DhDNI:&S*dd=3q"pk@Uy$Nw'b3I|+4YDM~]/MRG%g"M3^(28AY qpH&b3EBPPJP7XP&R-"-6 %2IE)!|5C-&$Y$>@JFE'3CqqbI$&cbLD"gA;SI@APvd98)SyDl PDV%RYW&th4(,X"T&2I%}JNfD!_ ;xLI@c8zU.S;4^W'"e50pJCpMbg/kSIta438r#sI$drg$xS%39E2k3ZiSzH*2jEPd3YthU^T0hB@h!5IHyMRuV'5HuZ8_d&[0z4mSZ5"uiu\ #3XAipJ]u:4~5"mS,*Th ,@*v hvZ4 ,I*u5FWHk5^JLU5Y`&\VOVh-a7,CApCGqL&4yh,v AL&+U9J)r0OlPirvVJ]P4Asp;";S,Y@MhMj3`)B`-u{H=4lHZE0_p/A&D.-`.i[XhPcA`B(iS0Yb59L(<*\`lf`JDLp8bTCbkVB% vDR/BOL@:q02P\"B.iJ4AOBF J(Xi0P \,Lf+T,|qzO|th8,|`GC %!G.^+|Jjr,XBF&TXV""s"b)mWEqZ]^3 %"~. 1S;[(H20XAT&4`](p4@a"_L:>mARTrA0<$AO_B~)A?[XZ) (jSpJAtp#<&4V7-Fvh2HNdR1z4x9XmDrPkB:fB |BAaJir%PB#JFJmQCkVz\'@)@5a2pzb2f}Nyr7 J)R 7|5nGx'&ZZiR#@JUh:q<*RL@#i0[+VZ\KT\I8VS0=Z.e@cH?@c;x EUF*8RR#H#/fl_(&dG/n0Ie.5^k@8gPN@!31 n!'n,qAO(TYns1@8b*d}{Pda]AL|QK"(>&#e]#Tx=`Q!S*5.5V@-bS4E"(@(+Q#X?*Z\Hg!4zeN#O@7+h>(thq$5'L6(p2x@2S!d,7|4am$ .EdH2FL$EJ+VIFBgy Eq5qMP-=KBLu;L&_bFx&X(j8I"c!D`aHQmuz}ViTZM*OgW*4K4*=b}vKCT*MROhvjE>Oh5jUVT.5zM~' UEVuf=IU*5j5ZHdr;]oVkI<6i*j|jUB*PY+S)D2)$VbRYDD^q;XJl*x-Fk9jU~UX!U'uJHyP:uZqG(u^]6T2i=lE&*u9EQ9:*e5NuFPZ/G3L%JcI,.sKE:Yh`UEV)T*Sk}z%V](SpBQ*5I>j=N^Y4I-#2bd.k!0M-OdsxLv.7hoTAiQ$S)N'2hBd3*UBU"~_?"2YLN]*H&uPn3< $Sa}Zq2.Q[]\dR{&w)=~V(E&-zDIg5) Microsoft Corporation\"\n \"interseminating.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"interseminating.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"interseminating.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.dll at 42541-2820-00456AAF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1562.001","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe\" has section name .text with entropy \"6.680413749210956\"\n \"SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe\" has section name .rsrc with entropy \"7.0306436558551475\"\n \"interseminating.exe\" has section name .text with entropy \"6.680413749210956\"\n \"interseminating.exe\" has section name .rsrc with entropy \"7.0306436558551475\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"802589036ce25d00\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\aut8DBF.tmp\" has high entropy 7.915806833932149\n Dropped file \"%TEMP%\\aut84A6.tmp\" has high entropy 7.706739561731052\n Dropped file \"%TEMP%\\aut862E.tmp\" has high entropy 7.915806833932149\n Dropped file \"%TEMP%\\aut8BCA.tmp\" has high entropy 7.706739561731052","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 42541-2502-004467E9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"interseminating.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%LOCALAPPDATA%\\lophophorine\\interseminating.exe]- [targetUID: 00000000-00002076]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\" wrote 17408 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\lophophorine\\interseminating.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 193.122.130.0 on port 80 is sent without HTTP header\n TCP traffic to 104.21.112.1 on port 443 is sent without HTTP header\n TCP traffic to 149.154.167.220 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to empty the Recycle Bin on the specified drive","description":"SHEmptyRecycleBinW@SHELL32.dll at 42541-2612-0045028D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":3,"id":"stream-114","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.dll at 42541-2015-0041A856\n SystemParametersInfoW@USER32.dll at 42541-2868-00459F50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\aut84A6.tmp\" for deletion\n \"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\aut862E.tmp\" for deletion\n \"interseminating.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\aut8BCA.tmp\" for deletion\n \"interseminating.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\aut8DBF.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\aut84A6.tmp\" with delete access\n \"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\aut862E.tmp\" with delete access\n \"interseminating.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\aut8BCA.tmp\" with delete access\n \"interseminating.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\aut8DBF.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains ability to simulate user keyboard/mouse input","description":"keybd_event@USER32.dll at 42541-2453-0044411C\n mouse_event@USER32.dll at 42541-2841-004474E7\n mouse_event@USER32.dll at 42541-2843-004474BB\n mouse_event@USER32.dll at 42541-2844-00459B45\n mouse_event@USER32.dll at 42541-2852-00447513","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056","relevance":6,"id":"stream-35","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$3e","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"DllGetClassObject\" (Source: SATIN ALMA SPAR-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe, API is part of module: DWMAPI.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"interseminating.exe\" called \"CreateProcessW\" with parameter \"\"C:\\SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\"\" - (UID: 00000000-00005016)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"RegSvcs.exe\" connects to 193.122.130.0:80","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 42541-2499-00446606\n DeviceIoControl@KERNEL32.dll at 42541-2500-00446685\n DeviceIoControl@KERNEL32.dll at 42541-2501-00446713\n DeviceIoControl@KERNEL32.dll at 42541-2562-0044D0B8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"interseminating.exe\" set thread context in remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" (PID: 8f0)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\lophophorine\\interseminating.exe\" (Handle: 700)\n \"interseminating.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" (Handle: 712)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"checkip.dyndns.org\" (Indicator: \"checkip.dyndns.org\"; File: \"PCAP\")\n \"GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive\" (Indicator: \"checkip.dyndns.org\"; File: \"PCAP\")\n \"GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org\" (Indicator: \"checkip.dyndns.org\"; File: \"PCAP\")\n \"reallyfreegeoip.org\" (Indicator: \"reallyfreegeoip.org\"; File: \"PCAP\")\n \"GET /xml/64.124.12.162 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive\" (Indicator: \"reallyfreegeoip.org\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"checkip.dyndns.org\"\n \"reallyfreegeoip.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.dll at 42541-2518-004479D3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\" (UID: 00000000-00002076)\n Spawned process \"interseminating.exe\" with commandline \"\"C:\\\\SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\"\" (UID: 00000000-00005016)\n Spawned process \"RegSvcs.exe\" with commandline \"\"C:\\\\SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\"\" (UID: 00000000-00002288)\n Spawned process \"WScript.exe\" with commandline \"\"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\interseminating.vbs\"\" (UID: 00000000-00001696)\n Spawned process \"interseminating.exe\" (UID: 00000000-00000404)\n Spawned process \"RegSvcs.exe\" with commandline \"\"%LOCALAPPDATA%\\\\lophophorine\\\\interseminating.exe\"\" (UID: 00000000-00006628)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"}],"sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Writes a file to the startup folder"}],"sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":92,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["autoitinject","autoit","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"sandbox_reports":[{"id":"684fe72430767e3fd9049e47","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR","USA"],"submit_name":"SATIN ALMA SİPARİŞİ-SUMITOMO RUBBER AKO LASTIK SAN ve TIC AS_docx.exe","analysis_start_time":"2025-06-16T09:43:00+00:00","indicators_count":{"informative":197,"suspicious":64,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"193.122.130.0","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"address":"104.21.112.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"address":"149.154.167.220","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]}],"dns_resolutions":[{"domain":"api.telegram.org","address":"149.154.167.220","ttl":157,"country":"United Kingdom","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS-CLOUD-B4.GOOGLEDOMAINS.COM","registrar_creation_date":"2003-12-15T14:48:05+00:00","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"domain":"checkip.dyndns.org","address":"193.122.130.0","ttl":386,"country":"United States","registrar_name":"Tucows Inc.","registrar_organization":"Dynamic Network Services, Inc.","registrar_name_servers":"NS1.DYNDNS.ORG","registrar_creation_date":"1998-11-22T05:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"domain":"reallyfreegeoip.org","address":"104.21.112.1","ttl":300,"country":"United States","registrar_name":"Cloudflare, Inc.","registrar_organization":"DATA REDACTED","registrar_name_servers":"olga.ns.cloudflare.com","registrar_creation_date":"2018-10-20T21:17:41+00:00","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]}],"http_requests":[{"host":"checkip.dyndns.org","host_ip":"193.122.130.0:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"host":"reallyfreegeoip.org","host_ip":"104.21.112.1:443","url":"/xml/64.124.12.162","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /xml/64.124.12.162 HTTP/1.1\nHost: reallyfreegeoip.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}],"processes":[{"pid":2076,"ppid":0,"name":"SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe","command_line":"","sha256":"799bbb48a1f3d7822992b3d7d6388e0ee2b3d6c358ad7587d10e63a5d1cc6f72","normalized_path":"C:\\SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe","uid":"00000000-00002076","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":5016,"ppid":2076,"name":"interseminating.exe","command_line":"\"C:\\SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\"","sha256":"799bbb48a1f3d7822992b3d7d6388e0ee2b3d6c358ad7587d10e63a5d1cc6f72","normalized_path":"%LOCALAPPDATA%\\lophophorine\\interseminating.exe","parent_uid":"00000000-00002076","uid":"00000000-00005016"},{"pid":2288,"ppid":5016,"name":"RegSvcs.exe","command_line":"\"C:\\SATINALMAS_PAR_-SUMITOMORUBBERAKOLASTIKSANveTICAS_docx.exe\"","sha256":"c09191a1a46b7bfa82e381c5a0cc5fae83787d63f550a8bd6beaf33cc5c0c344","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe","parent_uid":"00000000-00005016","uid":"00000000-00002288"},{"pid":1696,"ppid":0,"name":"WScript.exe","command_line":"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\interseminating.vbs\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00001696","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABKElEQVR4Xs2RCxKDIAxEPbpH82a2yxgbtxsEDNO+mQzIJ7zEZXGs67pnh89/Cy5k8hcCXRIzBLZta5eYIQCaJWYJgCaJmoD9z5bwd/iNKpFASURr6htVWi7aPvFnvlACtrZAQkTZ2z+JrQuYuzQnXQKqcoYfx9wCa3y+WwBw1RYgejySGBKIqFWfKsCVRx3gfMDn8+clkQBjWX0H/H6NLgFQKtvbunC9qRkSAL5qNbZKdAuAU0J0oMRxrkViSABkdWJYAGR04pEAeNqJFAF+LBqVxLAA9u6iJDnOY0wTiNa5UpZIEShJedHhHwfpHVCJ/XipPtg7Pi9rkkiAE/OoJNTjfl2iBADWcbEW5fE39o055wFDAoDP3sH3jWGBLP5fgP/tjOB3f8oL77sC8VhaSzEAAAAASUVORK5CYII="},{"pid":404,"ppid":1696,"name":"interseminating.exe","command_line":"","sha256":"799bbb48a1f3d7822992b3d7d6388e0ee2b3d6c358ad7587d10e63a5d1cc6f72","normalized_path":"%LOCALAPPDATA%\\lophophorine\\interseminating.exe","parent_uid":"00000000-00001696","uid":"00000000-00000404"},{"pid":6628,"ppid":404,"name":"RegSvcs.exe","command_line":"\"%LOCALAPPDATA%\\lophophorine\\interseminating.exe\"","sha256":"c09191a1a46b7bfa82e381c5a0cc5fae83787d63f550a8bd6beaf33cc5c0c344","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe","parent_uid":"00000000-00000404","uid":"00000000-00006628"}],"all_imported_dlls":["user32.dll","msvcp_win.dll","SHCore.dll","powrprof.dll","userenv.dll","imm32.dll","rsaenh.dll","mscoree.dll","profapi.dll","ole32.dll","mscoreei.dll","System.Windows.Forms.dll","dhcpcsvc6.dll","dhcpcsvc.dll","msasn1.dll","apphelp.dll","psapi.dll","gdi32.dll","msctf.dll","mswsock.dll","OnDemandConnRouteHelper.dll","gdi32full.dll","ucrtbase.dll","fltLib.dll","FWPUCLNT.DLL","IPHLPAPI.DLL","clrjit.dll","System.Xml.ni.dll","rtutils.dll","clr.dll","comdlg32.dll","rpcrt4.dll","sspicli.dll","cryptbase.dll","shlwapi.dll","mpr.dll","cryptsp.dll","windows.storage.dll","version.dll","uxtheme.dll","System.Drawing.dll","Accessibility.dll","wininet.dll","ws2_32.dll","winhttp.dll","dnsapi.dll","winnsi.dll","secur32.dll","msvcrt.dll","combase.dll","Microsoft.VisualBasic.dll","schannel.dll","System.Web.Extensions.dll","dpapi.dll","wow64.dll","win32u.dll","sechost.dll","winmmbase.dll","mskeyprotect.dll","ncrypt.dll","dwmapi.dll","mscorlib.ni.dll","crypt32.dll","ntasn1.dll","KernelBase.dll","advapi32.dll","System.ni.dll","rasapi32.dll","ncryptsslp.dll","shell32.dll","VxSSL32.dll","ucrtbase_clr0400.dll","nsi.dll","System.Security.dll","ntdll.dll","kernel32.dll","System.Core.ni.dll","rasman.dll","gpapi.dll","bcrypt.dll","bcryptprimitives.dll","cfgmgr32.dll","winmm.dll","comctl32.dll","System.Configuration.ni.dll","wow64win.dll","wow64cpu.dll","kernel.appcore.dll","oleaut32.dll","wsock32.dll","vcruntime140_clr0400.dll","rasadhlp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"interseminating.vbs","sha256":"69fa0b16ab239525c828fce34e1cf0c184a767b3280b195b4dffa1b41572a13c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"interseminating.exe","sha256":"799bbb48a1f3d7822992b3d7d6388e0ee2b3d6c358ad7587d10e63a5d1cc6f72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"aut862E.tmp","sha256":"625012b2ba2d22c11d9897e60211f4d5229580584957a414fa5276c5314b31df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"aut84A6.tmp","sha256":"85575b5c0da7e7bd97e0c64191d5d25db29f1273b3ffdf8b9848afbd9c9201ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"aut8BCA.tmp","sha256":"85575b5c0da7e7bd97e0c64191d5d25db29f1273b3ffdf8b9848afbd9c9201ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"aut8DBF.tmp","sha256":"625012b2ba2d22c11d9897e60211f4d5229580584957a414fa5276c5314b31df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"schoolma","sha256":"c2aa2a955dec0817ae013e93d03dbabe8b81d08ad8be35dafa01f3a1c8ed42eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"teres","sha256":"534de5b236bb5539d36d6a50243fb1af9911a27bf7f021295a85befe3924db4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"name":"interseminating.vbs.bin","sha256":"69fa0b16ab239525c828fce34e1cf0c184a767b3280b195b4dffa1b41572a13c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]}],"files_written":[{"path":"%TEMP%\\aut84A6.tmp","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"path":"%TEMP%\\schoolma","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"path":"%TEMP%\\aut862E.tmp","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"path":"%TEMP%\\teres","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"path":"%LOCALAPPDATA%\\lophophorine\\interseminating.exe","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"path":"%TEMP%\\aut8BCA.tmp","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"path":"%TEMP%\\aut8DBF.tmp","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\interseminating.vbs","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"684fe72430767e3fd9049e47"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["684fe72430767e3fd9049e47"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample 799bbb48a1f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 799bbb48a1f3…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 12/28 AV engines flagged this file. 10 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/799bbb48a1f3d7822992b3d7d6388e0ee2b3d6c358ad7587d10e63a5d1cc6f72"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample 799bbb48a1f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 799bbb48a1f3…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 12/28 AV engines flagged this file. 10 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/799bbb48a1f3d7822992b3d7d6388e0ee2b3d6c358ad7587d10e63a5d1cc6f72"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample 799bbb48a1f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 799bbb48a1f3…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 12/28 AV engines flagged this file. 10 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3f","11",{}]]